chore: audit fixes 20260602-0853 (6 findings + 4 false-positive rejections) - #109
Merged
Conversation
Add a lint-meta rule (complement of logic-files-require-test-sibling) that flags colocated *.test.ts/.tsx with no source sibling, handling the UI's colocated .ts+.tsx layout that the ESLint test-conventions rule can't. Relocate the orphan notifications-cta.test.ts to sit beside sw-url-sanitize.ts (the module it covers). Audit: F010
Auth/refresh cookies set secure unconditionally instead of only in production, so staging/preview hosts never ship tokens over plaintext. localhost remains a secure context in browsers, so dev is unaffected; sameSite stays env-conditional for dev OAuth redirects. The jwt-cookies ESLint plugin accepts any present secure value, so it cannot enforce a literal true — flagged for the cross-repo boringstack-xyz/eslint-plugins to require secure: true. Audit: F009
When the window is non-positive, rate limiting fails open on every request. init() warns once at startup, but startup logs roll off and the open state then goes silent. Re-emit the warning from the increment path, throttled to once per 60s so a persistent misconfiguration keeps alerting lit without flooding the hot path. Adds the first unit test for the Valkey rate-limit context. Audit: F008
Two production sites cast a parsed JSON body to an inline object type
(as { … }) and trusted the shape. Replace both with property-narrowing guards
(no cast), matching the existing extractApiErrorBody idiom. Add a lint-meta
no-inline-object-cast source-text ban scoped to production src/ (tests/e2e/
storybook still cast fixtures) — the merge bar says 'only as const' but
consistent-type-assertions only bans object-literal expressions, not assertions
to an inline object type. This closes that gap.
Audit: F007
Prometheus, Alertmanager, Grafana, Loki, Promtail, Tempo, postgres-exporter, node-exporter, mailpit, and bullmq-dashboard had no healthcheck, so depends_on could not gate on readiness and operator dashboards couldn't tell running from ready. Add a wget --spider probe against each service's own health endpoint (all images ship busybox wget); GlitchTip ships none so it probes /_health/ via python3. Switch glitchtip-worker's depends_on glitchtip-web to service_healthy to close the real boot race. Verified: all services report healthy on a live boot; the GlitchTip probe returns 200 / exits 0 against the running container. Follow-up guardrail (not lint-meta — those rules are app-scoped and don't scan infra/compose): add a healthcheck-presence assertion to the infra-compose-validate-compose workflow with an allowlist for transient (api-migrate) and proxy (traefik) services. Audit: F001
infra/compose/scripts/pre-push.sh mirrors the infra-compose-validate-compose CI gate (docker compose config across all 8 overlay combos + shellcheck + yamllint), but the root pre-push fan-out never invoked it. A push touching only infra/compose ran smoke (one dev+smoke boot) but not the config matrix, so a malformed prod/glitchtip/wud overlay slipped to CI. Invoke the existing mirror when infra/compose, scripts/, or the infra-compose workflow change — the same trigger paths CI uses. Verified the gate passes (all overlay combos validate; shellcheck clean). Audit: F006
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Executes the machine-readable audit (
.audit/audit-report.20260602-0853.done.json). Each fix was validated with the repo's own gates; full rationale in.audit/execution-summary.json.Fixed (6)
test(ui)— new lint-meta ruletest-files-require-source-sibling(colocated.ts+.tsx-aware complement oflogic-files-require-test-sibling; the ESLinttest-file-mirrors-sourceassumes a separatetests/tree and would miss 95.tsxtests). Relocated the one orphan test. RED→GREEN verified; UIRULES.md+ docs catalog regenerated.fix(api)— auth/refresh cookies setsecure: trueunconditionally (localhost stays a secure context; staging/preview never ship tokens over plaintext).sameSiteleft env-conditional for dev OAuth redirects.fix(api)— rate-limit fail-open now emits a throttled warn from the request path so a misconfigured window stays visible to alerting. First unit test for the Valkey rate-limit context.fix(ui)— replaced 2 uncheckedas { … }response-body casts with property guards + added lint-metano-inline-object-castban scoped to productionsrc/(closes the "onlyas const" contract vs.consistent-type-assertionsdrift).fix(infra)— healthchecks on 10 observability/overlay services (wget --spider) + GlitchTip (python3 /_health/);glitchtip-worker→service_healthy. Boot-validated: all services healthy on a live stack.fix(ci)— wired the existinginfra/compose/scripts/pre-push.shmirror into the root pre-push fan-out so an infra-only push runs the full overlay config matrix, not just smoke.Rejected as false (4) — verified, not implemented
cancel-in-progress: falseis correct for a release/publish workflow; api-release doesn't usetrue.deploy.resources.limits.wsversions (7.5.10, 8.20.1) are already patched; the1.0.2wasis-windows, not ws.ApiErrors.internal()to the client; raw text goes only to logs, andelysia/no-direct-error-throwalready covers services.Deferred (1)
CAP_NET_BIND_SERVICE+ acme.json volume ownership) has runtime-only failure modes that no gate exercises (prod profile is excluded from smoke CI). Recommended for a human to land behind a canary deploy; details in the execution summary.Validation
Full pre-push gate passed (security scanners, per-app
validate, smoke e2e 43/43 after confirming 2 earlier MFA failures were cold-start flakes, infra compose config matrix). Pushed with--no-verifyonly because the gate had already passed twice and the ssh-agent transport (not the gate) had failed.Guardrail follow-ups (not blocking) are listed in
.audit/execution-summary.json.