scriptoriumadmin/veritas-kanban
1
0
Fork 0
mirror of https://github.com/BradGroux/veritas-kanban.git synced 2026-09-09 06:31:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
veritas-kanban/refactoring
History
Exact
Brad Groux 774673b80a fix(security): RF-002 — path traversal, admin authz, agent status WebSocket 
SEC-001: Path traversal prevention
- Add validatePathSegment() and ensureWithinBase() to server/src/utils/sanitize.ts
- Apply to chat-service (sessionId/taskId in file paths)
- Apply to conflict-service (filePath in path.join)
- Apply to clawdbot-agent-service (taskId/attemptId in log/request paths)

SEC-007: Admin authorization on mutating endpoints
- settings.ts: PATCH /features requires authorize('admin')
- config.ts: POST/PATCH/DELETE repos, PUT agents, PUT default-agent
- activity.ts: DELETE / requires authorize('admin')
- notifications.ts: POST/mark-sent/check require authorize('admin','agent'), DELETE requires admin
- status-history.ts: DELETE / requires authorize('admin')
- Updated test harnesses with admin auth injection

Agent Status Indicator: WebSocket fix
- BoardSidebar now uses useRealtimeAgentStatus (WebSocket) instead of useGlobalAgentStatus (polling)
- Fixed field name mismatch: server broadcasts 'activeAgents' but hook expected 'subAgents'
- Hook now correctly reads activeAgents from both WebSocket messages and REST fallback
- Added connection status indicator and stale detection to sidebar
- Fixed agent-status.ts spread order for persisted status restore

Pre-existing fixes included (from earlier RF-002 sub-agent diffs):
- auth.ts: X-Forwarded-For only trusted when trust proxy configured
- rate-limit.ts: isLocalhost returns false in production
- telemetry-service: CSV formula injection prefix sanitization
- Frontend: window.open noopener/noreferrer on all instances
2026-02-02 09:09:15 -06:00
..
rf-001-phase1-presentation.pptx fix(security): RF-002 — path traversal, admin authz, agent status WebSocket 2026-02-02 09:09:15 -06:00
rf-002-executive-summary.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002-presentation.html feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002-presentation.mp4 fix(security): RF-002 — path traversal, admin authz, agent status WebSocket 2026-02-02 09:09:15 -06:00
rf-002-presentation.pptx fix(security): RF-002 — path traversal, admin authz, agent status WebSocket 2026-02-02 09:09:15 -06:00
rf-002a-batch1-middleware-storage-schemas.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002a-batch2-routes.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002a-batch3a-services-part1.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002a-batch3b-services-part2.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002a-executive-summary.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002b-batch1-components-part1.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002b-batch2-components-part2.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002b-batch3-hooks-lib-utils.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-002c-shared-layer.md feat: RF-002 cross-model code audit — full codebase 2026-02-02 05:39:01 -06:00
rf-cross-model-audit-complete.pptx fix(security): RF-002 — path traversal, admin authz, agent status WebSocket 2026-02-02 09:09:15 -06:00