mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
999fc257ae
Five hotfix-ready findings from the v1.4.34.3 code-quality audit. SESSION_SECRET drop (F-3): The env var was required by `docker-entrypoint.sh`, listed in `.env.example`, `docker-compose.yml`, `CONTRIBUTING.md`, and the scaling guide — but `grep -rn SESSION_SECRET src/` returned nothing. Sessions are server-stored in `prisma.session` keyed by the cookie value; the secret signed nothing. Every self-hoster carried a ceremonial 64-char hex string that the app ignored. Removed everywhere except the README (separate batch). Each fresh install now generates 3 secrets, not 4. toJson helper (F-9): Seven sites cast Prisma JSON writes via `value as unknown as Prisma.InputJsonValue`. Each call re-invented the same escape hatch. Replaced with one helper in `src/lib/db.ts`: `export const toJson = <T>(v: T) => v as unknown as Prisma.InputJsonValue;` Migrated all 7 call sites: `auth/me/doctor-report-prefs`, `dashboard/chart-overlay-prefs`, `dashboard/widgets`, `integrations/healthkit`, and 4 sites in `apple-health-import-worker`. The helper has a one-line WHY comment + a unit test pinning the cast shape stays stable. db-compat docstring (F-10): `src/lib/db-compat.ts` looks like accumulated backwards-compat cruft on first read. It's actually the schema-bootstrap path that runs ALTER-TABLE-IF-NOT-EXISTS so a fresh container syncs without `prisma migrate deploy`. Added a header docstring naming the role and pointing at `prisma/migrations/` as the canonical history. Passkey types (F-11): `src/lib/auth/passkey.ts:103,169` used `response: any` with per-line `eslint-disable`. Imported `RegistrationResponseJSON` and `AuthenticationResponseJSON` from `@simplewebauthn/types` and dropped the disables. Zero-TODO CI gate (F-15): The audit confirmed product code has zero TODO / FIXME / XXX / HACK markers — genuinely rare and worth preserving. Added a tiny GitHub Actions workflow at `.github/workflows/no-todo-markers.yml` that fails the build on any future re-introduction. Test files are excluded; product code only.
54 lines
2.1 KiB
Bash
54 lines
2.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# ── Validate required env vars ───────────────────────────────
|
|
# We do this in the entrypoint instead of in docker-compose.yml's
|
|
# environment block (which used to use the ${VAR:?error} syntax)
|
|
# because some hosting platforms parse compose files eagerly and
|
|
# end up storing the fallback error string as the literal value.
|
|
# Validating here guarantees a clear, deploy-platform-agnostic
|
|
# failure message before we touch the database.
|
|
missing=""
|
|
for var in DATABASE_URL ENCRYPTION_KEY API_TOKEN_HMAC_KEY; do
|
|
eval "value=\$$var"
|
|
if [ -z "$value" ]; then
|
|
missing="$missing $var"
|
|
fi
|
|
done
|
|
if [ -n "$missing" ]; then
|
|
echo "HealthLog: ERROR — required env vars not set:$missing" >&2
|
|
echo "HealthLog: see .env.example for the full list and how to generate each value." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# ── Wait for PostgreSQL ──────────────────────────────────────
|
|
MAX_RETRIES=30
|
|
RETRY=0
|
|
|
|
echo "HealthLog: Waiting for database..."
|
|
until node -e "
|
|
const { createConnection } = require('net');
|
|
const url = new URL(process.env.DATABASE_URL);
|
|
const sock = createConnection(Number(url.port) || 5432, url.hostname);
|
|
sock.on('connect', () => { sock.destroy(); process.exit(0); });
|
|
sock.on('error', () => process.exit(1));
|
|
" 2>/dev/null; do
|
|
RETRY=$((RETRY + 1))
|
|
if [ "$RETRY" -ge "$MAX_RETRIES" ]; then
|
|
echo "HealthLog: ERROR — Database not reachable after ${MAX_RETRIES}s, aborting." >&2
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
done
|
|
echo "HealthLog: Database is reachable."
|
|
|
|
# ── Run Prisma migrations ────────────────────────────────────
|
|
echo "HealthLog: Running database migrations..."
|
|
NODE_PATH=/opt/prisma-cli/node_modules \
|
|
node /opt/prisma-cli/node_modules/prisma/build/index.js migrate deploy
|
|
echo "HealthLog: Migrations complete."
|
|
|
|
# ── Start application ────────────────────────────────────────
|
|
echo "HealthLog: Starting application..."
|
|
exec "$@"
|