mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
ca03c6099f
Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: - Bearer auth fail-closed when a route declares no scope (api-handler) - Public /api/send Umami proxy now rate-limits 120 req/min/IP - Proxy nonce generation switched to btoa(...) for Edge portability - Session-expiry delete race uses deleteMany + catch (no more 500s) - POST /api/import returns the standard apiError envelope on 422 - Runtime Docker image pins Prisma 7.8 + worker deps to minors - Notifications page renders a real load-error alert - Accessibility: switch aria-labels, htmlFor pairing, mobile admin Overview link, deep-link anchors on notification settings - Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/ sleep/steps overlay keys, TrendCard layout tolerates long labels Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244) && pnpm format:check all green.
59 lines
2.0 KiB
TypeScript
59 lines
2.0 KiB
TypeScript
#!/usr/bin/env tsx
|
|
/**
|
|
* Compare the freshly-generated OpenAPI spec against the committed
|
|
* `docs/api/openapi.yaml`. Exits non-zero on drift.
|
|
*
|
|
* Used by the CI gate in `.github/workflows/security.yml`. v1.4.23 runs
|
|
* the step with `continue-on-error: true` while the registry catches
|
|
* up with the hand-maintained spec; v1.4.24+ flips it to hard-fail.
|
|
*/
|
|
import { readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
import { stringify } from "yaml";
|
|
import { buildOpenApiDocument } from "../src/lib/openapi/registry";
|
|
|
|
const SPEC_PATH = resolve(__dirname, "..", "docs", "api", "openapi.yaml");
|
|
|
|
function main(): void {
|
|
const document = buildOpenApiDocument();
|
|
const generated = stringify(document, {
|
|
sortMapEntries: true,
|
|
lineWidth: 120,
|
|
});
|
|
const committed = readFileSync(SPEC_PATH, "utf8");
|
|
if (generated === committed) {
|
|
console.log("OpenAPI spec in sync with source schemas.");
|
|
return;
|
|
}
|
|
console.error(
|
|
"OpenAPI spec drift detected. Run `pnpm openapi:generate` and commit the result.",
|
|
);
|
|
// Surface a unified-diff-ish hint so PR reviewers see what changed
|
|
// without having to re-run the generator locally.
|
|
const genLines = generated.split("\n");
|
|
const onDiskLines = committed.split("\n");
|
|
const max = Math.max(genLines.length, onDiskLines.length);
|
|
for (let i = 0; i < max; i++) {
|
|
if (genLines[i] !== onDiskLines[i]) {
|
|
console.error(
|
|
`Line ${i + 1}:\n generated: ${JSON.stringify(genLines[i] ?? "")}\n committed: ${JSON.stringify(onDiskLines[i] ?? "")}`,
|
|
);
|
|
// Limit the noise — first 5 mismatched lines is enough to point
|
|
// the maintainer at the regenerate command.
|
|
let shown = 1;
|
|
for (let j = i + 1; j < max && shown < 5; j++) {
|
|
if (genLines[j] !== onDiskLines[j]) {
|
|
console.error(
|
|
`Line ${j + 1}:\n generated: ${JSON.stringify(genLines[j] ?? "")}\n committed: ${JSON.stringify(onDiskLines[j] ?? "")}`,
|
|
);
|
|
shown++;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
process.exit(1);
|
|
}
|
|
|
|
main();
|