till/managarten
1
0
Fork 0
mirror of https://github.com/Memo-2023/mana-monorepo.git synced 2026-05-15 05:21:10 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
managarten/services
History
Till JS 4ff3ceb01a harden(mana-sync): fix WebSocket auth, add validation, tests, and docs 
Critical security and correctness fixes for the sync server:

Security:
- Fix WebSocket JWT validation — was completely broken (hardcoded
  "pending-auth"). Now validates JWT via JWKS, rejects invalid tokens,
  enforces 10-second auth deadline, sends auth-ok confirmation.
- Add 10 MB request body size limit (prevents OOM attacks)
- Validate op field (must be insert/update/delete)
- Validate table and id fields (must be non-empty)
- Abort sync on RecordChange failure (was silently continuing)

Correctness:
- Fix silent JSON unmarshal errors in store (now returns error)
- Copy client set before iterating in NotifyUser (prevents race)
- Add write timeout on WebSocket notifications

Testing (19 tests, 0 -> 100% for unit-testable code):
- auth: token extraction, validator init, missing auth handling
- config: defaults, env override, invalid port
- sync: op validation, changeset validation, response format,
  field change round-trip, body size constant

Documentation:
- Add CLAUDE.md with architecture, sync protocol, LWW explanation,
  API endpoints, configuration, security notes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 02:41:56 +01:00
..
it-landing feat: add it.mana.how landing page for European tech sovereignty 2026-03-24 10:04:59 +01:00
mana-analytics feat(services): create mana-analytics, remove feedback/analytics/ai from auth 2026-03-28 02:29:24 +01:00
mana-api-gateway-go feat(infra): consolidate 21 Matrix bots into Go binary + add Go API gateway 2026-03-27 21:03:00 +01:00
mana-core-auth feat(services): create mana-analytics, remove feedback/analytics/ai from auth 2026-03-28 02:29:24 +01:00
mana-crawler-go fix(crawler): skip TLS verification for outgoing crawl requests 2026-03-27 22:31:03 +01:00
mana-credits feat(infra): add mana-credits to docker-compose, fix port to 3061 2026-03-27 22:21:54 +01:00
mana-image-gen fix(mana-notify): resolve BullMQ circular import issue 2026-01-29 22:58:47 +01:00
mana-landing-builder fix(landing-builder): rework Dockerfile to copy workspace directly 2026-03-23 13:50:22 +01:00
mana-llm feat(mana-llm): add Google Gemini fallback provider with auto-routing 2026-03-23 22:44:09 +01:00
mana-matrix-bot feat(infra): consolidate 21 Matrix bots into Go binary + add Go API gateway 2026-03-27 21:03:00 +01:00
mana-media fix(mana-media): use prom-client directly instead of shared metrics package 2026-03-23 11:06:09 +01:00
mana-notify-go test(go-services): add unit tests for mana-search-go and mana-notify-go 2026-03-28 02:33:59 +01:00
mana-search-go test(go-services): add unit tests for mana-search-go and mana-notify-go 2026-03-28 02:33:59 +01:00
mana-stt feat(gpu-server): complete GPU server setup with AI services, monitoring, and public access 2026-03-27 21:35:30 +01:00
mana-sync harden(mana-sync): fix WebSocket auth, add validation, tests, and docs 2026-03-28 02:41:56 +01:00
mana-tts 📝 docs(tts): document German voice support (Piper/Kerstin) 2026-02-14 12:21:40 +01:00
mana-user feat(infra): add mana-sync and mana-notify-go to docker-compose 2026-03-27 22:35:05 +01:00
mana-voice-bot feat(mana-voice-bot): add German voice-to-voice assistant service 2026-02-01 02:21:13 +01:00
ollama-metrics-proxy feat(telegram-bot): add local STT support and Prometheus metrics 2026-01-27 16:51:09 +01:00