radziel/spotlightcam
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9af4447e1df1e8906a0bfbb5c7404cceacc5aba3
spotlightcam/backend/package.json

73 lines
1.7 KiB
JSON
Raw Normal View History

feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
{
"name": "spotlightcam-backend",
"version": "1.0.0",
"description": "Backend API for spotlight.cam - P2P video exchange for dance events",
"main": "src/server.js",
"scripts": {
"start": "node src/server.js",
"dev": "nodemon src/server.js",
"test": "jest --coverage",
feat: add PostgreSQL database with Prisma ORM Phase 1 - Step 2: PostgreSQL Setup **Infrastructure:** - Add PostgreSQL 15 Alpine container to docker-compose.yml - Configure persistent volume for database data - Update backend Dockerfile with OpenSSL for Prisma compatibility **Database Schema (Prisma):** - 6 tables: users, events, chat_rooms, messages, matches, ratings - Foreign key relationships and cascading deletes - Performance indexes on frequently queried columns - Unique constraints for data integrity **Prisma Setup:** - Prisma Client for database queries - Migration system with initial migration - Seed script with 4 test events and chat rooms - Database connection utility with singleton pattern **API Implementation:** - GET /api/events - List all events (with filtering and sorting) - GET /api/events/:id - Get single event with relations - Database connection test on server startup - Graceful database disconnect on shutdown **Seed Data:** - Warsaw Dance Festival 2025 - Swing Camp Barcelona 2025 - Blues Week Herräng 2025 - Krakow Swing Connection 2025 **Testing:** - Database connection verified ✅ - API endpoints returning data from PostgreSQL ✅ - Migrations applied successfully ✅ All systems operational 🚀
2025-11-12 21:56:11 +01:00
"test:watch": "jest --watch",
"prisma:generate": "prisma generate",
"prisma:migrate": "prisma migrate dev",
"prisma:seed": "node prisma/seed.js",
feat(cli): add admin REPL + commands and docs - Add CLI entry in backend with default REPL, persistent history, aliases - Add commands: users:list/create/verify, events:list/details/participants/checkin, matches:list, logs:app, logs:messages - Support running subcommands inside REPL via .cli and run() - Add Makefile targets: dev-cli, prod-cli, dev/prod up/down (+rebuild) - Update README and add docs/ADMIN_CLI.md - Add CLI tests with mocked Prisma
2025-11-15 20:51:24 +01:00
"prisma:studio": "prisma studio",
"cli": "node src/cli/index.js"
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
},
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"keywords": [
"webrtc",
"p2p",
"video",
"dance",
"matchmaking"
],
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
"author": "",
"license": "ISC",
"dependencies": {
feat: add email verification, password reset, and WSDC integration (Phase 1.5) Backend features: - AWS SES email service with HTML templates - Email verification with dual method (link + 6-digit PIN code) - Password reset workflow with secure tokens - WSDC API proxy for dancer lookup and auto-fill registration - Extended User model with verification and WSDC fields - Email verification middleware for protected routes Frontend features: - Two-step registration with WSDC ID lookup - Password strength indicator component - Email verification page with code input - Password reset flow (request + reset pages) - Verification banner for unverified users - Updated authentication context and API service Testing: - 65 unit tests with 100% coverage of new features - Tests for auth utils, email service, WSDC controller, and middleware - Integration tests for full authentication flows - Comprehensive mocking of AWS SES and external APIs Database: - Migration: add WSDC fields (firstName, lastName, wsdcId) - Migration: add email verification fields (token, code, expiry) - Migration: add password reset fields (token, expiry) Documentation: - Complete Phase 1.5 documentation - Test suite documentation and best practices - Updated session context with new features
2025-11-13 15:47:54 +01:00
"@aws-sdk/client-ses": "^3.930.0",
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"@prisma/client": "^5.8.0",
"bcryptjs": "^2.4.3",
security: implement CRITICAL and MEDIUM security fixes with environment profiles This commit addresses all CRITICAL and MEDIUM security vulnerabilities identified in the security audit with environment-aware configuration. ## Docker Compose Profiles - Added docker-compose.dev.yml for development (relaxed security) - Added docker-compose.prod.yml for production (strict security) - Environment-specific configurations for rate limiting, CSRF, logging ## CRITICAL Fixes (P0) 1. Fixed insecure random number generation - Replaced Math.random() with crypto.randomBytes() for verification codes - Now cryptographically secure 2. Implemented rate limiting - express-rate-limit for all endpoints - Strict limits on auth endpoints (5 attempts in dev=off, prod=5) - Email endpoint limits (20 in dev, 3 in prod) - API-wide rate limiting 3. Added request body size limits - Development: 50MB (for testing) - Production: 10KB (security) 4. Fixed user enumeration vulnerability - Generic error message for registration - No disclosure of which field exists 5. Added security headers - helmet.js with CSP, HSTS, XSS protection - No-sniff, hide powered-by headers ## MEDIUM Fixes (P1) 6. Strengthened password policy - Environment-aware validation (8+ chars) - Production: requires uppercase, lowercase, number - Development: relaxed for testing 7. Enhanced input validation - Validation for all auth endpoints - WSDC ID validation (numeric, max 10 digits) - Name validation (safe characters only) - Email normalization 8. Added input sanitization - DOMPurify for XSS prevention - Sanitize all user inputs in emails - Timing-safe string comparison for tokens 9. Improved error handling - Generic errors in production - Detailed errors only in development - Proper error logging 10. Enhanced CORS configuration - Whitelist-based origin validation - Environment-specific allowed origins - Credentials support ## New Files - backend/src/config/security.js - Environment-aware security config - backend/src/middleware/rateLimiter.js - Rate limiting middleware - backend/src/utils/sanitize.js - Input sanitization utilities - backend/.env.example - Development environment template - backend/.env.production.example - Production environment template - docker-compose.dev.yml - Development overrides - docker-compose.prod.yml - Production configuration - docs/DEPLOYMENT.md - Complete deployment guide - docs/SECURITY_AUDIT.md - Full security audit report - .gitignore - Updated to exclude .env files ## Dependencies Added - helmet (^8.1.0) - Security headers - express-rate-limit (^8.2.1) - Rate limiting - dompurify (^3.3.0) - XSS prevention - jsdom (^27.2.0) - DOM manipulation for sanitization ## Testing - ✅ Password validation works (weak passwords rejected) - ✅ User enumeration fixed (generic error messages) - ✅ WSDC lookup functional - ✅ Registration flow working - ✅ Rate limiting active (environment-aware) - ✅ Security headers present ## Usage Development: docker compose -f docker-compose.yml -f docker-compose.dev.yml up Production: docker compose -f docker-compose.yml -f docker-compose.prod.yml up See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
"cookie-parser": "^1.4.7",
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
"cors": "^2.8.5",
security: implement CRITICAL and MEDIUM security fixes with environment profiles This commit addresses all CRITICAL and MEDIUM security vulnerabilities identified in the security audit with environment-aware configuration. ## Docker Compose Profiles - Added docker-compose.dev.yml for development (relaxed security) - Added docker-compose.prod.yml for production (strict security) - Environment-specific configurations for rate limiting, CSRF, logging ## CRITICAL Fixes (P0) 1. Fixed insecure random number generation - Replaced Math.random() with crypto.randomBytes() for verification codes - Now cryptographically secure 2. Implemented rate limiting - express-rate-limit for all endpoints - Strict limits on auth endpoints (5 attempts in dev=off, prod=5) - Email endpoint limits (20 in dev, 3 in prod) - API-wide rate limiting 3. Added request body size limits - Development: 50MB (for testing) - Production: 10KB (security) 4. Fixed user enumeration vulnerability - Generic error message for registration - No disclosure of which field exists 5. Added security headers - helmet.js with CSP, HSTS, XSS protection - No-sniff, hide powered-by headers ## MEDIUM Fixes (P1) 6. Strengthened password policy - Environment-aware validation (8+ chars) - Production: requires uppercase, lowercase, number - Development: relaxed for testing 7. Enhanced input validation - Validation for all auth endpoints - WSDC ID validation (numeric, max 10 digits) - Name validation (safe characters only) - Email normalization 8. Added input sanitization - DOMPurify for XSS prevention - Sanitize all user inputs in emails - Timing-safe string comparison for tokens 9. Improved error handling - Generic errors in production - Detailed errors only in development - Proper error logging 10. Enhanced CORS configuration - Whitelist-based origin validation - Environment-specific allowed origins - Credentials support ## New Files - backend/src/config/security.js - Environment-aware security config - backend/src/middleware/rateLimiter.js - Rate limiting middleware - backend/src/utils/sanitize.js - Input sanitization utilities - backend/.env.example - Development environment template - backend/.env.production.example - Production environment template - docker-compose.dev.yml - Development overrides - docker-compose.prod.yml - Production configuration - docs/DEPLOYMENT.md - Complete deployment guide - docs/SECURITY_AUDIT.md - Full security audit report - .gitignore - Updated to exclude .env files ## Dependencies Added - helmet (^8.1.0) - Security headers - express-rate-limit (^8.2.1) - Rate limiting - dompurify (^3.3.0) - XSS prevention - jsdom (^27.2.0) - DOM manipulation for sanitization ## Testing - ✅ Password validation works (weak passwords rejected) - ✅ User enumeration fixed (generic error messages) - ✅ WSDC lookup functional - ✅ Registration flow working - ✅ Rate limiting active (environment-aware) - ✅ Security headers present ## Usage Development: docker compose -f docker-compose.yml -f docker-compose.dev.yml up Production: docker compose -f docker-compose.yml -f docker-compose.prod.yml up See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
"csurf": "^1.11.0",
"dompurify": "^3.3.0",
feat: add PostgreSQL database with Prisma ORM Phase 1 - Step 2: PostgreSQL Setup **Infrastructure:** - Add PostgreSQL 15 Alpine container to docker-compose.yml - Configure persistent volume for database data - Update backend Dockerfile with OpenSSL for Prisma compatibility **Database Schema (Prisma):** - 6 tables: users, events, chat_rooms, messages, matches, ratings - Foreign key relationships and cascading deletes - Performance indexes on frequently queried columns - Unique constraints for data integrity **Prisma Setup:** - Prisma Client for database queries - Migration system with initial migration - Seed script with 4 test events and chat rooms - Database connection utility with singleton pattern **API Implementation:** - GET /api/events - List all events (with filtering and sorting) - GET /api/events/:id - Get single event with relations - Database connection test on server startup - Graceful database disconnect on shutdown **Seed Data:** - Warsaw Dance Festival 2025 - Swing Camp Barcelona 2025 - Blues Week Herräng 2025 - Krakow Swing Connection 2025 **Testing:** - Database connection verified ✅ - API endpoints returning data from PostgreSQL ✅ - Migrations applied successfully ✅ All systems operational 🚀
2025-11-12 21:56:11 +01:00
"dotenv": "^16.3.1",
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"express": "^4.18.2",
security: implement CRITICAL and MEDIUM security fixes with environment profiles This commit addresses all CRITICAL and MEDIUM security vulnerabilities identified in the security audit with environment-aware configuration. ## Docker Compose Profiles - Added docker-compose.dev.yml for development (relaxed security) - Added docker-compose.prod.yml for production (strict security) - Environment-specific configurations for rate limiting, CSRF, logging ## CRITICAL Fixes (P0) 1. Fixed insecure random number generation - Replaced Math.random() with crypto.randomBytes() for verification codes - Now cryptographically secure 2. Implemented rate limiting - express-rate-limit for all endpoints - Strict limits on auth endpoints (5 attempts in dev=off, prod=5) - Email endpoint limits (20 in dev, 3 in prod) - API-wide rate limiting 3. Added request body size limits - Development: 50MB (for testing) - Production: 10KB (security) 4. Fixed user enumeration vulnerability - Generic error message for registration - No disclosure of which field exists 5. Added security headers - helmet.js with CSP, HSTS, XSS protection - No-sniff, hide powered-by headers ## MEDIUM Fixes (P1) 6. Strengthened password policy - Environment-aware validation (8+ chars) - Production: requires uppercase, lowercase, number - Development: relaxed for testing 7. Enhanced input validation - Validation for all auth endpoints - WSDC ID validation (numeric, max 10 digits) - Name validation (safe characters only) - Email normalization 8. Added input sanitization - DOMPurify for XSS prevention - Sanitize all user inputs in emails - Timing-safe string comparison for tokens 9. Improved error handling - Generic errors in production - Detailed errors only in development - Proper error logging 10. Enhanced CORS configuration - Whitelist-based origin validation - Environment-specific allowed origins - Credentials support ## New Files - backend/src/config/security.js - Environment-aware security config - backend/src/middleware/rateLimiter.js - Rate limiting middleware - backend/src/utils/sanitize.js - Input sanitization utilities - backend/.env.example - Development environment template - backend/.env.production.example - Production environment template - docker-compose.dev.yml - Development overrides - docker-compose.prod.yml - Production configuration - docs/DEPLOYMENT.md - Complete deployment guide - docs/SECURITY_AUDIT.md - Full security audit report - .gitignore - Updated to exclude .env files ## Dependencies Added - helmet (^8.1.0) - Security headers - express-rate-limit (^8.2.1) - Rate limiting - dompurify (^3.3.0) - XSS prevention - jsdom (^27.2.0) - DOM manipulation for sanitization ## Testing - ✅ Password validation works (weak passwords rejected) - ✅ User enumeration fixed (generic error messages) - ✅ WSDC lookup functional - ✅ Registration flow working - ✅ Rate limiting active (environment-aware) - ✅ Security headers present ## Usage Development: docker compose -f docker-compose.yml -f docker-compose.dev.yml up Production: docker compose -f docker-compose.yml -f docker-compose.prod.yml up See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
"express-rate-limit": "^8.2.1",
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"express-validator": "^7.3.0",
security: implement CRITICAL and MEDIUM security fixes with environment profiles This commit addresses all CRITICAL and MEDIUM security vulnerabilities identified in the security audit with environment-aware configuration. ## Docker Compose Profiles - Added docker-compose.dev.yml for development (relaxed security) - Added docker-compose.prod.yml for production (strict security) - Environment-specific configurations for rate limiting, CSRF, logging ## CRITICAL Fixes (P0) 1. Fixed insecure random number generation - Replaced Math.random() with crypto.randomBytes() for verification codes - Now cryptographically secure 2. Implemented rate limiting - express-rate-limit for all endpoints - Strict limits on auth endpoints (5 attempts in dev=off, prod=5) - Email endpoint limits (20 in dev, 3 in prod) - API-wide rate limiting 3. Added request body size limits - Development: 50MB (for testing) - Production: 10KB (security) 4. Fixed user enumeration vulnerability - Generic error message for registration - No disclosure of which field exists 5. Added security headers - helmet.js with CSP, HSTS, XSS protection - No-sniff, hide powered-by headers ## MEDIUM Fixes (P1) 6. Strengthened password policy - Environment-aware validation (8+ chars) - Production: requires uppercase, lowercase, number - Development: relaxed for testing 7. Enhanced input validation - Validation for all auth endpoints - WSDC ID validation (numeric, max 10 digits) - Name validation (safe characters only) - Email normalization 8. Added input sanitization - DOMPurify for XSS prevention - Sanitize all user inputs in emails - Timing-safe string comparison for tokens 9. Improved error handling - Generic errors in production - Detailed errors only in development - Proper error logging 10. Enhanced CORS configuration - Whitelist-based origin validation - Environment-specific allowed origins - Credentials support ## New Files - backend/src/config/security.js - Environment-aware security config - backend/src/middleware/rateLimiter.js - Rate limiting middleware - backend/src/utils/sanitize.js - Input sanitization utilities - backend/.env.example - Development environment template - backend/.env.production.example - Production environment template - docker-compose.dev.yml - Development overrides - docker-compose.prod.yml - Production configuration - docs/DEPLOYMENT.md - Complete deployment guide - docs/SECURITY_AUDIT.md - Full security audit report - .gitignore - Updated to exclude .env files ## Dependencies Added - helmet (^8.1.0) - Security headers - express-rate-limit (^8.2.1) - Rate limiting - dompurify (^3.3.0) - XSS prevention - jsdom (^27.2.0) - DOM manipulation for sanitization ## Testing - ✅ Password validation works (weak passwords rejected) - ✅ User enumeration fixed (generic error messages) - ✅ WSDC lookup functional - ✅ Registration flow working - ✅ Rate limiting active (environment-aware) - ✅ Security headers present ## Usage Development: docker compose -f docker-compose.yml -f docker-compose.dev.yml up Production: docker compose -f docker-compose.yml -f docker-compose.prod.yml up See docs/DEPLOYMENT.md for detailed instructions.
2025-11-13 16:39:27 +01:00
"helmet": "^8.1.0",
"jsdom": "^27.2.0",
feat: implement real-time chat with Socket.IO Implemented WebSocket-based real-time messaging for both event rooms and private match chats using Socket.IO with comprehensive test coverage. Backend changes: - Installed socket.io@4.8.1 for WebSocket server - Created Socket.IO server with JWT authentication middleware - Implemented event room management (join/leave/messages) - Added active users tracking with real-time updates - Implemented private match room messaging - Integrated Socket.IO with Express HTTP server - Messages are persisted to PostgreSQL via Prisma - Added 12 comprehensive unit tests (89.13% coverage) Frontend changes: - Installed socket.io-client for WebSocket connections - Created socket service layer for connection management - Updated EventChatPage with real-time messaging - Updated MatchChatPage with real-time private chat - Added connection status indicators (● Connected/Disconnected) - Disabled message input when not connected Infrastructure: - Updated nginx config to proxy WebSocket connections at /socket.io - Added Upgrade and Connection headers for WebSocket support - Set long timeouts (7d) for persistent WebSocket connections Key features: - JWT-authenticated socket connections - Room-based architecture for events and matches - Real-time message broadcasting - Active users list with automatic updates - Automatic cleanup on disconnect - Message persistence in database Test coverage: - 12 tests passing (authentication, event rooms, match rooms, disconnect, errors) - Socket.IO module: 89.13% statements, 81.81% branches, 91.66% functions - Overall coverage: 81.19% Phase 1, Step 4 completed. Ready for Phase 2 (Core Features).
2025-11-12 22:42:15 +01:00
"jsonwebtoken": "^9.0.2",
"socket.io": "^4.8.1"
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
},
"devDependencies": {
"jest": "^29.7.0",
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"nodemon": "^3.0.2",
"prisma": "^5.8.0",
feat: implement real-time chat with Socket.IO Implemented WebSocket-based real-time messaging for both event rooms and private match chats using Socket.IO with comprehensive test coverage. Backend changes: - Installed socket.io@4.8.1 for WebSocket server - Created Socket.IO server with JWT authentication middleware - Implemented event room management (join/leave/messages) - Added active users tracking with real-time updates - Implemented private match room messaging - Integrated Socket.IO with Express HTTP server - Messages are persisted to PostgreSQL via Prisma - Added 12 comprehensive unit tests (89.13% coverage) Frontend changes: - Installed socket.io-client for WebSocket connections - Created socket service layer for connection management - Updated EventChatPage with real-time messaging - Updated MatchChatPage with real-time private chat - Added connection status indicators (● Connected/Disconnected) - Disabled message input when not connected Infrastructure: - Updated nginx config to proxy WebSocket connections at /socket.io - Added Upgrade and Connection headers for WebSocket support - Set long timeouts (7d) for persistent WebSocket connections Key features: - JWT-authenticated socket connections - Room-based architecture for events and matches - Real-time message broadcasting - Active users list with automatic updates - Automatic cleanup on disconnect - Message persistence in database Test coverage: - 12 tests passing (authentication, event rooms, match rooms, disconnect, errors) - Socket.IO module: 89.13% statements, 81.81% branches, 91.66% functions - Overall coverage: 81.19% Phase 1, Step 4 completed. Ready for Phase 2 (Core Features).
2025-11-12 22:42:15 +01:00
"socket.io-client": "^4.8.1",
feat: add JWT authentication with complete test coverage Phase 1 - Step 3: Authentication API **Backend Authentication:** - bcryptjs for password hashing (salt rounds: 10) - JWT tokens with 24h expiration - Secure password storage (never expose passwordHash) **API Endpoints:** - POST /api/auth/register - User registration - Username validation (3-50 chars, alphanumeric + underscore) - Email validation and normalization - Password validation (min 6 chars) - Duplicate email/username detection - Auto-generated avatar (ui-avatars.com) - POST /api/auth/login - User authentication - Email + password credentials - Returns JWT token + user data - Invalid credentials protection - GET /api/users/me - Get current user (protected) - Requires valid JWT token - Returns user data + stats (matches, ratings) - Token validation via middleware **Security Features:** - express-validator for input sanitization - Auth middleware for protected routes - Token verification (Bearer token) - Password never returned in responses - Proper error messages (no information leakage) **Frontend Integration:** - API service layer (frontend/src/services/api.js) - Updated AuthContext to use real API - Token storage in localStorage - Automatic token inclusion in requests - Error handling for expired/invalid tokens **Unit Tests (30 tests, 78.26% coverage):** Auth Endpoints (14 tests): - ✅ Register: success, duplicate email, duplicate username - ✅ Register validation: invalid email, short password, short username - ✅ Login: success, wrong password, non-existent user, invalid format - ✅ Protected route: valid token, no token, invalid token, malformed header Auth Utils (9 tests): - ✅ Password hashing and comparison - ✅ Different hashes for same password - ✅ JWT generation and verification - ✅ Token expiration validation - ✅ Invalid token handling All tests passing ✅ Coverage: 78.26% ✅
2025-11-12 22:16:14 +01:00
"supertest": "^6.3.3"
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
},
"jest": {
"testEnvironment": "node",
test(ratings): add comprehensive E2E test for ratings & stats flow Add end-to-end test verifying the complete ratings and stats update flow: - Auto match creation from suggestion acceptance - Both users rating each other - Stats updated exactly once (recordingsDone/recordingsReceived) - Manual matches do NOT update stats - Double-rating prevention (idempotency) Test coverage (9 scenarios): - STEP 1-3: Event creation, user enrollment, heat declaration - STEP 4: Matching algorithm execution + saveMatchingResults fix - STEP 5: Suggestion acceptance creates auto match (source='auto') - STEP 6a: First rating (no stats update yet) - STEP 6b: Second rating triggers stats update + match completion - STEP 7: Verify duplicate rating prevention - STEP 8: Verify manual matches don't affect fairness stats Infrastructure: - Add jest.setup.js to load .env.development for all tests - Update package.json to use setupFilesAfterEnv Documentation: - Mark S10 (Ratings & Stats) as ✅ IMPLEMENTED in TODO.md - Remove from Critical Gaps section - Add detailed implementation references All tests passing ✅
2025-11-30 19:18:09 +01:00
"setupFilesAfterEnv": ["<rootDir>/jest.setup.js"],
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
"coveragePathIgnorePatterns": [
"/node_modules/"
],
"testMatch": [
"**/__tests__/**/*.test.js"
test: add comprehensive test suite for Matches & Ratings API - Created matches.test.js with 24 tests covering: * Match creation and validation * Match listing and filtering * Match acceptance workflow * Match deletion * Rating creation and validation * User ratings display - Fixed Jest ES module issues: * Added mock for jsdom to bypass parse5 compatibility * Added mock for dompurify for test environment * Updated package.json with moduleNameMapper Test results: 19/24 passing (79%) Remaining: 5 tests need investigation
2025-11-14 23:12:08 +01:00
],
"moduleNameMapper": {
"^jsdom$": "<rootDir>/src/__mocks__/jsdom.js",
"^dompurify$": "<rootDir>/src/__mocks__/dompurify.js"
}
feat: add test accounts and secure event slugs Security improvements: - Add @default(cuid()) to Event.slug for auto-generated random slugs - Prevent ID enumeration attacks (no more predictable slugs like "warsaw-dance-festival-2025") - Event slugs now generated as secure cuid strings (e.g., "cmhz3lcgb00018vbn34v4phoi") Test accounts: - Add 3 test users to seed (john_dancer, sarah_swings, mike_blues) - All users checked in to Warsaw Dance Festival 2025 - Pre-configured heats for testing matchmaking system - Full profiles with WSDC IDs, social media, and locations Seed improvements: - Add bcryptjs for password hashing - Add Prisma seed configuration to package.json - Use worldsdcId for event upsert (instead of slug) - Auto-generate event slugs via Prisma default Documentation: - Add test account credentials to SESSION_CONTEXT.md - Document event slug security model - Include sample heats for each test user
2025-11-14 17:55:29 +01:00
},
"prisma": {
"seed": "node prisma/seed.js"
security: add nginx headers and fix npm vulnerabilities - Add security headers to nginx (X-Frame-Options, CSP, etc.) - Reduce client_max_body_size from 500M to 10M - Add npm overrides to fix cookie vulnerability in csurf - Make navbar sticky with full width
2025-11-29 15:04:26 +01:00
},
"overrides": {
"csurf": {
"cookie": "^0.7.0"
}
feat: add backend setup with Express and unit tests Backend Foundation (Phase 1 - Step 1): **Infrastructure:** - Add backend service to docker-compose.yml - Configure nginx to proxy /api/* to backend - Node.js 20 Alpine Docker container **Backend Setup:** - Express.js REST API server - CORS configuration - Request logging middleware - Error handling (404, 500) - Graceful shutdown on SIGTERM/SIGINT - Health check endpoint: GET /api/health **Testing:** - Jest + Supertest for unit tests - 7 test cases covering: - Health check endpoint - 404 error handling - CORS headers - JSON body parsing - Code coverage: 88.23% **Project Structure:** - backend/src/app.js - Express app setup - backend/src/server.js - Server entry point - backend/src/__tests__/ - Unit tests - backend/README.md - Backend documentation **Environment:** - .env.example template - Development configuration - Ready for PostgreSQL integration All tests passing ✅
2025-11-12 21:42:52 +01:00
}
}
Reference in New Issue Copy Permalink