feat: implement security, error resilience, and query optimization proposals

Security Validation (enhance-security-validation):
- JWT secret validation with entropy checking and pattern detection
- CSRF protection middleware with token generation/validation
- Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests
- MIME type validation with magic bytes detection for file uploads

Error Resilience (add-error-resilience):
- React ErrorBoundary component with fallback UI and retry functionality
- ErrorBoundaryWithI18n wrapper for internationalization support
- Page-level and section-level error boundaries in App.tsx

Query Performance (optimize-query-performance):
- Query monitoring utility with threshold warnings
- N+1 query fixes using joinedload/selectinload
- Optimized project members, tasks, and subtasks endpoints

Bug Fixes:
- WebSocket session management (P0): Return primitives instead of ORM objects
- LIKE query injection (P1): Escape special characters in search queries

Tests: 543 backend tests, 56 frontend tests passing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
beabigegg
2026-01-11 18:41:19 +08:00
parent 2cb591ef23
commit 679b89ae4c
41 changed files with 3673 additions and 153 deletions

View File

@@ -239,6 +239,8 @@ class TestAttachmentAPI:
def test_delete_attachment(self, client, test_user_token, test_task, db):
"""Test soft deleting an attachment."""
from app.core.security import generate_csrf_token
attachment = Attachment(
id=str(uuid.uuid4()),
task_id=test_task.id,
@@ -252,9 +254,15 @@ class TestAttachmentAPI:
db.add(attachment)
db.commit()
# Generate CSRF token for the user
csrf_token = generate_csrf_token(test_task.created_by)
response = client.delete(
f"/api/attachments/{attachment.id}",
headers={"Authorization": f"Bearer {test_user_token}"},
headers={
"Authorization": f"Bearer {test_user_token}",
"X-CSRF-Token": csrf_token,
},
)
assert response.status_code == 200