beabigegg
|
35c90fe76b
|
feat: implement 5 QA-driven security and quality proposals
Implemented proposals from comprehensive QA review:
1. extend-csrf-protection
- Add POST to CSRF protected methods in frontend
- Global CSRF middleware for all state-changing operations
- Update tests with CSRF token fixtures
2. tighten-cors-websocket-security
- Replace wildcard CORS with explicit method/header lists
- Disable query parameter auth in production (code 4002)
- Add per-user WebSocket connection limit (max 5, code 4005)
3. shorten-jwt-expiry
- Reduce JWT expiry from 7 days to 60 minutes
- Add refresh token support with 7-day expiry
- Implement token rotation on refresh
- Frontend auto-refresh when token near expiry (<5 min)
4. fix-frontend-quality
- Add React.lazy() code splitting for all pages
- Fix useCallback dependency arrays (Dashboard, Comments)
- Add localStorage data validation in AuthContext
- Complete i18n for AttachmentUpload component
5. enhance-backend-validation
- Add SecurityAuditMiddleware for access denied logging
- Add ErrorSanitizerMiddleware for production error messages
- Protect /health/detailed with admin authentication
- Add input length validation (comment 5000, desc 10000)
All 521 backend tests passing. Frontend builds successfully.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2026-01-12 23:19:05 +08:00 |
|
beabigegg
|
f5f870da56
|
Fix test failures and workload/websocket behavior
|
2026-01-11 08:37:21 +08:00 |
|
beabigegg
|
64874d5425
|
feat: enhance weekly report and realtime notifications
Weekly Report (fix-weekly-report):
- Remove 5-task limit, show all tasks per category
- Add blocked tasks with blocker_reason and blocked_since
- Add next week tasks (due in coming week)
- Add assignee_name, completed_at, days_overdue to task details
- Frontend collapsible sections for each task category
- 8 new tests for enhanced report content
Realtime Notifications (fix-realtime-notifications):
- SQLAlchemy event-based notification publishing
- Redis Pub/Sub for multi-process broadcast
- Fix soft rollback handler stacking issue
- Fix ping scheduling drift (send immediately when interval expires)
- Frontend NotificationContext with WebSocket reconnection
Spec Fixes:
- Add missing ## Purpose sections to 5 specs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2025-12-30 20:52:08 +08:00 |
|
beabigegg
|
95c281d8e1
|
feat: implement automation module
- Event-based triggers (Phase 1):
- Trigger/TriggerLog models with field_change type
- TriggerService for condition evaluation and action execution
- Trigger CRUD API endpoints
- Task integration (status, assignee, priority changes)
- Frontend: TriggerList, TriggerForm components
- Weekly reports (Phase 2):
- ScheduledReport/ReportHistory models
- ReportService for stats generation
- APScheduler for Friday 16:00 job
- Report preview/generate/history API
- Frontend: WeeklyReportPreview, ReportHistory components
- Tests: 23 new tests (14 triggers + 9 reports)
- OpenSpec: add-automation change archived
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2025-12-29 22:59:00 +08:00 |
|