Security hardening, test coverage, and deployment docs

CLAUDE.md

@@ -246,7 +246,7 @@ Deployed via **Coolify** using **Dockerfile**. Config in `Dockerfile` + `docker-
 
 - Next.js uses `output: "standalone"` for containerized deployment
 - `SKIP_ENV_VALIDATION=true` is set at build time to bypass t3-env validation (runtime secrets aren't available during build)
-- Docker build: install deps → generate Prisma client → build Next.js → copy static assets
+- Docker build: install deps → build Drizzle migration bundle → build Next.js → copy static assets
 - Start command: `node apps/web/.next/standalone/apps/web/server.js`
 - PostgreSQL 17 Alpine as a separate Coolify service
 - Instance-specific notes live in `coolify.md` (gitignored)

Dockerfile

@@ -37,6 +37,8 @@ COPY --from=build /app/apps/web/.next/static ./apps/web/.next/static
 COPY --from=build /app/packages/db/migrate.js ./packages/db/migrate.js
 COPY --from=build /app/packages/db/drizzle ./packages/db/drizzle
 COPY docker-entrypoint.sh ./
+RUN chown -R node:node /app && chmod +x /app/docker-entrypoint.sh
+USER node
 
 EXPOSE 3000
 ENTRYPOINT ["./docker-entrypoint.sh"]

README.md

@@ -1,11 +1,13 @@
 # Dirework - Pomodoro Timer and Task List for Twitch
 
-Self-hosted Pomodoro timer and task list built for Twitch
-co-working and body-doubling streams. Your viewers join the
-grind through chat commands while customizable OBS overlays
-keep everyone focused and in sync.
+Dirework is a personal project built for my own Twitch
+co-working and body-doubling streams. It combines a
+Pomodoro timer, viewer task list, and Twitch chat bot into
+a single self-hosted tool with customizable OBS overlays.
 
-One streamer, one instance, zero distractions.
+It is open source. If you want the same setup for your own
+channel, fork it and run your own instance — one streamer,
+one instance, zero distractions.
 
 ## Features
 
@@ -104,7 +106,7 @@ command aliases.
 ### Prerequisites
 
 - Node.js 20+
-- pnpm 10+
+- Bun 1.0+
 - Docker (for PostgreSQL)
 - A Twitch Developer Application
   ([dev.twitch.tv](https://dev.twitch.tv/console))
@@ -121,7 +123,7 @@ command aliases.
 2. Install dependencies:
 
    ```bash
-   pnpm install
+   bun install
    ```
 
 3. Configure environment variables in `apps/web/.env`:
@@ -138,30 +140,30 @@ command aliases.
 4. Start the database:
 
    ```bash
-   pnpm db:start
+   bun db:start
    ```
 
 5. Push the schema:
 
    ```bash
-   pnpm db:push
+   bun db:push
    ```
 
 6. Start the dev server:
 
    ```bash
-   pnpm dev
+   bun dev
    ```
 
 ### Development Scripts
 
-- `pnpm dev` - Start all apps (web on port 3001, docs on port 4000)
-- `pnpm build` - Build all apps for production
-- `pnpm check-types` - Run TypeScript type checking
-- `pnpm test` - Run unit tests across all packages
-- `pnpm dev:web` - Start the web app only
-- `pnpm db:start` - Start PostgreSQL via Docker
-- `pnpm db:stop` - Stop PostgreSQL
+- `bun dev` - Start all apps (web on port 3001, docs on port 4000)
+- `bun build` - Build all apps for production
+- `bun check-types` - Run TypeScript type checking
+- `bun test` - Run unit tests across all packages
+- `bun dev:web` - Start the web app only
+- `bun db:start` - Start PostgreSQL via Docker
+- `bun db:stop` - Stop PostgreSQL
 - `bun run db:push` - Push Drizzle schema to database (dev only, no migration file)
 - `bun run db:generate` - Generate a new Drizzle migration from schema changes
 - `bun run db:migrate` - Apply pending Drizzle migrations
@@ -173,7 +175,7 @@ command aliases.
 - Tests cover timer state machine, config build/flatten helpers,
   round-trip consistency, display utilities, task grouping, and
   event emitter isolation
-- Run with `pnpm test`
+- Run with `bun test`
 
 ### Code Quality
 
@@ -201,7 +203,7 @@ dirework/
 
 ## License
 
-![GitHub license](https://img.shields.io/github/license/mrdemonwolf/dirework.svg?style=for-the-badge&logo=github)
+[![GitHub license](https://img.shields.io/github/license/MrDemonWolf/dirework.svg?style=for-the-badge&logo=github)](https://github.com/MrDemonWolf/dirework/blob/main/LICENSE)
 
 ## Contact
 

apps/web/instrumentation.ts

@@ -5,14 +5,14 @@ export async function register() {
     const { botService } = await import("@dirework/api/bot/index");
     const { logger } = await import("@dirework/api/logger");
 
-    // Find a bot account to auto-start
+    // Find a bot account to auto-start (single-user-per-instance app)
     const botAccount = await db.query.botAccount.findFirst({
       columns: { userId: true },
     });
 
     if (botAccount && !botService.isRunning()) {
       await botService.start(db, botAccount.userId);
-      logger.info("[Instrumentation] Bot auto-started");
+      logger.info(`[Instrumentation] Bot auto-started for user ${botAccount.userId}`);
     }
   } catch (err) {
     const { logger } = await import("@dirework/api/logger").catch(() => ({

apps/web/src/app/(app)/api/bot/authorize/route.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { auth } from "@dirework/auth";
 import { env } from "@dirework/env/server";
 import { headers } from "next/headers";
@@ -12,18 +13,27 @@ export async function GET() {
     return NextResponse.redirect(new URL("/?error=not_authenticated", env.BETTER_AUTH_URL));
   }
 
+  const nonce = randomBytes(32).toString("hex");
   const state = Buffer.from(
-    JSON.stringify({ userId: session.user.id }),
+    JSON.stringify({ userId: session.user.id, nonce }),
   ).toString("base64url");
 
   const params = new URLSearchParams({
     client_id: env.TWITCH_CLIENT_ID,
     redirect_uri: `${env.BETTER_AUTH_URL}/api/bot/callback/twitch`,
     response_type: "code",
-    scope: "chat:read chat:edit channel:moderate user:read:chat",
+    scope: "user:read:chat user:write:chat",
     force_verify: "true",
     state,
   });
 
-  return NextResponse.redirect(`https://id.twitch.tv/oauth2/authorize?${params}`);
+  const response = NextResponse.redirect(`https://id.twitch.tv/oauth2/authorize?${params}`);
+  response.cookies.set("bot_oauth_nonce", nonce, {
+    httpOnly: true,
+    secure: env.BETTER_AUTH_URL.startsWith("https"),
+    sameSite: "lax",
+    path: "/api/bot/callback",
+    maxAge: 300,
+  });
+  return response;
 }

apps/web/src/app/(app)/api/bot/callback/twitch/route.ts

@@ -1,9 +1,10 @@
+import { timingSafeEqual } from "node:crypto";
 import { auth } from "@dirework/auth";
 import { db } from "@dirework/db";
 import * as schema from "@dirework/db/schema";
 import { env } from "@dirework/env/server";
 import { logger } from "@dirework/api/logger";
-import { headers } from "next/headers";
+import { cookies, headers } from "next/headers";
 import { type NextRequest, NextResponse } from "next/server";
 
 function errorRedirect(_request: NextRequest, reason: string) {
@@ -21,15 +22,24 @@ export async function GET(request: NextRequest) {
   }
 
   let userId: string;
+  let nonce: string;
   try {
     const decoded = JSON.parse(
       Buffer.from(state, "base64url").toString(),
     );
     userId = decoded.userId;
+    nonce = decoded.nonce;
   } catch {
     return errorRedirect(request, "Invalid state parameter");
   }
 
+  // Verify CSRF nonce from httpOnly cookie
+  const cookieStore = await cookies();
+  const storedNonce = cookieStore.get("bot_oauth_nonce")?.value;
+  if (!storedNonce || !nonce || !timingSafeEqual(Buffer.from(storedNonce), Buffer.from(nonce))) {
+    return errorRedirect(request, "Invalid or expired OAuth state — please try again");
+  }
+
   // Verify the current session matches the userId from state
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session || session.user.id !== userId) {

apps/web/src/app/(app)/dashboard/bot/bot-settings-page.tsx

@@ -164,7 +164,7 @@ export default function BotSettingsPage() {
       toast.error(`Failed to connect bot account: ${reason}`);
       router.replace("/dashboard/bot");
     }
-  }, [searchParams]);
+  }, [searchParams, router]);
 
   // Working state
   const [taskCommandsEnabled, setTaskCommandsEnabled] = useState(true);

docker-entrypoint.sh

@@ -1,5 +1,7 @@
 #!/bin/sh
 
+export SKIP_ENV_VALIDATION=true
+
 echo "Running database migrations..."
 if node /app/packages/db/migrate.js; then
   echo "Database migrations completed successfully."

packages/api/src/bot/commands.ts

@@ -1,4 +1,4 @@
-import { eq, and, asc, inArray, sql } from "drizzle-orm";
+import { eq, and, asc, desc, inArray, sql } from "drizzle-orm";
 import type { DbClient } from "@dirework/db";
 import * as schema from "@dirework/db/schema";
 import { env } from "@dirework/env/server";
@@ -183,7 +183,7 @@ async function handleTaskAdd(args: string[], ctx: MessageContext): Promise<void>
 
   const lastTask = await db.query.task.findFirst({
     where: and(eq(schema.task.ownerId, ownerId), eq(schema.task.priority, isBroadcaster ? 0 : 1)),
-    orderBy: [asc(schema.task.order)],
+    orderBy: [desc(schema.task.order)],
     columns: { order: true },
   });
 
@@ -468,7 +468,7 @@ async function handleTaskNext(args: string[], ctx: MessageContext): Promise<void
 
   const lastTask = await db.query.task.findFirst({
     where: and(eq(schema.task.ownerId, ownerId), eq(schema.task.priority, isBroadcaster ? 0 : 1)),
-    orderBy: [asc(schema.task.order)],
+    orderBy: [desc(schema.task.order)],
     columns: { order: true },
   });
 
@@ -697,7 +697,7 @@ async function handleTimerCommand(args: string[], ctx: MessageContext): Promise<
       }
 
       const etaDate = new Date(Date.now() + totalMs);
-      const timeStr = etaDate.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+      const timeStr = etaDate.toLocaleTimeString("en-US", { hour: "2-digit", minute: "2-digit" });
 
       say(interpolate(config.timer.eta, { ...vars, time: timeStr }));
       break;

packages/api/src/bot/index.ts

@@ -54,7 +54,7 @@ class TwitchBotService {
         .set({
           accessToken: tokenData.accessToken,
           refreshToken: tokenData.refreshToken ?? botAccount.refreshToken,
-          expiresAt: tokenData.expiresIn
+          expiresAt: tokenData.expiresIn != null
             ? new Date(Date.now() + tokenData.expiresIn * 1000)
             : botAccount.expiresAt,
           scopes: tokenData.scope ?? botAccount.scopes,
@@ -181,6 +181,10 @@ class TwitchBotService {
     return this.chatClient !== null;
   }
 
+  getOwnerId(): string | null {
+    return this.userId;
+  }
+
   getStatus(): { running: boolean; channel: string | null; botUsername: string | null } {
     return {
       running: this.isRunning(),

packages/api/src/routers/__tests__/timer-logic.test.ts

@@ -17,6 +17,7 @@ describe("getTimerConfig", () => {
       longBreakInterval: 2,
       startingDuration: 10000,
       noLastBreak: false,
+      defaultCycles: 8,
     };
     const result = getTimerConfig(custom);
     expect(result).toEqual(custom);

packages/api/src/routers/bot.ts

@@ -27,11 +27,15 @@ export const botRouter = router({
     return botService.getStatus();
   }),
 
-  stop: protectedProcedure.mutation(async () => {
+  stop: protectedProcedure.mutation(async ({ ctx }) => {
     if (!botService.isRunning()) {
       throw new TRPCError({ code: "CONFLICT", message: "Bot is not running" });
     }
 
+    if (botService.getOwnerId() !== ctx.session.user.id) {
+      throw new TRPCError({ code: "FORBIDDEN", message: "You can only stop your own bot instance" });
+    }
+
     await botService.stop();
     return botService.getStatus();
   }),

packages/api/src/routers/config.ts

@@ -378,11 +378,12 @@ export const configRouter = router({
     }))
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const [updated] = await ctx.db.update(schema.timerConfig)
         .set(input)
         .where(eq(schema.timerConfig.userId, userId))
         .returning();
-      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found — call config.get first to provision defaults" });
+      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found" });
       ee.emit(`timerStateChange:${userId}`);
       return buildTimerConfig(updated);
     }),
@@ -392,12 +393,13 @@ export const configRouter = router({
     .input(z.object({ timerStyles: timerStylesSchema }))
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const flat = flattenTimerStyles(input.timerStyles);
       const [updated] = await ctx.db.update(schema.timerStyle)
         .set(flat)
         .where(eq(schema.timerStyle.userId, userId))
         .returning();
-      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found — call config.get first to provision defaults" });
+      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found" });
       ee.emit(`timerStateChange:${userId}`);
       return buildTimerStylesConfig(updated);
     }),
@@ -407,12 +409,13 @@ export const configRouter = router({
     .input(z.object({ taskStyles: taskStylesSchema }))
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const flat = flattenTaskStyles(input.taskStyles);
       const [updated] = await ctx.db.update(schema.taskStyle)
         .set(flat)
         .where(eq(schema.taskStyle.userId, userId))
         .returning();
-      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found — call config.get first to provision defaults" });
+      if (!updated) throw new TRPCError({ code: "NOT_FOUND", message: "Config row not found" });
       ee.emit(`taskListChange:${userId}`);
       return buildTaskStylesConfig(updated);
     }),
@@ -463,6 +466,7 @@ export const configRouter = router({
     )
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const [result] = await ctx.db.update(schema.botConfig)
         .set({
           taskCommandsEnabled: input.taskCommandsEnabled,
@@ -521,6 +525,7 @@ export const configRouter = router({
     )
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const [result] = await ctx.db.update(schema.timerConfig)
         .set({
           labelIdle: input.idle,
@@ -547,6 +552,7 @@ export const configRouter = router({
     }))
     .mutation(async ({ ctx, input }) => {
       const userId = ctx.session.user.id;
+      await ensureUserConfig(ctx.db, userId);
       const [result] = await ctx.db.update(schema.botConfig)
         .set({ commandAliases: input.commandAliases })
         .where(eq(schema.botConfig.userId, userId))