Admin audit remediation: security hardening + repo cleanup (Phases 1-2) - #41
Merged
Merged
Conversation
Audit phase 1 (verified by independent read-only review): - session-config: remove committed fallback secret; ADMIN_SESSION_SECRET is now required in every environment (throws at boot when missing) - admin proxy: add defensive admin-role check on session meta, reject encoded/plain dot-segment traversal via normalized backend URL boundary check, apply same-origin CSRF gate to all mutation methods - csrf helper: fail closed when both Origin and Referer are absent - remove dead localStorage isAdmin gates from three dashboard screens - extend proxy/logout/session/csrf test suites (123 admin tests green)
Audit phases 1-1 and 2-4/2-5: - next/eslint-config-next 14.1.3 -> 14.2.35 (CVE-2025-29927 et al) - retarget typecheck:admin-v2 / lint:admin-v2 to real paths (app/admin, components/admin, shared, app/api/admin) - UI code was silently excluded via nonexistent features/admin target - consolidate configs: single .eslintrc.json (absorbs admin-v2 rules as scoped overrides; flat config was ignored by next lint on 14.2), single postcss.config.js, repaired tsconfig.admin-v2.json includes (noUnusedLocals/Parameters relaxed during gradual adoption) - 23 minimal source fixes the newly-activated lint required - remove unused deps: @emotion/react, @emotion/styled, @headlessui/react, @heroicons/react (grep-confirmed zero usages) Gates: next build 108/108 pages, quality:admin-v2 exit 0, 123 tests.
Audit phase 2 items 2-1/2-2/2-6/2-8 (all removals grep-verified as unreferenced before removal): - remove dead supabase/ dir (26 files incl. 15 migrations), deno.json, import_map.json, root database.types.ts - remove root junk: check-db.js, db.json, test-db.mjs, sql-commands.txt, .cursorrules, recover.patch, dynamic-directive-results.log, four stale scratch .sql files, memory-bank/ stub, committed .omc/state artifacts - move memory/AI/diagrams -> docs/diagrams with ARCHIVED banners on the two files describing the removed supabase-era architecture - ignore .omc/ going forward - ci: replace two empty workflow files with a minimal verification gate (install/build/lint/test:admin on PRs and pushes to main); deployment stays on Vercel - docs: rewrite boilerplate README and Airbnb-copied DESIGN.md; fix factual drift in AGENTS.md/CLAUDE.md (TS 5.3.3, Next 14.2.35, ~97 pages, real module counts, session secret requirement) Independent read-only verification: PASS (ops/plans/phase2-verification-report.md in sometime-central).
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Resolves SonarCloud githubactions:S7637 (supply-chain hardening): mutable v4 tags replaced with the commits they currently point to.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full-audit remediation, Phases 1 + 2, per
sometime-central/ops/plans/2026-07-12-projectsolo-full-audit-remediation.md. Implemented by parallel workers, then independently re-verified by a read-only reviewer (verdict: PASS — report insometime-central/ops/plans/phase2-verification-report.md).86 files, +604 / −4,007 lines across 3 commits:
1.
fix(security)— Phase 1ADMIN_SESSION_SECRETnow required in every environment (committed fallback secret removed; boot fails without it). Vercel env already has it in Production/Preview/Development — confirmed via CLI...traversal rejection via normalized backend-URL boundary check, same-origin CSRF gate on all mutation methods.csrf.tsfail-closed when Origin+Referer are both absent.localStorage.isAdmingates removed from 3 dashboard screens.2.
chore(quality)— Phases 1-1, 2-4, 2-5features/adminto real paths — UI code is no longer silently skipped by lint/typecheck.3.
chore(cleanup)— Phases 2-1, 2-2, 2-6, 2-8docs/diagrams/.Validation
pnpm build— 108/108 pagespnpm quality:admin-v2— exit 0 (typecheck + lint + 123 admin tests)Post-merge
SUPABASE_SERVICE_ROLE_KEY,NEXT_PUBLIC_SUPABASE_URL,NEXT_PUBLIC_SUPABASE_ANON_KEY).