feat: server core — config, workspaces, target validation, tool detection - #15
Merged
Conversation
…ol detection Foundation for the upgraded recon pipeline: - config.js: centralised env config (rate profiles, scan limits, access control) - db.js: new tables (workspaces, programs, web_assets, evidence, exploit_results, finding_reviews, scope_authorizations, access_sessions) + idempotent column migrations and dedupe/unique indexes; existing schema unchanged - workspaces.js: per-session workspace tokens isolating scan data - targets.js + tests: target normalization, private-range blocking, DNS resolution guard - scope.js + tests: program scope matching (exact/wildcard/CIDR) - tools.js: runtime detection of subfinder/nmap/nuclei/sqlmap versions - scanState.js, fingerprints.js, notifications.js: supporting modules No route changes yet — modules land unused so main stays green while the pipeline slices arrive.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First slice of the upgraded server architecture (slice 1 of 6):
config.js— centralised env-driven config (rate profiles, concurrency limits, access control)db.js— new tables for workspaces, programs, web assets, evidence, exploit results, finding reviews, scope authorizations; idempotent column migrations; dedupe cleanup + unique indexes. Existing tables unchanged (verified by schema diff)workspaces.js— workspace tokens that isolate each browser session's scan datatargets.js+ tests — target normalization, private/reserved IP blocking, DNS resolution validationscope.js+ tests — program scope matching (exact host, wildcard, CIDR)tools.js— runtime version detection for subfinder / nmap / nuclei / sqlmapscanState.js,fingerprints.js,notifications.jsWhy
Foundation the upgraded recon pipeline, exploit engine, and programs features build on. Modules land wired-but-unused so
mainstays green; routes arrive in following slices.Verification
npm test— all pass (scope: 4, targets: 6)npm run lint— cleannpm run build— clean