Grovy311/leistungsbilanz-ts
1
0
Fork 0
forked from jappel/leistungsbilanz-ts
Code Pull requests Activity

Address security review notes

Browse source 
- log only the error name for rejected 4xx requests (JSON.parse messages
  can quote the request body, e.g. a password)
- refuse LB_DATABASE_PATH in production; it is test-only
- fix two stale file references in the skill texts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311 2026-10-15 09:45:59 +02:00
parent a7a1595cbf
commit afd8019a7b
6 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/db/client.ts
View file

@ -1,10 +1,15 @@
import path from "node:path";
import { createDatabaseContext } from "./database-context.js";
// LB_DATABASE_PATH ist nur fuer Tests gedacht (z. B. ":memory:" in tests/security);
// der Betrieb nutzt weiterhin data/leistungsbilanz.db.
// LB_DATABASE_PATH ist nur fuer Tests gedacht (z. B. ":memory:" in tests/security).
// Migrationen, Backup und Schema-Pruefung nutzen fest data/leistungsbilanz.db, deshalb
// ist die Variable in Produktion verboten.
const testDatabasePath = process.env.LB_DATABASE_PATH;
if (testDatabasePath && process.env.NODE_ENV === "production") {
throw new Error("LB_DATABASE_PATH is test-only and must not be set in production.");
}
const defaultDatabaseContext = createDatabaseContext(
process.env.LB_DATABASE_PATH || path.resolve("data", "leistungsbilanz.db")
testDatabasePath || path.resolve("data", "leistungsbilanz.db")
);
export const db = defaultDatabaseContext.db;