Update the Test & Security Baseline from cj/security-baseline (364d756):
- make prepush runs only the checks the diff needs (scripts/security/changed_scope.py)
- make weekly = check + trivy-fs, run by the weekly cron on cj-ki
- in git worktrees gitleaks scanned 0 commits and Semgrep ignored .gitignore (.next/); fixed
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- log only the error name for rejected 4xx requests (JSON.parse messages
can quote the request body, e.g. a password)
- refuse LB_DATABASE_PATH in production; it is test-only
- fix two stale file references in the skill texts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Same skills in .agents/skills (Codex) and .claude/skills (Claude Code):
codeguard, security-review, dependency-vetting, pre-release-gate,
authz-idor-audit, threat-model-light. Source: cj/claude-skills.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Also document that Sec-Fetch-Site is only sent over HTTPS, so plain-HTTP
LAN access relies on SameSite=Lax alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Renumber the users migration to 0013_users so it follows the upstream
0012_good_gateway (logical board feeds); AGENTS.md deferred-work list keeps
both the new feed items and the auth items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security: per-username login throttling, constant-time unknown-user check,
Sec-Fetch-Site CSRF guard for writes, session rotation on login and
password change, absolute session lifetime, sessions ended on reset and
deactivation, last-admin protection, input length caps, ASCII usernames,
clickjacking headers. Covered by tests/authentication.test.ts.
Filter panel: toggle, fields and count share one row to save space.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Square icon-only theme toggle sits next to the Abmelden button in a shared
row, collapsing to just the toggle when the sidebar is collapsed - same
arrangement as pm-app's Sidebar.tsx.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
No self-signup: admins create every account in Config -> Benutzer with a
typed start password; a forced password change gates first use. Session-
cookie auth protects all /api/* routes; /api/users additionally requires
the admin role. See docs/authentication.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
List the building structure, room areas, rough power balance and cable
sizing in the README and documentation map, add an architecture section
for the rough power balance, correct stale snapshot schema references and
record the integrated contributor features in the backlog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Further Revit exchange will use the CSV export/import of the Linear
plugin instead of Dynamo, as preferred by the internal Revit/CAD
steering committee. Mark the Revit documentation as deferred and remove
the Dynamo diagnostic scripts, which stay reachable through the tag
archive/dynamo-vorueberlegungen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep the earlier Dynamo/API considerations as historical reference only.
Further Revit exchange will use CSV via the Linear plugin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
