openclaw/oikos
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
812 Commits 3 Branches 0 Tags
main
Commit Graph

6 Commits

Author SHA1 Message Date
Ulas 6e0eda8ba4 fix(security): address multiple security findings from audit 
- Fix SQLCipher PRAGMA key interpolation (hex-encode key to prevent crash on single quotes)
- Enforce min password length (8 chars) on admin user creation
- Add length bounds on username/display_name and login inputs
- Invalidate other sessions on password change
- Multi-stage Docker build (exclude build tools from runtime)
- Exclude docs/ from Docker image
- Consolidate dotenv.config() to single entry point
- Document flat family authorization model in SECURITY.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-03 09:11:17 +02:00
Ulas 5cb71bb424 fix: align Node.js version to >=22 across Dockerfile and package.json 
Dockerfile used node:20-slim but the project requires Node >=22
(--experimental-sqlite in tests, CI matrix). package.json had a
duplicate engines block where the second (>=20.0.0) silently
overwrote the correct first one (>=22.0.0).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-02 14:16:49 +02:00
ulsklyc b5bb69ad37 fix: su-exec → gosu (su-exec ist Alpine-only, Debian nutzt gosu) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-25 09:04:06 +01:00
ulsklyc fe7af1775a fix: Entrypoint-Script für robuste /data-Permissions (SQLITE_CANTOPEN) 
chown im Dockerfile reicht nicht: Docker überschreibt beim Mounten eines
named Volume die Image-Permissions. Entrypoint-Script (läuft als root)
korrigiert /data-Ownership zur Laufzeit und startet dann via su-exec
als unprivilegierten node-User (korrekte Signal-Weiterleitung).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-25 09:02:44 +01:00
ulsklyc 6fddaa8311 fix: /data-Verzeichnis gehört node-User (SQLITE_CANTOPEN) 
mkdir -p /data lief als root, danach USER node — node hatte keine
Schreibrechte auf das Volume-Mountpoint. chown node:node /data vor
dem USER-Wechsel behebt den SQLITE_CANTOPEN-Fehler beim Deploy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-25 08:57:11 +01:00
ulsklyc d49cbe33b3 feat: Phase 1 — Projektstruktur, DB-Schema, Auth-System 
- Vollständige Verzeichnisstruktur gemäß CLAUDE.md
- Express-Server mit Helmet, Sessions, Rate Limiting, SPA-Fallback
- SQLite-Schema (Migration v1): 10 Tabellen, updated_at-Triggers, Indizes
- Versioniertes Migrations-System (schema_migrations)
- Auth-Routen: Login, Logout, /me, Admin-User-CRUD
- Frontend App-Shell: SPA-Router, API-Client, Design-System (CSS Tokens)
- PWA: Service Worker, Web App Manifest
- Setup-Script für ersten Admin-User (node setup.js)
- DB-Tests mit node:sqlite built-in: 29/29 bestanden
- Docker Compose + Dockerfile + Nginx-Beispielkonfiguration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-24 14:32:36 +01:00