Alex Holliday
861d867a17
run formatter
2026-07-07 09:55:21 -07:00
Alex Holliday
68a9bece1e
bump dependencies
2026-07-07 09:48:34 -07:00
Alex Holliday
4f82a11c66
update tests
2026-07-07 09:47:41 -07:00
Alex Holliday
cc1814f507
whitelist monitor properties instead of blacklist for status pages
2026-07-07 09:47:29 -07:00
Alex Holliday
436c11bcba
Merge branch 'develop' into fix/status-page-monitor-leak
2026-07-07 09:02:48 -07:00
Alex
937ffe4f3b
add and update tests
2026-07-06 09:39:59 -07:00
Alex
0df71d6356
use re2 for regex
2026-07-06 09:39:43 -07:00
Alex
adba25269c
tighten regex validation
2026-07-06 09:39:28 -07:00
Alex
386a384ef6
add RE2 dependency
2026-07-06 09:39:11 -07:00
Alex Holliday
8bf5db0834
remove dead code and tests
2026-07-03 11:28:00 -07:00
Alex Holliday
3f30acdbdf
add tests
2026-07-03 10:45:53 -07:00
Alex Holliday
80b604b9ff
add global unhandled exception handler
2026-07-03 10:34:02 -07:00
Alex Holliday
9356b0d482
catch on recordFailure, add defenisve cathc to run job
2026-07-03 10:33:45 -07:00
Alex Holliday
900c039672
add additional worker tests
2026-07-03 09:41:18 -07:00
Alex
807d7e10c3
type bulk op
2026-07-02 10:55:57 -07:00
Alex
39043f3945
migration fix
2026-07-02 10:43:22 -07:00
Alex
5a72e1e123
Merge branch 'develop' of github.com:bluewave-labs/Checkmate into develop
2026-07-02 10:30:05 -07:00
Alex
959b150ebf
fix migratin
2026-07-02 10:29:15 -07:00
Alexander Holliday
552b7a037d
Merge pull request #3743 from bluewave-labs/feat/helm
...
feat: Update helm charts
2026-07-02 10:13:28 -07:00
Alexander Holliday
105d7f0580
Merge pull request #3723 from Buco7854/feat/customcss-status-page
...
Feat/customcss status page
2026-07-02 09:11:02 -07:00
Harshitbro-ctrlv
29d05c1e57
feat(status-page): add minimal theme
2026-07-02 12:08:17 +05:30
Alexander Holliday
95eb75f416
Merge pull request #3741 from sanmaxdev/fix/maintenance-window-monitor-edits
...
test: cover maintenance window monitor edits
2026-06-30 16:46:40 -07:00
Alex Holliday
c0e33eb4fa
skip general rate limiter on dev mode
2026-06-30 09:08:20 -07:00
Alex Holliday
3f5707721f
fix logging on server startup
2026-06-29 09:12:42 -07:00
sanmaxdev
cc5f033d0d
test: cover maintenance window monitor edits
2026-06-27 16:21:37 +00:00
Alex Holliday
d2d0fb788e
resolve shutdown race
2026-06-25 12:29:21 -07:00
Alex Holliday
9d969d67ca
udpate tests
2026-06-25 11:55:40 -07:00
Alex Holliday
6e1c26b987
remove shadowing var
2026-06-25 11:55:28 -07:00
Alex Holliday
ef353dcb36
bugfix, move reconcile to job scheduler
2026-06-25 11:47:22 -07:00
Alex Holliday
f43bf9ab3d
add observability to worker and health server
2026-06-25 11:02:38 -07:00
Alex Holliday
48ca64ec6f
add observability repo method
2026-06-25 11:02:18 -07:00
Alex Holliday
e036c6077e
add tests
2026-06-25 10:37:07 -07:00
Alex Holliday
c9f0254aed
start health server, update shutdown, update env config
2026-06-25 10:36:53 -07:00
Alex Holliday
b3d9c5b94c
add health server and metrics to db queue worker
2026-06-25 10:36:31 -07:00
Alex Holliday
fd536541d7
add test for job scheduler drain
2026-06-25 09:16:07 -07:00
Alex Holliday
7a82c76d5c
update tests
2026-06-24 12:20:21 -07:00
Alex Holliday
5fab2d0a30
inject buffer service, implement drain
2026-06-24 12:17:02 -07:00
Alex Holliday
860b2d6214
add a getHealth method to interface, stub out implementation
2026-06-24 12:16:37 -07:00
Alex Holliday
8579edd56e
add a shutdown method to buffer service
2026-06-24 11:58:32 -07:00
Arnaud GRIMBERT
969d24e369
Merge branch 'develop' into feat/customcss-status-page
2026-06-24 20:27:57 +02:00
Buco7854
a4cc322a55
feat: apply status page CSP to custom domains
...
Detect custom domains by comparing the request host to the app host and apply
the tightened CSP there too, not just on the public path. Run the middleware
before express.static so static-served root documents get the header, and keep
helmet after static so its default-src does not block custom domain API calls.
2026-06-24 18:21:16 +00:00
Alex Holliday
0f230c4d70
update tests
2026-06-24 10:53:13 -07:00
Alex Holliday
74783fd738
clean up logger
2026-06-24 10:53:03 -07:00
Alex Holliday
71d3e789ff
split services to api, worker, and shared
2026-06-24 10:30:21 -07:00
Alex Holliday
f59a7c3113
extract shared services
2026-06-23 12:26:42 -07:00
Buco7854
ffbf223288
feat: tighten CSP on the public status page document
...
Layer a stricter Content-Security-Policy on the /status/public document so
custom CSS cannot load external images, fonts, or stylesheets. Browsers
enforce the intersection of all CSP headers, so this only narrows the public
status page and never loosens the global policy, while keeping the app's
Google Fonts. Browser-enforced backstop behind the validator.
2026-06-23 19:25:40 +00:00
Buco7854
96021b7479
refactor: detect external CSS references with the CSS Syntax tokenizer
...
Replace the regex/escape-normalizer with @csstools/css-tokenizer (already
present transitively). Tokenizing resolves comments, hex escapes, and line
continuations into the real value before scanning, so obfuscated forms (a
scheme split by a line continuation or hex escape) cannot slip past. Scan
url-tokens and string-tokens to cover url(), quoted @import, and string-form
image functions. Add regression tests for the bypasses.
2026-06-23 19:25:18 +00:00
Alex Holliday
f0a5974eaf
update tests
2026-06-23 11:31:35 -07:00
Alex Holliday
c9b8f434cd
split worker into a scheduler and worker
2026-06-23 11:22:37 -07:00
Buco7854
3685e0c476
feat: reject custom CSS that references external resources
...
Reject status page custom CSS containing @import or a url() / image-set()
/ image() / cross-fade() whose target is http(s) or protocol-relative,
while allowing data: and relative URLs. The check normalizes comments and
CSS escapes first so obfuscated forms cannot slip past. Enforced in the
create/update body validation.
2026-06-22 23:49:58 +00:00
Alex Holliday
Harshitbro-ctrlv
sanmaxdev
Arnaud GRIMBERT
Buco7854