Security hardening + code quality sweep (9-block audit) by desingh-rajan · Pull Request #103 · desingh-rajan/tstack-kit

desingh-rajan · 2026-02-25T12:18:59Z

Summary

Comprehensive security hardening and code quality sweep across all packages.
Squash and merge — keeps a single revert target if anything breaks.

Closes #52, #71, #84, #89.
Remaining items tracked in #102.

Changes by block

Block 1 — Critical security

SQL injection fix in destroy.ts / database.ts
JWT fallback secret removed (hard error if JWT_SECRET unset)
OAuth redirect allowlist (whitelist-only, rejects unknown origins)
GitHub token removed from git remote URL in infra.ts
SSH host key verification fixed (ssh-keyscan instead of StrictHostKeyChecking=no)

Block 2 — Auth & concurrency

Per-request API client in storefront (18 routes — eliminates token cross-contamination)
Rate limiting on auth routes (in-memory, FIFO eviction cap)
Atomic KV commits in projectStore (replaces plain db.set)
DB transactions for orders and payments
Dockerfile --allow-all replaced with granular permission flags

Block 3 — Input validation & observability

parseInt guards in all numeric controller params
Rate limit eviction capped (prevents unbounded memory growth)
DB password masked in startup log
Request ID middleware + X-Request-ID response header
DB pool fully env-configurable: DB_POOL_SIZE, DB_IDLE_TIMEOUT, DB_CONNECT_TIMEOUT, DB_MAX_LIFETIME

Block 4 — HTTP error semantics

checkAuth returns 401/403 HTTPException (was 500/generic)
Slug generation loop capped at 100 iterations

Block 5 — CLI reliability

Workspace marked partial on failure (prevents ghost workspaces)
Upgrade error logging improved
Deno.exit() replacements with proper error propagation

Block 6 — Admin integration

article.service.ts uses @tstack/admin generateSlug (removes duplicated logic)

Block 7 — Test coverage

100+ new tests across 8 new test files: jwt, response, validation, rateLimit, requireRole, requireAuth, adminUiDetection, config
Fixed hono.test.ts, admin.controller.ts import path, workspace.ts Logger.warn→warning
Deleted scaffold.test.old.ts stub
Total: 227 CLI + 83 admin + 50 api-starter = 360+ tests

Block 8 — Code quality

validate.ts no-op try/catch removed
ContactForm.tsx type fixes
_error.tsx error boundary pages for both starters
data-testid attributes on key UI elements

Block 9 — Docs & infrastructure

All dep versions pinned (removed ^ from 5 deno.json files)
permissions: contents: read in generated deploy workflow + ci.yml
JSDoc to admin/mod.ts public API
AGENTS.md test flag documentation
Terminal output policy in copilot-instructions.md
README: test count updated, Security Hardened feature entry

Testing

All tests pass: deno task test in cli (227), admin (83), api-starter (50)
fmt + lint clean: 524 / 464 files

…astructure improvements Backports from production sc-* repos to starter templates: API Starter: - Guest checkout: nullable userId, isGuest/guestEmail/guestPhone fields - Guest order creation with insertOrderWithRetry for collision handling - Guest payment flow (create-order + verify) with email-based ownership - Order tracking endpoint (POST /orders/track) - public, no auth - Manual refund support for admin (COD/UPI orders) - Email templates: order-refunded, admin-order-notification - Notification service with fire-and-forget pattern - Site settings: enableRazorpay, enableCOD, enableSelfPickup, OrderNotifications - APP_CURRENCY config (default INR), APP_URL, STOREFRONT_URL env vars - DB_POOL_SIZE and max_lifetime database config - pageSize alias in pagination response Storefront Starter: - Full guest checkout flow with inline address form - Guest payment via Razorpay with email prefill - Order tracking page (/track-order) - public - optionalAuth for guest cart access (cookie-based guest_cart_id) - SSR_API_URL for Docker internal networking - isDeno guard for browser-safe env access - AbortSignal.timeout on API calls - Contact form proxy route (/api/contact) - Email verification resend (/api/auth/resend-verification + island) - /health endpoint - Dual payment verification (guest + authenticated) Admin UI Starter: - Guest order display: isGuest column, Customer Type filter - Customer info card on order detail (guest vs registered) - Manual refund support - SSR_API_URL for Docker internal networking - DatePicker in GenericForm, textarea/custom FieldType - formatDate helpers in DataTable and ShowPage - canEditRecord and limit in entity config types - Feature flags from backend schemas - /health endpoint - pageSize support in order service READMEs updated across all packages.

- database.ts: promptForCredentials reads PGUSER/PGPASSWORD (was hardcoded postgres:password) - database.ts: createDatabaseWithPassword adds -d postgres to psql args - destroy.ts: dropDatabases reads PGUSER/PGPASSWORD env vars - destroy.ts: dropDatabaseWithPassword adds -d postgres to psql args - cli/cleanup-test-dbs.ts: reads PGUSER/PGPASSWORD, adds -d postgres - api-starter/cleanup-test-db.ts: loads .env.test.local, extracts creds from DATABASE_URL - api-starter/setup-test-full.ts: loads .env.test.local before .env.test - admin/_test_setup.ts: reads PGUSER/PGPASSWORD (was already fixed) - admin/cleanup-test-db.ts: reads PGUSER/PGPASSWORD (was already fixed) - scaffold.test.ts: dropWorkspaceDatabases reads PGUSER/PGPASSWORD, adds -d postgres - api-creator.ts: test-mode credentials read PGUSER/PGPASSWORD env vars Also update README files with test setup docs including troubleshooting tables covering auth failures, missing .env.test.local, and leftover database cleanup commands. All three test suites pass with zero leftover databases after run: cli: 225 passed, 0 failed admin: 83 passed, 0 failed api-starter: 35 passed (601 steps), 0 failed

Closes #98, #99, #101 Partially addresses #52, #71, #89 ## Block 1: P0 Critical Security - Fix SQL injection in destroy.ts + database.ts (quote dbName in DROP/CREATE DATABASE) - Remove JWT fallback secret -- throw if JWT_SECRET unset in production - Add OAuth redirect allowlist + HttpOnly cookie (stop token-in-URL pattern) - Fix GitHub token exposure in workspace.ts -- use GIT_ASKPASS instead of URL embedding - Fix SSH host verification in infra.ts -- replace StrictHostKeyChecking no with ssh-keyscan - Add permissions: contents: read to generated GitHub Actions workflows ## Block 2: Critical + High Impact - Add per-request API client factory in storefront-starter (fix singleton auth leak) - Add rate limiting to all auth routes (10/15min login/register, 5/15min password reset) - Wrap projectStore.ts KV writes in atomic operations - Restrict Dockerfile CMD from --allow-all to granular permission flags - Wrap order and payment service mutations in DB transactions ## Block 3: API Input Validation + Error Handling - Guard all parseInt() calls with NaN checks across controllers - Cap rate limiter Map at 10,000 entries with FIFO eviction - Mask database password in startup log - Add DB_POOL_MAX env var support - Move request ID generation to start of middleware pipeline - Echo X-Request-ID response header from error handler ## Block 4: Admin Package Fixes - checkAuth throws HTTPException(401/403) instead of generic Error - bulkDelete validates each ID is string or number - Cap slug uniqueness loop at 100 iterations in drizzle.ts and slug.ts ## Block 5: CLI Robustness - Track partial workspace creation -- set status partial on any component failure - Fix upgrade.ts swallowing errors -- log details and show hints - Replace Deno.exit() with throw in create.ts and base-creator.ts ## Block 6: Slug Consolidation - article.service.ts imports generateSlug from @tstack/admin (remove private duplicate) - Add JSDoc to all exports in packages/admin/mod.ts ## Block 7: New Tests (+227 CLI, +50 api-starter, +83 admin all passing) - jwt.test.ts -- createToken/verifyToken roundtrip, tampered/garbage rejection - response.test.ts -- ApiResponse success/error/paginated - validation.test.ts -- ValidationUtil + commonSchemas - rateLimit.test.ts -- limits, headers, skip, custom keys, eviction, reset - requireRole.test.ts -- role middleware + all convenience middlewares - requireAuth.test.ts -- full integration through app routes - adminUiDetection.test.ts -- name derivation, suffix stripping, real fs - config.test.ts -- loadConfig/saveConfig/ensureConfig with temp HOME - Delete dead scaffold.test.old.ts ## Block 8: UI Improvements - Add _error.tsx to storefront-starter and admin-ui-starter (404/500 handling) - Add data-testid attributes to login, register, cart, add-to-cart, admin login - Fix ContactForm.tsx -- rename FormData interface, replace unsafe as string casts - Remove no-op try/catch blocks in validate.ts middleware ## Block 9: Infrastructure + Docs - Pin all dependency versions (remove ^ caret ranges) across all 5 deno.json files - Document exact test flags and required env vars in AGENTS.md - Add terminal output policy to copilot-instructions.md (no tail/head truncation)

…99 #100 #101) - ci.yml: add 'permissions: contents: read' (least-privilege, was missing from actual workflow) - api-starter database.ts: expose DB_IDLE_TIMEOUT, DB_CONNECT_TIMEOUT, DB_MAX_LIFETIME as env vars with same defaults (20s, 10s, 1800s); DB_POOL_SIZE was already env-configurable - docs/environment-variables.md: document all four DB pool config variables - Remaining audit items consolidated into #102

Copilot

Pull request overview

This PR implements a comprehensive security hardening and code quality sweep addressing issues #52, #71, #84, and #89. The changes span 9 blocks covering critical security fixes, authentication improvements, input validation, test coverage expansion, and infrastructure hardening.

Changes:

Security fixes: SQL injection prevention, JWT secret enforcement, OAuth redirect validation, SSH key verification
Authentication: Per-request API clients, rate limiting, atomic KV operations, guest checkout support
Code quality: 100+ new tests (360+ total), dependency pinning, error handling improvements, data-testid attributes

Reviewed changes

Copilot reviewed 129 out of 129 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/storefront-starter/vite.config.ts	Added CORS wildcard configuration for dev server
packages/storefront-starter/utils.ts	Added per-request API client to state
packages/storefront-starter/routes/track-order.tsx	New guest order tracking page
packages/storefront-starter/routes/api/contact.ts	New server-side contact form proxy
packages/storefront-starter/routes/_middleware.ts	Enhanced with per-request API client and guest support
packages/storefront-starter/lib/api.ts	Added guest checkout methods and per-request client factory
packages/cli/src/utils/database.ts	Fixed SQL injection with parameterized queries
packages/cli/src/utils/projectStore.ts	Added atomic KV commits
packages/cli/src/commands/workspace.ts	Improved Git token security and workspace status handling
packages/cli/src/commands/infra.ts	Fixed SSH host key verification
packages/api-starter/src/shared/utils/jwt.ts	JWT secret validation and fallback removal
packages/api-starter/src/config/database.ts	Added configurable DB pool settings
packages/api-starter/src/shared/middleware/rateLimit.ts	Added FIFO eviction cap
packages/api-starter/src/shared/middleware/logger.ts	Added request ID generation
packages/api-starter/src/auth/oauth.controller.ts	OAuth redirect allowlist and HttpOnly cookies
packages/api-starter/Dockerfile	Replaced --allow-all with granular permissions
packages/admin/src/framework/hono.ts	checkAuth now returns proper HTTP exceptions
packages/admin/src/core/slug.ts	Added max attempts cap on slug generation
All deno.json files	Pinned all dependency versions

Copilot · 2026-02-25T12:23:09Z

+      const body = await ctx.req.json();
+
+      const response = await fetch(`${SSR_API_URL}/contact`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });


The contact form proxy forwards user input to the backend without any validation or rate limiting. This could be abused for spamming or as a CSRF vector. Consider adding:

Rate limiting on this endpoint

CSRF token validation

Basic input validation (e.g., check for required fields before proxying)

Copilot · 2026-02-25T12:23:09Z

+  server: {
+    cors: {
+      origin: "*",
+    },
+  },


The wildcard CORS configuration in vite.config.ts (origin: "*") is a security concern. In production, the Vite dev server shouldn't be exposed, but during development this allows any website to make requests to your local dev server. Consider using origin: ["http://localhost:8000", "http://localhost:3000"] or documenting that this file should not be used in production.

- payment.service.ts: explicit PaymentDetails type annotation, narrow webhookEvent.orderId/payment before use in transactions (fixes TS7034, TS7005, TS18048, TS2769 errors) - routes/api/contact.ts: add server-side rate limiting (5/min per IP) and input validation (email + message required) per Copilot review - vite.config.ts: replace wildcard CORS origin with explicit localhost origins (dev-only, never used in production) per Copilot review

desingh-rajan added 4 commits February 25, 2026 14:21

Copilot AI review requested due to automatic review settings February 25, 2026 12:18

Copilot started reviewing on behalf of desingh-rajan February 25, 2026 12:19 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

desingh-rajan merged commit 9188763 into main Feb 25, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Security hardening + code quality sweep (9-block audit)#103

Security hardening + code quality sweep (9-block audit)#103
desingh-rajan merged 5 commits into
mainfrom
security-audit-feb-2026

desingh-rajan commented Feb 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

desingh-rajan commented Feb 25, 2026

Summary

Changes by block

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants