admin/elegalsoftware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7 Commits 1 Branch 0 Tags
d9b807662a68058451cd9456dc2ef1ff9481146d
Commit Graph
4 Commits
Author SHA1 Message Date
Leon SerfatyandClaude Fable 5 d9b807662a Add e2e auth test suite, retention crons, and email-verification UX
CI / build-and-test (push) Has been cancelled
Details 
- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
  Fastify app against a disposable Dockerized Postgres (never a real DB) and
  covers signup/login/lockout/rate limits, CSRF (incl. forged-token
  rejection), logout, password reset, email verification, the superadmin
  verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
  don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
  tokens, login attempts, tool usage, contact messages, audit log) +
  sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
  with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
  document login-attempt/tool-usage retention in the Privacy Policy

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-16 14:32:55 -04:00
Leon SerfatyandClaude Fable 5 97e1d4c60b Storage→Spaces, security hardening, production-blocker fixes, tests + CI 
Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-16 13:18:10 -04:00
Leon SerfatyandClaude Sonnet 4.6 e91ff1ce89 Switch from pnpm to npm workspaces 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-26 03:32:17 -04:00
Leon SerfatyandClaude Sonnet 4.6 0700d54225 Initial commit — eLegal Software monorepo 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-26 02:42:42 -04:00