Leon SerfatyandClaude Fable 5
97e1d4c60b
Storage - Migrate document/media storage from local disk to DigitalOcean Spaces (S3); lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required. - Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time). Security hardening (all report findings) - DB pool fails closed in production when the CA cert is missing (no more silent unverified TLS); warns in dev. - trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits. - Login lockout keyed by (email, ip) so an attacker can't lock out a victim. - Superadmin auto-grant now requires a verified email. - CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt. - Upload content-sniffing (magic bytes) rejects spoofed MIME types. - create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED. Production-blocker fixes - SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache. - Invoice numbering is transaction-safe (per-firm advisory lock + max sequence), eliminating concurrent collisions and delete-reuse — no schema change. - Checkout guards against double-billing a firm already on a paid plan. - Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps). Honesty / trust - Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA, and the login-panel stats; replace with non-fabricated copy. - Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.) Quality - Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
48 lines
1.2 KiB
JSON
48 lines
1.2 KiB
JSON
{
|
|
"name": "@lawdesk/api",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "./src/server.ts",
|
|
"scripts": {
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsc -p tsconfig.json --noEmit",
|
|
"start": "tsx src/server.ts",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.1088.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.1088.0",
|
|
"@fastify/cookie": "^11.0.1",
|
|
"@fastify/cors": "^10.0.1",
|
|
"@fastify/helmet": "^12.0.1",
|
|
"@fastify/multipart": "^9.0.1",
|
|
"@fastify/rate-limit": "^10.2.1",
|
|
"@fastify/static": "^8.0.3",
|
|
"@lawdesk/db": "*",
|
|
"@sentry/node": "^8.45.0",
|
|
"argon2": "^0.41.1",
|
|
"dotenv": "^16.4.5",
|
|
"drizzle-orm": "^0.36.4",
|
|
"fastify": "^5.1.0",
|
|
"fastify-plugin": "^5.0.1",
|
|
"fastify-type-provider-zod": "^4.0.2",
|
|
"pdfkit": "^0.15.0",
|
|
"pg": "^8.13.1",
|
|
"pino": "^9.5.0",
|
|
"stripe": "^17.4.0",
|
|
"tsx": "^4.19.2",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.9.1",
|
|
"@types/pdfkit": "^0.13.5",
|
|
"@types/pg": "^8.11.10",
|
|
"pino-pretty": "^11.3.0",
|
|
"typescript": "^5.6.3",
|
|
"vitest": "^3.2.7"
|
|
}
|
|
}
|