Martin Dvorak
8822baf4b7
Audit pass with the threats that actually apply to a self-hosted, account-less app: getting the Ollama key throttled or banned, and someone grinding the app down. Per-route windows already existed; these are the missing layers. - lib/model-guard.ts: every route that spends a model call now takes a slot — 60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight per IP, 6 in total — and the slot is released when the call finishes, on errors and on client disconnects. Over the concurrency cap answers 429 kind=busy, not a punishment. Slots are taken after every cheap rejection so a malformed request cannot hold one (found by the new suite: early 400s were leaking slots). - Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL in an images field made Ollama fetch an arbitrary address on our behalf. - Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored. - The rate-limit identity is the LAST x-forwarded-for hop. Reading the first let a client spoof its own IP and dodge every per-IP limit. - Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder devices cap at PUSH_MAX_SUBSCRIPTIONS (50). - Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a referrer policy and a Permissions-Policy without camera/mic/geo/payment. New tests/security-test.mjs (13 checks, registered in run-all) proves each guard against a slow stub Ollama with deliberately tiny limits. README: security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.
47 lines
1.4 KiB
JavaScript
47 lines
1.4 KiB
JavaScript
/**
|
|
* Runs every Freezmo browser suite in order.
|
|
*
|
|
* npm run test:e2e # everything
|
|
* npm run test:e2e -- phase1 # only suites whose name contains "phase1"
|
|
*
|
|
* Each suite is a standalone script that talks to the running app on :3207
|
|
* (FREEZMO_URL overrides). Suites that need a stub Ollama or extra server
|
|
* instance start their own on their own port and clean up after themselves.
|
|
*/
|
|
import { spawn } from "node:child_process";
|
|
import path from "node:path";
|
|
|
|
const SUITES = [
|
|
"regression",
|
|
"bubbles-test",
|
|
"mobile-test",
|
|
"wizard-test",
|
|
"native-test",
|
|
"i18n-test",
|
|
"freeze-loading-test",
|
|
"phase1-test",
|
|
"phase2-test",
|
|
"phase3-test",
|
|
"security-test",
|
|
"chat-test",
|
|
"review-test",
|
|
];
|
|
|
|
const filters = process.argv.slice(2);
|
|
const list = filters.length ? SUITES.filter((name) => filters.some((f) => name.includes(f))) : SUITES;
|
|
|
|
const here = path.dirname(new URL(import.meta.url).pathname);
|
|
const repo = path.resolve(here, "..");
|
|
|
|
let failed = 0;
|
|
for (const suite of list) {
|
|
console.log(`\n===== ${suite} =====`);
|
|
const code = await new Promise((resolve) => {
|
|
const child = spawn(process.execPath, [path.join(here, `${suite}.mjs`)], { cwd: repo, stdio: "inherit" });
|
|
child.on("close", resolve);
|
|
});
|
|
if (code !== 0) failed += 1;
|
|
}
|
|
|
|
console.log(`\n${list.length - failed}/${list.length} suites passed`);
|
|
process.exit(failed ? 1 : 0);
|