chore: pre-release v0.2.1-dev

feat/upload-bar (#30 )
* feat/upload-bar: add a upload bar when user upload file, indicate the upload process * feat/save-loading-status: add save status when click back button from editor * fix: address PR review issues in upload and save features - Replace deprecated substr() with substring() in UploadContext - Fix broken error handling that checked stale task status - Fix missing useEffect dependency in UploadStatus - Fix CSS class conflict in progress bar styling - Add error recovery for save state in Editor (reset on failure) - Use .finally() instead of .then() to ensure refresh on upload failure - Fix inconsistent indentation in UploadContext * fix e2e tests --------- Co-authored-by: Zimeng Xiong <zxzimeng@gmail.com>
2026-01-14 10:38:28 -08:00 · 2026-01-14 09:25:17 -08:00 · 2026-01-14 08:57:04 -08:00 · 2026-01-14 08:21:49 -08:00 · 2025-12-21 10:08:05 -08:00
15 changed files with 46 additions and 645 deletions
@@ -511,17 +511,6 @@ release-docker: ## Build and push release Docker images
 pre-release-docker: ## Build and push pre-release Docker images
 	./publish-docker-prerelease.sh

-dev-release: ## Build and push custom dev release (usage: make dev-release NAME=issue38)
-	@if [ -z "$(NAME)" ]; then \
-		echo "$(RED)ERROR: NAME parameter is required!$(NC)"; \
-		echo "$(YELLOW)Usage: make dev-release NAME=<custom-name>$(NC)"; \
-		echo "$(YELLOW)Example: make dev-release NAME=issue38$(NC)"; \
-		echo "$(YELLOW)  This will create tags like: 0.3.1-dev-issue38$(NC)"; \
-		exit 1; \
-	fi
-	@echo "$(BLUE)Building custom dev release: $(NAME)$(NC)"
-	@./publish-docker-dev.sh $(NAME)
-
 #===============================================================================
 # DATABASE
 #===============================================================================
@@ -1,6 +1,6 @@
 <img src="logoExcaliDash.png" alt="ExcaliDash Logo" width="80" height="88">

-# ExcaliDash
+# ExcaliDash v0.1.8

 ![License](https://img.shields.io/github/license/zimengxiong/ExcaliDash)
 ![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)
@@ -120,17 +120,14 @@ docker compose up -d

 When running ExcaliDash behind Traefik, Nginx, or another reverse proxy, configure both containers so that API + WebSocket calls resolve correctly:

- `FRONTEND_URL` (backend) must match the public URL that users hit (e.g. `https://excalidash.example.com`). This controls CORS and Socket.IO origin checks. **Supports multiple comma-separated URLs** for accessing from different addresses.
+- `FRONTEND_URL` (backend) must match the public URL that users hit (e.g. `https://excalidash.example.com`). This controls CORS and Socket.IO origin checks.
 - `BACKEND_URL` (frontend) tells the Nginx container how to reach the backend from inside Docker/Kubernetes. Override it if your reverse proxy exposes the backend under a different hostname.

 ```yaml
 # docker-compose.yml example
 backend:
  environment:
-    # Single URL
    - FRONTEND_URL=https://excalidash.example.com
-    # Or multiple URLs (comma-separated) for local + network access
-    # - FRONTEND_URL=http://localhost:6767,http://192.168.1.100:6767,http://nas.local:6767
 frontend:
  environment:
    # For standard Docker Compose (default)
@@ -27,17 +27,3 @@ CSRF Protection (8a78b2b)
  - Updated docker-compose configurations with new environment variables
  - E2E test suite improvements and reliability fixes
  - Added Kubernetes deployment note in README
-
-### Kubernetes
-
-  A `CSRF_SECRET` environment variable is now required for CSRF protection. Generate a secure 32+ character random string:
-
-  ```bash
-  openssl rand -base64 32
-
-  Add it to your deployment:
-  - Docker Compose: Add CSRF_SECRET=<your-secret> to the backend service environment
-  - Kubernetes: Add to your ConfigMap/Secret and reference in the backend deployment
-
-  If not set, the backend will refuse to start.
-  ```
@@ -1 +1 @@
-0.3.2
+0.2.1
@@ -1,12 +1,12 @@
 {
  "name": "backend",
-  "version": "0.3.2",
+  "version": "0.1.8",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "backend",
-      "version": "0.3.2",
+      "version": "0.1.8",
      "license": "ISC",
      "dependencies": {
        "@prisma/client": "^5.22.0",
@@ -1,6 +1,6 @@
 {
  "name": "backend",
-  "version": "0.3.2",
+  "version": "0.2.1",
  "description": "",
  "main": "index.js",
  "scripts": {
@@ -1,172 +0,0 @@
-/**
- * Issue #38: CSRF fails with multiple reverse proxies
- *
- * This test demonstrates how trust proxy settings affect CSRF validation
- * when ExcaliDash is behind multiple proxy layers (e.g., Traefik, Synology NAS)
- */
-
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import express from "express";
-import request from "supertest";
-import {
-  createCsrfToken,
-  validateCsrfToken,
-  getCsrfTokenHeader,
-} from "../security";
-
-// mock the getClientId function behavior
-const getClientIdFromRequest = (req: express.Request): string => {
-  const ip = req.ip || req.connection.remoteAddress || "unknown";
-  const userAgent = req.headers["user-agent"] || "unknown";
-  return `${ip}:${userAgent}`.slice(0, 256);
-};
-
-describe("Issue #38: CSRF with trust proxy settings", () => {
-  let app: express.Application;
-
-  beforeEach(() => {
-    app = express();
-    app.use(express.json());
-  });
-
-  it("demonstrates the trust proxy issue with multiple proxies", async () => {
-    // ext proxy -> frontend nginx -> backend
-    // X-Forwarded-For: 203.0.113.42 (client), 10.0.0.5 (external proxy), 172.17.0.3 (frontend nginx)
-
-    // With trust proxy: 1 (current setting)
-    const app1 = express();
-    app1.set("trust proxy", 1);
-    app1.use(express.json());
-
-    app1.get("/test-ip", (req, res) => {
-      res.json({
-        ip: req.ip,
-        clientId: getClientIdFromRequest(req),
-      });
-    });
-
-    // Simulate request through multiple proxies
-    const response1 = await request(app1)
-      .get("/test-ip")
-      .set("X-Forwarded-For", "203.0.113.42, 10.0.0.5, 172.17.0.3")
-      .set("User-Agent", "Mozilla/5.0 Test");
-
-    // With trust proxy: 1 in supertest (no real socket), Express takes the last IP
-    // In production with a real connection, behavior differs - the key point is it's NOT the client IP
-    expect(response1.body.ip).toBe("172.17.0.3");
-    console.log(
-      "trust proxy: 1 → IP:",
-      response1.body.ip,
-      "(not the real client IP)",
-    );
-
-    // With trust proxy: true
-    const app2 = express();
-    app2.set("trust proxy", true);
-    app2.use(express.json());
-
-    app2.get("/test-ip", (req, res) => {
-      res.json({
-        ip: req.ip,
-        clientId: getClientIdFromRequest(req),
-      });
-    });
-
-    const response2 = await request(app2)
-      .get("/test-ip")
-      .set("X-Forwarded-For", "203.0.113.42, 10.0.0.5, 172.17.0.3")
-      .set("User-Agent", "Mozilla/5.0 Test");
-
-    // With trust proxy: true, Express takes leftmost IP
-    expect(response2.body.ip).toBe("203.0.113.42");
-    console.log(
-      "trust proxy: true → IP:",
-      response2.body.ip,
-      "(real client IP - CORRECT)",
-    );
-  });
-
-  it("simulates CSRF failure scenario from issue #38", async () => {
-    const userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";
-
-    // Request 1: Fetch CSRF token
-    // X-Forwarded-For shows: client, external-proxy-1, frontend-nginx
-    const clientIp1 = "203.0.113.42";
-    const externalProxyIp1 = "10.0.0.5"; // External proxy IP on first request
-
-    // With trust proxy: 1, Express sees the external proxy IP
-    const clientId1 = `${externalProxyIp1}:${userAgent}`;
-    const token = createCsrfToken(clientId1);
-
-    console.log(
-      "  X-Forwarded-For:",
-      `${clientIp1}, ${externalProxyIp1}, 172.17.0.3`,
-    );
-    console.log("  Express sees IP:", externalProxyIp1);
-    console.log("  ClientId:", clientId1.slice(0, 50) + "...");
-
-    // Request 2: Try to create drawing with token
-    // External proxy IP might differ slightly
-    const externalProxyIp2 = "10.0.0.6";
-
-    const clientId2 = `${externalProxyIp2}:${userAgent}`;
-
-    console.log(
-      "  X-Forwarded-For:",
-      `${clientIp1}, ${externalProxyIp2}, 172.17.0.3`,
-    );
-    console.log("  Express sees IP:", externalProxyIp2);
-    console.log("  ClientId:", clientId2.slice(0, 50) + "...");
-
-    // CSRF validation fails because clientId changed
-    const isValid = validateCsrfToken(clientId2, token);
-
-    expect(isValid).toBe(false);
-    console.log("   Expected:", clientId1.slice(0, 50) + "...");
-    console.log("   Got:", clientId2.slice(0, 50) + "...");
-  });
-
-  it("shows the fix works with trust proxy: true", async () => {
-    const userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)";
-    const realClientIp = "203.0.113.42";
-
-    const clientId1 = `${realClientIp}:${userAgent}`;
-    const token = createCsrfToken(clientId1);
-
-    console.log("  X-Forwarded-For:", `${realClientIp}, 10.0.0.5, 172.17.0.3`);
-    console.log("  Express sees IP:", realClientIp);
-
-    // Request 2: Use token (even if middle proxy IPs differ)
-    const clientId2 = `${realClientIp}:${userAgent}`;
-
-    console.log("Create drawing");
-    console.log("X-Forwarded-For:", `${realClientIp}, 10.0.0.6, 172.17.0.3`);
-    console.log("Express sees IP:", realClientIp, "(same!)");
-
-    const isValid = validateCsrfToken(clientId2, token);
-
-    expect(isValid).toBe(true);
-    console.log("\nCSRF Validation: SUCCESS");
-  });
-
-  it("demonstrates the Synology NAS scenario from issue #38", async () => {
-    const app = express();
-    app.set("trust proxy", 1);
-    app.use(express.json());
-
-    let seenIp: string | undefined;
-    app.get("/test", (req, res) => {
-      seenIp = req.ip;
-      res.json({ ip: req.ip });
-    });
-
-    // Client -> Synology (192.168.1.x) -> Docker frontend (192.168.11.x) -> Backend
-    // In supertest without real socket, trust proxy: 1 returns last IP
-    // Key point: it's NOT the real client IP (192.168.0.100)
-    await request(app)
-      .get("/test")
-      .set("X-Forwarded-For", "192.168.0.100, 192.168.1.4, 192.168.11.166");
-    console.log("  With trust proxy: 1, Express sees:", seenIp);
-    expect(seenIp).toBe("192.168.11.166"); // Not the real client IP
-  });
-});
@@ -1,159 +0,0 @@
-/**
- * Security hardening tests
- *
- * Tests for input validation and sanitization improvements:
- * - Route parameter ID validation
- * - Collection name validation/sanitization
- * - Library items validation
- * - Socket.io input validation helpers
- * - Path traversal protection in archive file names
- */
-
-import { describe, it, expect } from "vitest";
-import { sanitizeText } from "../security";
-
-// Replicate the validation functions from index.ts to test them in isolation
-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const SAFE_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
-
-const isValidResourceId = (id: string): boolean => {
-  return UUID_REGEX.test(id) || SAFE_ID_REGEX.test(id);
-};
-
-describe("Route Parameter ID Validation", () => {
-  it("should accept valid UUID v4", () => {
-    expect(isValidResourceId("550e8400-e29b-41d4-a716-446655440000")).toBe(true);
-    expect(isValidResourceId("6ba7b810-9dad-11d1-80b4-00c04fd430c8")).toBe(true);
-  });
-
-  it("should accept safe alphanumeric IDs", () => {
-    expect(isValidResourceId("trash")).toBe(true);
-    expect(isValidResourceId("default")).toBe(true);
-    expect(isValidResourceId("my-collection-123")).toBe(true);
-    expect(isValidResourceId("element_1")).toBe(true);
-  });
-
-  it("should reject IDs with path traversal", () => {
-    expect(isValidResourceId("../etc/passwd")).toBe(false);
-    expect(isValidResourceId("..\\windows\\system32")).toBe(false);
-    expect(isValidResourceId("foo/bar")).toBe(false);
-  });
-
-  it("should reject IDs with SQL injection attempts", () => {
-    expect(isValidResourceId("'; DROP TABLE drawings; --")).toBe(false);
-    expect(isValidResourceId("1 OR 1=1")).toBe(false);
-  });
-
-  it("should reject IDs with script injection", () => {
-    expect(isValidResourceId("<script>alert(1)</script>")).toBe(false);
-    expect(isValidResourceId('"><img src=x onerror=alert(1)>')).toBe(false);
-  });
-
-  it("should reject empty or excessively long IDs", () => {
-    expect(isValidResourceId("")).toBe(false);
-    expect(isValidResourceId("a".repeat(129))).toBe(false);
-  });
-
-  it("should accept IDs at maximum length", () => {
-    expect(isValidResourceId("a".repeat(128))).toBe(true);
-  });
-});
-
-describe("Collection Name Validation", () => {
-  it("should sanitize collection names with HTML", () => {
-    const result = sanitizeText('<script>alert("xss")</script>My Collection', 255);
-    expect(result).not.toContain("<script>");
-    expect(result).toContain("My Collection");
-  });
-
-  it("should preserve normal collection names", () => {
-    const result = sanitizeText("My Drawings Collection", 255);
-    expect(result).toBe("My Drawings Collection");
-  });
-
-  it("should truncate overly long names", () => {
-    const longName = "A".repeat(300);
-    const result = sanitizeText(longName, 255);
-    expect(result.length).toBeLessThanOrEqual(255);
-  });
-
-  it("should strip control characters", () => {
-    const result = sanitizeText("Name\x00With\x07Control\x1FChars", 255);
-    expect(result).not.toContain("\x00");
-    expect(result).not.toContain("\x07");
-    expect(result).not.toContain("\x1F");
-  });
-});
-
-describe("Library Items Validation", () => {
-  it("should accept valid item counts", () => {
-    const items = Array.from({ length: 100 }, (_, i) => ({ id: `item-${i}` }));
-    expect(items.length).toBeLessThanOrEqual(10000);
-  });
-
-  it("should flag excessive item counts", () => {
-    const items = Array.from({ length: 10001 }, (_, i) => ({ id: `item-${i}` }));
-    expect(items.length).toBeGreaterThan(10000);
-  });
-});
-
-describe("Archive Path Sanitization", () => {
-  const sanitizeArchiveName = (name: string): string => {
-    return name.replace(/[<>:"/\\|?*]/g, "_").replace(/\.\./g, "_");
-  };
-
-  it("should replace path traversal sequences", () => {
-    const result = sanitizeArchiveName("../../etc/passwd");
-    expect(result).not.toContain("..");
-    expect(result).not.toContain("/");
-  });
-
-  it("should replace dangerous characters", () => {
-    const result = sanitizeArchiveName('my<drawing>:name/"test"\\path|file?name*');
-    expect(result).not.toContain("<");
-    expect(result).not.toContain(">");
-    expect(result).not.toContain(":");
-    expect(result).not.toContain('"');
-    expect(result).not.toContain("\\");
-    expect(result).not.toContain("|");
-    expect(result).not.toContain("?");
-    expect(result).not.toContain("*");
-  });
-
-  it("should preserve normal names", () => {
-    const result = sanitizeArchiveName("My Drawing 2024");
-    expect(result).toBe("My Drawing 2024");
-  });
-
-  it("should handle double-dot paths", () => {
-    const result = sanitizeArchiveName("..folder../..test..");
-    expect(result).not.toContain("..");
-  });
-});
-
-describe("Socket.io Input Validation Helpers", () => {
-  const isValidDrawingId = (id: unknown): id is string =>
-    typeof id === "string" && id.length > 0 && id.length <= 128 && isValidResourceId(id);
-
-  it("should accept valid drawing IDs", () => {
-    expect(isValidDrawingId("550e8400-e29b-41d4-a716-446655440000")).toBe(true);
-    expect(isValidDrawingId("my-drawing-1")).toBe(true);
-  });
-
-  it("should reject non-string inputs", () => {
-    expect(isValidDrawingId(123)).toBe(false);
-    expect(isValidDrawingId(null)).toBe(false);
-    expect(isValidDrawingId(undefined)).toBe(false);
-    expect(isValidDrawingId({})).toBe(false);
-    expect(isValidDrawingId([])).toBe(false);
-  });
-
-  it("should reject empty strings", () => {
-    expect(isValidDrawingId("")).toBe(false);
-  });
-
-  it("should reject strings with injection attempts", () => {
-    expect(isValidDrawingId("<script>alert(1)</script>")).toBe(false);
-    expect(isValidDrawingId("../../../etc/passwd")).toBe(false);
-  });
-});
@@ -129,25 +129,6 @@ const initializeUploadDir = async () => {
 };

 const app = express();
-
-// Trust proxy headers (X-Forwarded-For, X-Real-IP) from nginx
-// Required for correct client IP detection when running behind a reverse proxy
-// Fix for issue #38: Use 'true' to handle multiple proxy layers (e.g., Traefik, Synology NAS)
-// This ensures Express extracts the real client IP from the leftmost X-Forwarded-For value
-const trustProxyConfig = process.env.TRUST_PROXY || "true";
-const trustProxyValue = trustProxyConfig === "true"
-  ? true
-  : trustProxyConfig === "false"
-  ? false
-  : parseInt(trustProxyConfig, 10) || 1;
-app.set("trust proxy", trustProxyValue);
-
-if (trustProxyValue === true) {
-  console.log("[config] trust proxy: enabled (handles multiple proxy layers)");
-} else {
-  console.log(`[config] trust proxy: ${trustProxyValue}`);
-}
-
 const httpServer = createServer(app);
 const io = new Server(httpServer, {
  cors: {
@@ -235,15 +216,10 @@ const upload = multer({
    files: 1,
  },
  fileFilter: (req, file, cb) => {
-    // Reject filenames with path traversal characters
-    const safeName = path.basename(file.originalname);
-    if (safeName !== file.originalname || /[/\\]/.test(file.originalname)) {
-      return cb(new Error("Invalid filename"));
-    }
    if (file.fieldname === "db") {
      const isSqliteDb =
-        safeName.endsWith(".db") ||
-        safeName.endsWith(".sqlite");
+        file.originalname.endsWith(".db") ||
+        file.originalname.endsWith(".sqlite");
      if (!isSqliteDb) {
        return cb(new Error("Only .db or .sqlite files are allowed"));
      }
@@ -287,7 +263,6 @@ app.use((req, res, next) => {
    "Permissions-Policy",
    "geolocation=(), microphone=(), camera=()"
  );
-  res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");

  res.setHeader(
    "Content-Security-Policy",
@@ -297,9 +272,7 @@ app.use((req, res, next) => {
    "font-src 'self' https://fonts.gstatic.com; " +
    "img-src 'self' data: blob: https:; " +
    "connect-src 'self' ws: wss:; " +
-    "frame-ancestors 'none'; " +
-    "base-uri 'self'; " +
-    "form-action 'self';"
+    "frame-ancestors 'none';"
  );

  next();
@@ -351,24 +324,9 @@ app.use((req, res, next) => {
 const getClientId = (req: express.Request): string => {
  const ip = req.ip || req.connection.remoteAddress || "unknown";
  const userAgent = req.headers["user-agent"] || "unknown";
-  const clientId = `${ip}:${userAgent}`.slice(0, 256);
-
-  // Debug logging for CSRF troubleshooting (issue #38)
-  if (process.env.DEBUG_CSRF === "true") {
-    console.log("[CSRF DEBUG] getClientId", {
-      method: req.method,
-      path: req.path,
-      ip,
-      remoteAddress: req.connection.remoteAddress,
-      "x-forwarded-for": req.headers["x-forwarded-for"],
-      "x-real-ip": req.headers["x-real-ip"],
-      userAgent: userAgent.slice(0, 100),
-      clientIdPreview: clientId.slice(0, 60) + "...",
-      trustProxySetting: req.app.get("trust proxy"),
-    });
-  }
-
-  return clientId;
+  // Create a simple hash for client identification
+  // In production, you might use a session ID instead
+  return `${ip}:${userAgent}`.slice(0, 256);
 };

 // Rate limiter specifically for CSRF token generation to prevent store exhaustion
@@ -483,28 +441,6 @@ const csrfProtectionMiddleware = (
 // Apply CSRF protection to all routes
 app.use(csrfProtectionMiddleware);

-// Validate route parameter IDs to prevent injection and ensure expected format
-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const SAFE_ID_REGEX = /^[a-zA-Z0-9_-]{1,128}$/;
-
-const isValidResourceId = (id: string): boolean => {
-  return UUID_REGEX.test(id) || SAFE_ID_REGEX.test(id);
-};
-
-const validateIdParam = (
-  req: express.Request,
-  res: express.Response,
-  next: express.NextFunction
-) => {
-  const { id } = req.params;
-  if (id && !isValidResourceId(id)) {
-    return res.status(400).json({ error: "Invalid resource ID format" });
-  }
-  next();
-};
-
-app.param("id", validateIdParam);
-
 const filesFieldSchema = z
  .union([z.record(z.string(), z.any()), z.null()])
  .optional()
@@ -694,12 +630,6 @@ interface User {

 const roomUsers = new Map<string, User[]>();

-const isValidSocketId = (id: unknown): id is string =>
-  typeof id === "string" && id.length > 0 && id.length <= 128 && SAFE_ID_REGEX.test(id);
-
-const isValidDrawingId = (id: unknown): id is string =>
-  typeof id === "string" && id.length > 0 && id.length <= 128 && isValidResourceId(id);
-
 io.on("connection", (socket) => {
  socket.on(
    "join-room",
@@ -710,16 +640,10 @@ io.on("connection", (socket) => {
      drawingId: string;
      user: Omit<User, "socketId" | "isActive">;
    }) => {
-      if (!isValidDrawingId(drawingId)) return;
-      if (!user || !isValidSocketId(user.id)) return;
-      const safeName = sanitizeText(typeof user.name === "string" ? user.name : "", 100);
-      const safeInitials = sanitizeText(typeof user.initials === "string" ? user.initials : "", 5);
-      const safeColor = sanitizeText(typeof user.color === "string" ? user.color : "", 30);
-
      const roomId = `drawing_${drawingId}`;
      socket.join(roomId);

-      const newUser: User = { id: user.id, name: safeName, initials: safeInitials, color: safeColor, socketId: socket.id, isActive: true };
+      const newUser: User = { ...user, socketId: socket.id, isActive: true };

      const currentUsers = roomUsers.get(roomId) || [];
      const filteredUsers = currentUsers.filter((u) => u.id !== user.id);
@@ -731,13 +655,11 @@ io.on("connection", (socket) => {
  );

  socket.on("cursor-move", (data) => {
-    if (!data || !isValidDrawingId(data.drawingId)) return;
    const roomId = `drawing_${data.drawingId}`;
    socket.volatile.to(roomId).emit("cursor-move", data);
  });

  socket.on("element-update", (data) => {
-    if (!data || !isValidDrawingId(data.drawingId)) return;
    const roomId = `drawing_${data.drawingId}`;
    socket.to(roomId).emit("element-update", data);
  });
@@ -745,8 +667,6 @@ io.on("connection", (socket) => {
  socket.on(
    "user-activity",
    ({ drawingId, isActive }: { drawingId: string; isActive: boolean }) => {
-      if (!isValidDrawingId(drawingId)) return;
-      if (typeof isActive !== "boolean") return;
      const roomId = `drawing_${drawingId}`;
      const users = roomUsers.get(roomId);
      if (users) {
@@ -1039,12 +959,8 @@ app.get("/collections", async (req, res) => {
 app.post("/collections", async (req, res) => {
  try {
    const { name } = req.body;
-    if (typeof name !== "string" || name.trim().length === 0 || name.trim().length > 255) {
-      return res.status(400).json({ error: "Collection name must be a non-empty string (max 255 characters)" });
-    }
-    const sanitizedName = sanitizeText(name.trim(), 255);
    const newCollection = await prisma.collection.create({
-      data: { name: sanitizedName },
+      data: { name },
    });
    res.json(newCollection);
  } catch (error) {
@@ -1056,13 +972,9 @@ app.put("/collections/:id", async (req, res) => {
  try {
    const { id } = req.params;
    const { name } = req.body;
-    if (typeof name !== "string" || name.trim().length === 0 || name.trim().length > 255) {
-      return res.status(400).json({ error: "Collection name must be a non-empty string (max 255 characters)" });
-    }
-    const sanitizedName = sanitizeText(name.trim(), 255);
    const updatedCollection = await prisma.collection.update({
      where: { id },
-      data: { name: sanitizedName },
+      data: { name },
    });
    res.json(updatedCollection);
  } catch (error) {
@@ -1117,23 +1029,14 @@ app.put("/library", async (req, res) => {
      return res.status(400).json({ error: "Items must be an array" });
    }

-    if (items.length > 10000) {
-      return res.status(400).json({ error: "Library items limit exceeded (max 10,000)" });
-    }
-
-    const serialized = JSON.stringify(items);
-    if (serialized.length > 50 * 1024 * 1024) {
-      return res.status(400).json({ error: "Library data too large" });
-    }
-
    const library = await prisma.library.upsert({
      where: { id: "default" },
      update: {
-        items: serialized,
+        items: JSON.stringify(items),
      },
      create: {
        id: "default",
-        items: serialized,
+        items: JSON.stringify(items),
      },
    });

@@ -1222,12 +1125,12 @@ app.get("/export/json", async (req, res) => {

    Object.entries(drawingsByCollection).forEach(
      ([collectionName, collectionDrawings]) => {
-        const folderName = collectionName.replace(/[<>:"/\\|?*]/g, "_").replace(/\.\./g, "_");
+        const folderName = collectionName.replace(/[<>:"/\\|?*]/g, "_");
        collectionDrawings.forEach((drawing, index) => {
          const fileName = `${drawing.name.replace(
            /[<>:"/\\|?*]/g,
            "_"
-          ).replace(/\.\./g, "_")}.excalidraw`;
+          )}.excalidraw`;
          const filePath = `${folderName}/${fileName}`;

          archive.append(JSON.stringify(drawing.data, null, 2), {
@@ -1319,27 +1222,12 @@ app.post("/import/sqlite", upload.single("db"), async (req, res) => {
    }

    const dbPath = getResolvedDbPath();
-    const backupTimestamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const backupPath = `${dbPath}.backup-${backupTimestamp}`;
+    const backupPath = `${dbPath}.backup`;

    try {
      try {
        await fsPromises.access(dbPath);
        await fsPromises.copyFile(dbPath, backupPath);
-        console.log(`[import] Created backup: ${backupPath}`);
-
-        // Rotate old backups - keep only the 5 most recent
-        const dbDir = path.dirname(dbPath);
-        const dbName = path.basename(dbPath);
-        const files = await fsPromises.readdir(dbDir);
-        const backups = files
-          .filter((f) => f.startsWith(`${dbName}.backup-`))
-          .sort()
-          .reverse();
-        for (const oldBackup of backups.slice(5)) {
-          await removeFileIfExists(path.join(dbDir, oldBackup));
-          console.log(`[import] Removed old backup: ${oldBackup}`);
-        }
      } catch { }

      await moveFile(stagedPath, dbPath);
@@ -1378,17 +1266,6 @@ const ensureTrashCollection = async () => {
  }
 };

-// Global error handler - prevent stack traces from leaking to clients
-app.use((err: any, req: express.Request, res: express.Response, next: express.NextFunction) => {
-  if (err instanceof multer.MulterError) {
-    return res.status(400).json({ error: `Upload error: ${err.message}` });
-  }
-  if (err && err.message) {
-    console.error("Unhandled error:", err.message);
-  }
-  res.status(500).json({ error: "Internal server error" });
-});
-
 httpServer.listen(PORT, async () => {
  await initializeUploadDir();
  await ensureTrashCollection();
@@ -532,6 +532,7 @@ export const validateImportedDrawing = (data: any): boolean => {
 // CSRF Protection
 // ============================================================================

+const CSRF_TOKEN_LENGTH = 32;
 const CSRF_TOKEN_HEADER = "x-csrf-token";
 const CSRF_TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1000; // 24 hours
 const CSRF_TOKEN_FUTURE_SKEW_MS = 5 * 60 * 1000; // 5 minutes clock skew tolerance
@@ -569,12 +570,8 @@ const getCsrfSecret = (): Buffer => {
  cachedCsrfSecret = crypto.randomBytes(32);
  const envLabel = process.env.NODE_ENV ? ` (${process.env.NODE_ENV})` : "";
  console.warn(
-    `[SECURITY WARNING] CSRF_SECRET is not set${envLabel}.\n` +
-    `Using an ephemeral per-process secret.\n` +
-    `  - Tokens will expire on container restart\n` +
-    `  - Horizontal scaling (k8s) will NOT work\n` +
-    `  - Generate a secret: openssl rand -base64 32\n` +
-    `  - Set environment variable: CSRF_SECRET=<generated-secret>`
+    `[security] CSRF_SECRET is not set${envLabel}. Using an ephemeral per-process secret. ` +
+    "For horizontal scaling (k8s), set CSRF_SECRET to the same value on all instances."
  );
  return cachedCsrfSecret;
 };
@@ -1,7 +1,7 @@
 {
  "name": "frontend",
  "private": true,
-  "version": "0.3.2",
+  "version": "0.2.1",
  "type": "module",
  "scripts": {
    "dev": "vite",
@@ -48,7 +48,7 @@ export const UploadProvider: React.FC<{ children: ReactNode }> = ({ children })

  const uploadFiles = useCallback(async (files: File[], targetCollectionId: string | null) => {
    const newTasks: UploadTask[] = files.map(f => ({
-      id: crypto.randomUUID(),
+      id: Math.random().toString(36).substring(2, 11),
      fileName: f.name,
      status: 'pending',
      progress: 0
@@ -56,12 +56,12 @@ export const UploadProvider: React.FC<{ children: ReactNode }> = ({ children })

    setTasks(prev => [...newTasks, ...prev]);

-    // Map file index to task ID for progress callbacks (handles duplicate filenames)
-    const indexToTaskId = new Map<number, string>();
-    newTasks.forEach((t, index) => indexToTaskId.set(index, t.id));
+    // Map file names to task IDs for progress callbacks
+    const fileTaskMap = new Map<string, string>();
+    newTasks.forEach(t => fileTaskMap.set(t.fileName, t.id));

-    const handleProgress = (fileIndex: number, status: UploadStatus, progress: number, error?: string) => {
-      const taskId = indexToTaskId.get(fileIndex);
+    const handleProgress = (fileName: string, status: UploadStatus, progress: number, error?: string) => {
+      const taskId = fileTaskMap.get(fileName);
      if (taskId) {
        updateTask(taskId, { status, progress, error });
      }
@@ -7,7 +7,7 @@ export const importDrawings = async (
  targetCollectionId: string | null,
  onSuccess?: () => void | Promise<void>,
  onProgress?: (
-    fileIndex: number,
+    fileName: string,
    status: UploadStatus,
    progress: number,
    error?: string
@@ -25,20 +25,12 @@ export const importDrawings = async (
  let failCount = 0;
  const errors: string[] = [];

-  // Build a map from drawingFile index to original file index for progress reporting
-  const originalIndexMap = new Map<number, number>();
-  drawingFiles.forEach((df, i) => {
-    const originalIndex = files.indexOf(df);
-    originalIndexMap.set(i, originalIndex);
-  });
-
  // We process files in parallel (Promise.all) but we could limit concurrency if needed.
  // For now, full parallel is fine as browser limits connection count anyway.
  await Promise.all(
-    drawingFiles.map(async (file, drawingIndex) => {
-      const fileIndex = originalIndexMap.get(drawingIndex) ?? drawingIndex;
+    drawingFiles.map(async (file) => {
      try {
-        if (onProgress) onProgress(fileIndex, 'processing', 0); // Parsing phase
+        if (onProgress) onProgress(file.name, 'processing', 0); // Parsing phase

        const text = await file.text();
        const data = JSON.parse(text);
@@ -69,7 +61,7 @@ export const importDrawings = async (
          preview: svg.outerHTML,
        };

-        if (onProgress) onProgress(fileIndex, 'uploading', 0);
+        if (onProgress) onProgress(file.name, 'uploading', 0);

        await api.post("/drawings", payload, {
          headers: {
@@ -81,12 +73,12 @@ export const importDrawings = async (
              const percentCompleted = Math.round(
                (progressEvent.loaded * 100) / progressEvent.total
              );
-              onProgress(fileIndex, 'uploading', percentCompleted);
+              onProgress(file.name, 'uploading', percentCompleted);
            }
          },
        });

-        if (onProgress) onProgress(fileIndex, 'success', 100);
+        if (onProgress) onProgress(file.name, 'success', 100);
        successCount++;

      } catch (err: any) {
@@ -98,7 +90,7 @@ export const importDrawings = async (
          err?.message ||
          "Upload failed";
        errors.push(`${file.name}: ${errorMessage}`);
-        if (onProgress) onProgress(fileIndex, 'error', 0, errorMessage);
+        if (onProgress) onProgress(file.name, 'error', 0, errorMessage);
      }
    })
  );
@@ -15,16 +15,19 @@ try {
  console.warn("Unable to read VERSION file:", error);
 }

-const appVersion = process.env.VITE_APP_VERSION?.trim() || versionFromFile;
-const buildLabel = process.env.VITE_APP_BUILD_LABEL?.trim() || "local development build";
+if (
+  !process.env.VITE_APP_VERSION ||
+  process.env.VITE_APP_VERSION.trim().length === 0
+) {
+  process.env.VITE_APP_VERSION = versionFromFile;
+  if (!process.env.VITE_APP_BUILD_LABEL) {
+    process.env.VITE_APP_BUILD_LABEL = "local development build";
+  }
+}

 // https://vite.dev/config/
 export default defineConfig({
  plugins: [react()],
-  define: {
-    'import.meta.env.VITE_APP_VERSION': JSON.stringify(appVersion),
-    'import.meta.env.VITE_APP_BUILD_LABEL': JSON.stringify(buildLabel),
-  },
  server: {
    proxy: {
      "/api": {
@@ -1,109 +0,0 @@
-#!/bin/bash
-set -e
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# Custom name is required
-CUSTOM_NAME=$1
-
-if [ -z "$CUSTOM_NAME" ]; then
-    echo -e "${RED}ERROR: Custom name is required!${NC}"
-    echo -e "${YELLOW}Usage: $0 <custom-name>${NC}"
-    echo -e "${YELLOW}Example: $0 issue38${NC}"
-    echo -e "${YELLOW}  This will create tags like: 0.3.1-dev-issue38${NC}"
-    exit 1
-fi
-
-# Configuration
-DOCKER_USERNAME="zimengxiong"
-IMAGE_NAME="excalidash"
-BASE_VERSION=$(node -e "try { console.log(require('fs').readFileSync('VERSION', 'utf8').trim()) } catch { console.log('0.0.0') }")
-VERSION="${BASE_VERSION}-dev-${CUSTOM_NAME}"
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
-
-echo -e "${BLUE}===========================================${NC}"
-echo -e "${BLUE}ExcaliDash Custom Dev Release${NC}"
-echo -e "${BLUE}===========================================${NC}"
-echo ""
-echo -e "${YELLOW}Branch:       ${CURRENT_BRANCH}${NC}"
-echo -e "${YELLOW}Base version: ${BASE_VERSION}${NC}"
-echo -e "${YELLOW}Custom name:  ${CUSTOM_NAME}${NC}"
-echo -e "${YELLOW}Full tag:     ${VERSION}${NC}"
-echo ""
-echo -e "${YELLOW}This will publish images with tag: ${VERSION}${NC}"
-echo -e "${YELLOW}Dev images will NOT update 'latest' or 'dev' tags${NC}"
-echo ""
-
-# Confirm before proceeding
-read -p "Continue? (y/N) " -n 1 -r
-echo
-if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-    echo -e "${RED}Aborted.${NC}"
-    exit 1
-fi
-
-# Check if logged in to Docker Hub
-echo -e "${YELLOW}Checking Docker Hub authentication...${NC}"
-if ! docker info | grep -q "Username: $DOCKER_USERNAME"; then
-    echo -e "${YELLOW}Not logged in. Please login to Docker Hub:${NC}"
-    docker login
-else
-    echo -e "${GREEN}✓ Already logged in as $DOCKER_USERNAME${NC}"
-fi
-
-# Create buildx builder if it doesn't exist
-echo -e "${YELLOW}Setting up buildx builder...${NC}"
-if ! docker buildx inspect excalidash-builder > /dev/null 2>&1; then
-    echo -e "${YELLOW}Creating new buildx builder...${NC}"
-    docker buildx create --name excalidash-builder --use --bootstrap
-else
-    echo -e "${GREEN}✓ Using existing buildx builder${NC}"
-    docker buildx use excalidash-builder
-fi
-
-# Build and push backend image
-echo ""
-echo -e "${BLUE}Building and pushing backend image...${NC}"
-docker buildx build \
-    --platform linux/amd64,linux/arm64 \
-    --tag $DOCKER_USERNAME/$IMAGE_NAME-backend:$VERSION \
-    --file backend/Dockerfile \
-    --push \
-    backend/
-
-echo -e "${GREEN}✓ Backend image pushed successfully${NC}"
-
-# Build and push frontend image
-echo ""
-echo -e "${BLUE}Building and pushing frontend image...${NC}"
-docker buildx build \
-    --platform linux/amd64,linux/arm64 \
-    --tag $DOCKER_USERNAME/$IMAGE_NAME-frontend:$VERSION \
-    --build-arg VITE_APP_VERSION=$VERSION \
-    --file frontend/Dockerfile \
-    --push \
-    .
-
-echo -e "${GREEN}✓ Frontend image pushed successfully${NC}"
-
-echo ""
-echo -e "${BLUE}===========================================${NC}"
-echo -e "${GREEN}✓ Custom dev images published!${NC}"
-echo -e "${BLUE}===========================================${NC}"
-echo ""
-echo -e "${YELLOW}Images published:${NC}"
-echo -e "  • $DOCKER_USERNAME/$IMAGE_NAME-backend:$VERSION"
-echo -e "  • $DOCKER_USERNAME/$IMAGE_NAME-frontend:$VERSION"
-echo ""
-echo -e "${YELLOW}To use these images in docker-compose:${NC}"
-echo -e "${BLUE}  services:"
-echo -e "    backend:"
-echo -e "      image: $DOCKER_USERNAME/$IMAGE_NAME-backend:$VERSION"
-echo -e "    frontend:"
-echo -e "      image: $DOCKER_USERNAME/$IMAGE_NAME-frontend:$VERSION${NC}"
-echo ""
Author	SHA1	Message	Date
Zimeng Xiong	44fb456405	chore: pre-release v0.2.1-dev	2026-01-14 10:38:28 -08:00
adamant368	8f9b9b4945	feat/upload-bar (#30 ) * feat/upload-bar: add a upload bar when user upload file, indicate the upload process * feat/save-loading-status: add save status when click back button from editor * fix: address PR review issues in upload and save features - Replace deprecated substr() with substring() in UploadContext - Fix broken error handling that checked stale task status - Fix missing useEffect dependency in UploadStatus - Fix CSS class conflict in progress bar styling - Add error recovery for save state in Editor (reset on failure) - Use .finally() instead of .then() to ensure refresh on upload failure - Fix inconsistent indentation in UploadContext * fix e2e tests --------- Co-authored-by: Zimeng Xiong <zxzimeng@gmail.com>	2026-01-14 09:25:17 -08:00
Zimeng Xiong	cae8f3cbf6	add K8S note in README, fix broken e2e	2026-01-14 08:57:04 -08:00
Zimeng Xiong	e4e48b13d8	chore: clean up CSRF implementation - Remove unused generateCsrfToken export from security.ts - Remove redundant /csrf-token path check (GET already exempt) - Restore defineConfig wrapper in vitest.config.ts for type safety	2026-01-14 08:21:49 -08:00
AdrianAcala	8a78b2bb2e	feat(security): implement CSRF protection	2025-12-21 10:08:05 -08:00
@@ -1 +1 @@
 .3.2
 .2.1