karti
13dec6b4b8
Seven parallel agents and an adversarial verification pass. The three things worth knowing before reading the diff: RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago. So this does not rebuild them; it closes the gaps an audit found. The big one is that reads were entirely ungoverned: every GET was "any authenticated member", so a junior demand rep and a research contractor could both pull per-block supplier cost and break-even prices from /api/capacity/margin, and every contract's negotiated terms. For a company whose margin is the business, that was the hole that mattered. Adds book:read / economics:read / team:read, a readGuard middleware, and a `viewer` role below member. THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen. Contracts.tsx never called can() at all, so its save button was always enabled against a server requiring contract:sign; Capacity.tsx gated commitment creation on deal:write/demand while the server wanted commitment:write/supply. POST /api/activities was the one write bypassing executeMutation: no capability check, and any member could mutate accounts.lastActivityAt as a side effect. It is now a proper mutation() behind activity:write. The shell becomes three panes — a collapsible shadcn sidebar with an account switcher on the Piggy accent, a header with real search, and Piggy docked to the right, page-aware and persistent across navigation. The phone keeps its bottom tab bar, which is the thing this product already beat trycompai/crm on, and gains the sidebar as a sheet. Calendar is a projection over thirteen dated sources rather than a new table, because a table would duplicate dates that already live on contracts, deals and commitments and would drift — and one ledger answering the question is the whole argument. It surfaces export_authorizations and compliance_artifacts, which had indexed expires_at columns, schema comments saying they must be alerted on, and no read endpoint or UI anywhere. Learn carries two tracks. Concepts are members-only; the platform track can be opened with a share code by someone with no account. The code mints a scoped learn-only token and never a Principal — every route here resolves a principal and then checks capabilities, so a principal-minting code would be one missing check away from leaking the book. "Only platform-track rows may be code-visible" is a database CHECK constraint as well as a write-path rule, and a test asserts a valid learn token still gets 401 on /api/dashboard, /api/accounts and /api/contracts — the same invariant scripts/deploy.sh refuses to ship without. CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a release-* tag and cloud-2 pulls it, so no credential on the shared runner can execute anything on production — by construction rather than by policy. Both halves of deploy.sh's original rule survive: nothing on the runner reaches the host, and a human still decides when it ships. deploy.sh gains a rollback and a public-origin check, and PIG_IMAGE now reaches compose through `sudo env`, without which sudo's env_reset silently resolved every release to pig:local. Tests 141 -> 261. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43 lines
2.0 KiB
Caddyfile
43 lines
2.0 KiB
Caddyfile
# Caddy — reverse proxy for PIG.
|
|
#
|
|
# Serve the app and the API from ONE hostname. Auth sessions live in
|
|
# per-origin browser storage, so splitting them across two hostnames makes
|
|
# sign-in loop endlessly in a way that looks like a server fault.
|
|
|
|
primeintellectgrowth.com, www.primeintellectgrowth.com {
|
|
encode zstd gzip
|
|
|
|
# The MCP endpoint, when Streamable HTTP is enabled. Same origin as the
|
|
# app so it shares the session and needs no CORS allowance.
|
|
reverse_proxy 127.0.0.1:8920
|
|
|
|
|
|
# The inline script hash covers the pre-paint theme script in index.html,
|
|
# which sets light/dark before first paint so dark-mode users do not get a
|
|
# white flash. It cannot be an external file without reintroducing that
|
|
# flash, and it cannot use 'unsafe-inline' without defeating the CSP.
|
|
#
|
|
# IMPORTANT: editing that script changes its hash and CSP will silently
|
|
# block it. The browser console says exactly which hash it wants.
|
|
header {
|
|
# Not public yet. The header covers everything served — og.png, the
|
|
# manifest, the built assets — where the <meta> tag in index.html only
|
|
# covers the HTML document. robots.txt asks crawlers not to fetch;
|
|
# this tells the ones that fetch anyway not to index.
|
|
X-Robots-Tag "noindex, nofollow, noarchive, nosnippet"
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
# The app is entirely first-party except for the auth provider, which
|
|
# it must reach over XHR.
|
|
Content-Security-Policy "default-src 'self'; connect-src 'self' https://*.supabase.co; img-src 'self' data: https://video.karti.ai; style-src 'self' 'unsafe-inline'; script-src 'self' 'sha256-1tTDwCq+TCEyPDSZeYqW5HbmP+unUg8hrgRiZBiH/IU='; frame-src https://video.karti.ai; frame-ancestors 'none'; base-uri 'self'"
|
|
-Server
|
|
}
|
|
}
|
|
|
|
# Short alias. A redirect rather than a second origin, deliberately — see above.
|
|
pig.karti.ai {
|
|
redir https://primeintellectgrowth.com{uri} permanent
|
|
}
|