cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity
27 Commits 1 Branch 0 Tags
04f5786cf69bf118994df664fd5b3cb991342f84
Commit Graph

5 Commits

Author SHA1 Message Date
Catherine Renelle 0bba161c12 Phase 9: Admin & DevOps — health check, rate limiting, logging, site admin, Docker healthcheck 
- Health check endpoint (GET /api/health) with DB probe and uptime
- In-memory sliding window rate limiting on login (10/60s) and register (5/3600s)
- Structured logging with pino (request timing in hooks, Socket.IO events in server.js)
- Site admin dashboard with tenant stats, CRUD, and requireSiteAdmin guard
- Tenant admin enhanced with tag and category management UI
- Docker HEALTHCHECK in Dockerfile and docker-compose.yml
- Backup documentation (docs/backup.md)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-26 01:24:24 -05:00
Catherine Renelle bd12160ebb Phase 2: Enforce Row-Level Security at the PostgreSQL level 
- Rewrite rls.ts with withTenant()/withBypassRLS() using parameterized
  set_config() in interactive Prisma transactions (no SQL injection)
- Add FORCE ROW LEVEL SECURITY on all 15 tenant-scoped tables
- Add __bypass__ sentinel and WITH CHECK clauses to every RLS policy
- Explicitly DISABLE RLS on tenants, tenant_hostnames, sessions
- Wrap all API route and page loader queries in withTenant()
- Wrap validateSession() in withBypassRLS() (joins RLS-protected users)
- Keep existing tenantId where-clause filters as optimization layer
- Add postgresql-client to Dockerfile and auto-apply RLS via entrypoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-25 22:54:26 -05:00
Catherine Renelle b47cc8748d Add docker-entrypoint.sh to retry DB connection on startup 
The app container starts before DNS resolution is ready,
causing prisma db push to fail. Entrypoint now retries
until the database is reachable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-25 21:45:13 -05:00
Catherine Renelle 2c0583d0e4 Fix Docker build: add native deps for bcrypt, simplify vite config 
- Add python3/make/g++ to Alpine for bcrypt native compilation
- Remove Socket.IO vite plugin (uses SvelteKit aliases unavailable at config level)
- Use prisma db push instead of migrate deploy for initial setup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-25 21:05:45 -05:00
Catherine Renelle 2f398711c8 Initial implementation: multi-tenant Kanban board (Phase 1) 
Complete Phase 1 foundation with working board, column, and card CRUD:
- SvelteKit + TypeScript + Tailwind CSS v4 + adapter-node
- Full Prisma schema with 18 tables (tenants, users, boards, columns, cards, etc.)
- Multi-tenant architecture with hostname-based tenant resolution
- Email/password auth with bcrypt + session cookies
- Board/Column/Card API routes with full CRUD
- Fractional indexing for drag-and-drop ordering
- Board view with svelte-dnd-action for column and card drag-and-drop
- Card modal with inline editing
- Auth pages (login, register)
- Board listing with create form
- RLS policies SQL script for tenant isolation
- Prisma RLS client extensions (forTenant/bypassRLS)
- Permission helpers (canEditBoard, canManageMembers, etc.)
- Socket.IO server setup (dev Vite plugin + production Express server)
- Client-side socket store for real-time updates
- Docker Compose (app + PostgreSQL 16) + multi-stage Dockerfile
- Database seed script (default tenant + admin user)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-25 20:58:49 -05:00