Strip emoji from docs, fix XSS/hashing vulnerabilities, remediate all failing CI checks (#1)

* Initial plan * Fix security vulnerabilities: MD5→SHA-256, XSS via dangerouslySetInnerHTML/innerHTML, insecure randomness, CodeQL config Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Clean up README: remove decorative emojis for a professional tone Remove all emojis from section headers, list item prefixes, and decorative positions. Replace ✅ phase status markers with '(Complete)' text. Keep the ⭐ in the final call-to-action line. No changes to links, badges, code blocks, or technical content. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from CONTRIBUTING.md Remove all emoji from section headers and closing line while preserving links, code blocks, and technical content. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from documentation files Remove all emoji characters from 8 documentation files in docs/. Replace status-marker checkmarks (✅) with '(Done)' text. Remove decorative emojis from headers and body text entirely. Preserve emojis inside code blocks unchanged. Clean up trailing whitespace introduced by removals. Files modified: - DEPLOYMENT_GUIDE.md - IMPLEMENTATION_PLAN.md - MILESTONE_6_SUMMARY.md - PRODUCTION_ROADMAP.md - PROJECT_STATUS.md - REPOSITORY_ENHANCEMENT.md - ROADMAP.md - SECURITY_AUDIT_ROADMAP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: remove emoji characters from documentation files Remove all emoji characters from 9 markdown files while preserving code block content (box-drawing characters, indentation). Emojis removed from headers, list items, and body text across READMEs, issue templates, PR template, runbook, and mobile docs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Remove excessive emoji from all documentation for professional presentation Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Fix PluginWidget initial state and remove || true from security audit steps Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> * Remediate all failing CI checks: update deprecated actions, fix npm vulnerabilities, fix migrations YAML Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com> * Fix all remaining CI failures: Node 18→20, fix test API contract, fix pytest version, fix Postgres health checks Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: TLimoges33 <125313326+TLimoges33@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: SynOSdev <257853113+SynOSdev@users.noreply.github.com>
2026-03-14 08:59:37 -04:00
parent 2b961611fd
commit 90750ee8df
53 changed files with 1852 additions and 1989 deletions
@@ -5,18 +5,18 @@ This backend supports TOTP-based 2FA and one-time recovery codes.
 Key flows:

 - Admin-assisted signup + setup
-  - After creating a user via the backend while logged in as admin, an alternate cookie `session_alt` will be set.
-  - Use this cookie when calling 2FA endpoints to configure TOTP for the new account without logging the admin out.
+ - After creating a user via the backend while logged in as admin, an alternate cookie `session_alt` will be set.
+ - Use this cookie when calling 2FA endpoints to configure TOTP for the new account without logging the admin out.

 - TOTP setup
-  1) POST /api/v1/auth/2fa/setup
-     - Show the `otpauth_uri` QR and the plaintext `recovery_codes` once.
-  2) After the user scans the QR in an authenticator, prompt for a 6-digit code.
-  3) POST /api/v1/auth/2fa/enable with `{ code }`.
+ 1) POST /api/v1/auth/2fa/setup
+ - Show the `otpauth_uri` QR and the plaintext `recovery_codes` once.
+ 2) After the user scans the QR in an authenticator, prompt for a 6-digit code.
+ 3) POST /api/v1/auth/2fa/enable with `{ code }`.

 - Login with 2FA
-  - If the login response indicates 2FA is required (401 with detail), ask the user for their TOTP code and retry including `totp_code`.
-  - Provide an option to use a recovery code; if used successfully, it is consumed and cannot be used again.
+ - If the login response indicates 2FA is required (401 with detail), ask the user for their TOTP code and retry including `totp_code`.
+ - Provide an option to use a recovery code; if used successfully, it is consumed and cannot be used again.

 Notes

@@ -26,10 +26,10 @@
    },
    "devDependencies": {
        "@tailwindcss/forms": "^0.5.10",
-        "@vitejs/plugin-react": "^4.3.0",
+        "@vitejs/plugin-react": "^5.2.0",
        "autoprefixer": "^10.4.21",
        "postcss": "^8.5.6",
        "tailwindcss": "^4.1.12",
-        "vite": "^5.0.0"
+        "vite": "^8.0.0"
    }
 }
@@ -208,12 +208,22 @@ const MobileHabitTracker = ({ userId, isMobile = false }) => {
    const celebration = document.createElement("div");
    celebration.className =
      "fixed inset-0 flex items-center justify-center z-50 pointer-events-none";
-    celebration.innerHTML = `
-            <div class="bg-gradient-to-r from-yellow-400 to-orange-500 text-white rounded-full p-8 animate-bounce shadow-2xl">
-                <div class="text-4xl">🔥</div>
-                <div class="text-xl font-bold mt-2">${milestone} Day Streak!</div>
-            </div>
-        `;
+
+    const inner = document.createElement("div");
+    inner.className =
+      "bg-gradient-to-r from-yellow-400 to-orange-500 text-white rounded-full p-8 animate-bounce shadow-2xl";
+
+    const emoji = document.createElement("div");
+    emoji.className = "text-4xl";
+    emoji.textContent = "\uD83D\uDD25";
+
+    const text = document.createElement("div");
+    text.className = "text-xl font-bold mt-2";
+    text.textContent = `${milestone} Day Streak!`;
+
+    inner.appendChild(emoji);
+    inner.appendChild(text);
+    celebration.appendChild(inner);

    document.body.appendChild(celebration);

@@ -65,7 +65,7 @@ export const NotificationSystem: React.FC<NotificationSystemProps> = ({

  const addNotification = useCallback(
    (notification: Omit<NotificationData, "id">) => {
-      const id = `notification-${Date.now()}-${Math.random()}`;
+      const id = `notification-${Date.now()}-${crypto.randomUUID()}`;
      const newNotification: NotificationData = {
        ...notification,
        id,
@@ -5,7 +5,7 @@ import { Card, CardHeader, CardTitle, CardContent } from '../components/ui/card'
 * PluginWidget - Renders a widget from a plugin
 */
 const PluginWidget = ({ widget }) => {
-    const [content, setContent] = useState('');
+    const [content, setContent] = useState(null);
    const [loading, setLoading] = useState(true);
    const [error, setError] = useState(null);

@@ -19,20 +19,12 @@ const PluginWidget = ({ widget }) => {
            setError(null);

            // In a real implementation, this would call the plugin's render function
-            // For now, we'll just show the widget configuration
-            const mockContent = `
-        <div class="p-4">
-          <h3 class="text-lg font-semibold">${widget.config.title || 'Plugin Widget'}</h3>
-          <p class="text-gray-600">Plugin ID: ${widget.plugin_id}</p>
-          <p class="text-gray-600">Widget ID: ${widget.id}</p>
-          <div class="mt-4">
-            <p>This is a placeholder for plugin-rendered content.</p>
-            <p>In a real implementation, the plugin's WASM code would generate this content.</p>
-          </div>
-        </div>
-      `;
-
-            setContent(mockContent);
+            // For now, we'll just show the widget configuration as structured data
+            setContent({
+                title: widget.config.title || 'Plugin Widget',
+                pluginId: widget.plugin_id,
+                widgetId: widget.id,
+            });
        } catch (err) {
            setError(err.message);
        } finally {
@@ -68,7 +60,15 @@ const PluginWidget = ({ widget }) => {

    return (
        <Card>
-            <div dangerouslySetInnerHTML={{ __html: content }} />
+            <div className="p-4">
+                <h3 className="text-lg font-semibold">{content.title}</h3>
+                <p className="text-gray-600">Plugin ID: {content.pluginId}</p>
+                <p className="text-gray-600">Widget ID: {content.widgetId}</p>
+                <div className="mt-4">
+                    <p>This is a placeholder for plugin-rendered content.</p>
+                    <p>In a real implementation, the plugin's WASM code would generate this content.</p>
+                </div>
+            </div>
        </Card>
    );
 };