35e929c5e1
Fixes issues raised by the whole-branch review before merge: - Critical: the previous migration hardcoded the live production functions URL and anon key as the committed default, so every local `supabase db reset` silently pointed dev/test triggers at the real project. Adding a new migration instead of editing the already-applied one (checksum/drift safety), with local dev values as the committed default; production values are applied out-of-band, never committed. - Important: verify_jwt=true plus sending the anon key as a bearer token didn't actually stop anyone, since the anon key is public (ships in the frontend bundle) — confirmed empirically, a request with a valid anon key but no shared secret now gets a real 401. Added a random shared secret known only to the database and the Edge Functions' secret store. - Important: notification emails interpolated raw contact fields into HTML with no escaping. Added escapeHtml() and tests proving injected markup renders as literal text, not live markup. - Important: the URL/key/secret functions moved from public to a private schema with EXECUTE revoked from anon/authenticated, closing an unintended PostgREST RPC endpoint (verified 404 after the fix). Also adds a test:functions npm script now that Deno is confirmed available and the shared email builders' tests pass (12 total incl. the new escaping cases). Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH
51 lines
1.5 KiB
JSON
51 lines
1.5 KiB
JSON
{
|
|
"version": "5",
|
|
"specifiers": {
|
|
"jsr:@std/assert@*": "1.0.19",
|
|
"jsr:@std/internal@^1.0.12": "1.0.14"
|
|
},
|
|
"jsr": {
|
|
"@std/assert@1.0.19": {
|
|
"integrity": "eaada96ee120cb980bc47e040f82814d786fe8162ecc53c91d8df60b8755991e",
|
|
"dependencies": [
|
|
"jsr:@std/internal"
|
|
]
|
|
},
|
|
"@std/internal@1.0.14": {
|
|
"integrity": "291516b3d4c35024d6ffbc0a9df5bf4c64116e05b50012cf846710152d2ffdf7"
|
|
}
|
|
},
|
|
"workspace": {
|
|
"packageJson": {
|
|
"dependencies": [
|
|
"npm:@eslint/js@^10.0.1",
|
|
"npm:@react-three/fiber@^9.7.0",
|
|
"npm:@supabase/supabase-js@^2.112.2",
|
|
"npm:@testing-library/jest-dom@7",
|
|
"npm:@testing-library/react@^16.3.2",
|
|
"npm:@testing-library/user-event@^14.6.1",
|
|
"npm:@types/node@^24.13.3",
|
|
"npm:@types/react-dom@^19.2.3",
|
|
"npm:@types/react@^19.2.17",
|
|
"npm:@types/three@~0.185.3",
|
|
"npm:@vitejs/plugin-react@^6.0.4",
|
|
"npm:eslint-plugin-react-hooks@^7.1.1",
|
|
"npm:eslint-plugin-react-refresh@~0.5.3",
|
|
"npm:eslint@^10.8.0",
|
|
"npm:framer-motion@^12.43.0",
|
|
"npm:globals@^17.7.0",
|
|
"npm:jsdom@^30.0.1",
|
|
"npm:react-dom@^19.2.8",
|
|
"npm:react-router-dom@^7.18.2",
|
|
"npm:react@^19.2.8",
|
|
"npm:three@~0.185.1",
|
|
"npm:tsx@^4.23.11",
|
|
"npm:typescript-eslint@^8.65.0",
|
|
"npm:typescript@~6.0.2",
|
|
"npm:vite@^8.2.0",
|
|
"npm:vitest@^4.1.10"
|
|
]
|
|
}
|
|
}
|
|
}
|