35e929c5e1
Fixes issues raised by the whole-branch review before merge: - Critical: the previous migration hardcoded the live production functions URL and anon key as the committed default, so every local `supabase db reset` silently pointed dev/test triggers at the real project. Adding a new migration instead of editing the already-applied one (checksum/drift safety), with local dev values as the committed default; production values are applied out-of-band, never committed. - Important: verify_jwt=true plus sending the anon key as a bearer token didn't actually stop anyone, since the anon key is public (ships in the frontend bundle) — confirmed empirically, a request with a valid anon key but no shared secret now gets a real 401. Added a random shared secret known only to the database and the Edge Functions' secret store. - Important: notification emails interpolated raw contact fields into HTML with no escaping. Added escapeHtml() and tests proving injected markup renders as literal text, not live markup. - Important: the URL/key/secret functions moved from public to a private schema with EXECUTE revoked from anon/authenticated, closing an unintended PostgREST RPC endpoint (verified 404 after the fix). Also adds a test:functions npm script now that Deno is confirmed available and the shared email builders' tests pass (12 total incl. the new escaping cases). Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH
46 lines
1.2 KiB
JSON
46 lines
1.2 KiB
JSON
{
|
|
"name": "braids_by_mira",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b && vite build",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview",
|
|
"test": "vitest run",
|
|
"test:functions": "deno test supabase/functions/",
|
|
"seed": "tsx scripts/seed.ts"
|
|
},
|
|
"dependencies": {
|
|
"@react-three/fiber": "^9.7.0",
|
|
"@supabase/supabase-js": "^2.112.2",
|
|
"framer-motion": "^12.43.0",
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"react-router-dom": "^7.18.2",
|
|
"three": "^0.185.1"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@testing-library/jest-dom": "^7.0.0",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/node": "^24.13.3",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@types/three": "^0.185.3",
|
|
"@vitejs/plugin-react": "^6.0.4",
|
|
"eslint": "^10.8.0",
|
|
"eslint-plugin-react-hooks": "^7.1.1",
|
|
"eslint-plugin-react-refresh": "^0.5.3",
|
|
"globals": "^17.7.0",
|
|
"jsdom": "^30.0.1",
|
|
"tsx": "^4.23.11",
|
|
"typescript": "~6.0.2",
|
|
"typescript-eslint": "^8.65.0",
|
|
"vite": "^8.2.0",
|
|
"vitest": "^4.1.10"
|
|
}
|
|
}
|