pezkuwichain/pwap
1
0
Fork 0
mirror of https://github.com/pezkuwichain/pwap.git synced 2026-07-26 20:05:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci/build): typecheck gate, npm ci, backend CI, dep+vuln fixes, hygiene

Browse Source 
Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
  on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
  step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
  Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
  live tests run in CI (they need a live chain) — a mockable CI test subset is a
  follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
  react-router v7 open-redirect remains, deferred as a breaking major); backend tar
  ^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
  subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
  language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
  resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
  files (mimari.txt, _scratch_credit_serok.mjs).
This commit is contained in:
Satoshi Qazi Muhammed
2026-07-24 23:43:37 -07:00
parent 1c6ff3d578
commit 27b4057bd4
12 changed files with 113 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/Dockerfile
+1 -1
View File
@@ -49,5 +49,5 @@ WORKDIR /dist
COPY --from=builder /build/web/dist /dist
LABEL org.opencontainers.image.source="https://github.com/pezkuwichain/pwap"
LABEL org.opencontainers.image.description="pwap/web static SPA — Pezkuwi wallet/exchange frontend"
LABEL org.opencontainers.image.licenses="proprietary"
LABEL org.opencontainers.image.licenses="MIT"
CMD ["sh", "-c", "echo 'pwap-web image — extract /dist via: docker create + docker cp'; sleep infinity"]
web/generate-docs-structure.cjs
+17 -2
View File
@@ -17,8 +17,23 @@ const rustdocDestPath = path.join(publicPath, 'sdk_docs'); // Destination for BU
const structureOutputPath = path.join(publicPath, 'docs-structure.json');
const rustdocBuildOutputPath = path.join(pezkuwiSdkRoot, 'target', 'doc'); // Output of cargo doc
// Absolute path to rustup (used to build rustdoc)
const rustupPath = '/home/mamostehp/.cargo/bin/rustup';
// Path to rustup (used to build rustdoc). Resolve dynamically instead of
// hardcoding a per-machine absolute path: prefer $RUSTUP_PATH, then whatever
// is on PATH, then the conventional ~/.cargo/bin/rustup, then bare 'rustup'.
function resolveRustupPath() {
if (process.env.RUSTUP_PATH) return process.env.RUSTUP_PATH;
try {
const which = spawnSync('bash', ['-lc', 'command -v rustup'], { encoding: 'utf8' });
if (which.status === 0 && which.stdout && which.stdout.trim()) {
return which.stdout.trim();
}
} catch { /* fall through */ }
const home = process.env.HOME || require('os').homedir();
const cargoRustup = path.join(home, '.cargo', 'bin', 'rustup');
if (fs.existsSync(cargoRustup)) return cargoRustup;
return 'rustup';
}
const rustupPath = resolveRustupPath();
// Path to the rebranding script (now .cjs)
const rebrandScriptPath = path.join(__dirname, 'rebrand-rustdoc.cjs');
web/package-lock.json
Generated
+12 -12
View File
@@ -58,7 +58,7 @@
"clsx": "^2.1.1",
"cmdk": "^1.0.0",
"date-fns": "^3.6.0",
"dompurify": "^3.3.1",
"dompurify": "^3.4.12",
"embla-carousel-react": "^8.3.0",
"highlight.js": "^11.9.0",
"i18next": "^23.7.6",
@@ -103,7 +103,7 @@
"globals": "^15.15.0",
"husky": "^9.1.7",
"jsdom": "^27.2.0",
"postcss": "^8.4.47",
"postcss": "^8.5.23",
"tailwindcss": "^3.4.11",
"typescript": "^5.5.3",
"typescript-eslint": "^8.0.1",
@@ -7651,9 +7651,9 @@
}
},
"node_modules/dompurify": {
"version": "3.4.10",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.10.tgz",
"integrity": "sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==",
"version": "3.4.12",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
"integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
"license": "(MPL-2.0 OR Apache-2.0)",
"optionalDependencies": {
"@types/trusted-types": "^2.0.7"
@@ -10054,9 +10054,9 @@
}
},
"node_modules/nanoid": {
"version": "3.3.11",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
"integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
"version": "3.3.16",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
"integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
"funding": [
{
"type": "github",
@@ -10800,9 +10800,9 @@
}
},
"node_modules/postcss": {
"version": "8.5.13",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.13.tgz",
"integrity": "sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag==",
"version": "8.5.23",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
"integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
"funding": [
{
"type": "opencollective",
@@ -10819,7 +10819,7 @@
],
"license": "MIT",
"dependencies": {
"nanoid": "^3.3.11",
"nanoid": "^3.3.16",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.1"
},
web/package.json
+3 -2
View File
@@ -8,6 +8,7 @@
"dev": "cp .env.development .env && vite",
"prebuild": "node generate-docs-structure.cjs",
"build": "vite build",
"typecheck": "tsc --noEmit -p tsconfig.app.json",
"build:telegram": "vite build --config vite.config.telegram.ts",
"build:dev": "cp .env.development .env && vite build",
"build:alfa": "cp .env.alfa .env && vite build",
@@ -70,7 +71,7 @@
"clsx": "^2.1.1",
"cmdk": "^1.0.0",
"date-fns": "^3.6.0",
"dompurify": "^3.3.1",
"dompurify": "^3.4.12",
"embla-carousel-react": "^8.3.0",
"highlight.js": "^11.9.0",
"i18next": "^23.7.6",
@@ -142,7 +143,7 @@
"globals": "^15.15.0",
"husky": "^9.1.7",
"jsdom": "^27.2.0",
"postcss": "^8.4.47",
"postcss": "^8.5.23",
"tailwindcss": "^3.4.11",
"typescript": "^5.5.3",
"typescript-eslint": "^8.0.1",
web/src/components/notifications/NotificationBell.tsx
+8 -5
View File
@@ -29,11 +29,14 @@ export default function NotificationBell() {
const [open, setOpen] = useState(false);
useEffect(() => {
if (user) {
loadNotifications();
if (!user) return;
subscribeToNotifications();
}
loadNotifications();
// Return the unsubscribe callback so the realtime channel is torn down
// on unmount / when the user changes — otherwise channels leak and
// setState fires after unmount.
const unsubscribe = subscribeToNotifications();
return unsubscribe;
// eslint-disable-next-line react-hooks/exhaustive-deps
}, [user]);
@@ -55,7 +58,7 @@ export default function NotificationBell() {
const subscribeToNotifications = () => {
const channel = supabase
.channel('notifications')
.channel(`notifications-${user?.id}`)
.on(
'postgres_changes',
{
web/src/main.tsx
+4
View File
@@ -26,6 +26,10 @@ if (typeof window !== 'undefined' && import.meta.env.PROD) {
};
}
// Augment @pezkuwi/api types so api.query/tx/rpc return typed values
// instead of the generic `Codec`. Must be imported before any api usage.
import '@pezkuwi/api-augment';
import { createRoot } from 'react-dom/client'
import App from './App.tsx'
import './index.css'
web/src/pages/ProfileSettings.tsx
+2 -2
View File
@@ -398,8 +398,8 @@ export default function ProfileSettings() {
<SelectItem value="en">English</SelectItem>
<SelectItem value="tr">Türkçe</SelectItem>
<SelectItem value="ar">العربية</SelectItem>
<SelectItem value="kmr">Kurdî</SelectItem>
<SelectItem value="ckb">کوردی</SelectItem>
<SelectItem value="ku-kurmanji">Kurdî (Kurmancî)</SelectItem>
<SelectItem value="ku-sorani">کوردی (سۆرانی)</SelectItem>
<SelectItem value="fa">فارسی</SelectItem>
</SelectContent>
</Select>
web/vite.config.ts
+3
View File
@@ -66,6 +66,9 @@ export default defineConfig(({ command }) => ({
optimizeDeps: {
include: ['@pezkuwi/util-crypto', '@pezkuwi/util', '@pezkuwi/api', '@pezkuwi/extension-dapp', '@pezkuwi/keyring', 'buffer'],
},
// Strip all console.* and debugger statements from production bundles so the
// 600+ dev-time console calls never ship. Dev keeps full logging.
esbuild: command === 'build' ? { drop: ['console', 'debugger'] } : {},
build: {
rollupOptions: {
external: [],