mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 22:25:41 +00:00
pezkuwichain
27b4057bd4
Audit remediation (build/supply-chain/quality):
- Add `@pezkuwi/api-augment` import in main.tsx -> tsc errors 416->328 (Codec-typed
on-chain reads now augmented); add `typecheck` script + a non-blocking Typecheck CI
step (flip to blocking once errors reach 0).
- CI: `npm install` -> `npm ci` (lockfile enforced) in web + security-audit jobs; add a
Backend Indexer job (npm ci + node --check + non-blocking high/critical audit). No
live tests run in CI (they need a live chain) — a mockable CI test subset is a
follow-up.
- Vulns: bump dompurify ^3.4.12 + postcss ^8.5.23 (web prod highs cleared; only the
react-router v7 open-redirect remains, deferred as a breaking major); backend tar
^7.5.22 + ws ^8.21.1 (clears the critical tar advisory). Lockfiles regenerated.
- Prod build now drops console/debugger (vite esbuild.drop); NotificationBell realtime
subscription now returns cleanup + uses a per-user channel (fixes leak); ProfileSettings
language codes aligned to i18n config (ku-kurmanji/ku-sorani).
- Root package.json sdk-ui path env-driven (${SDK_UI_DIR}); generate-docs rustup path
resolved dynamically; Docker image license label MIT (matches LICENSE). Removed scratch
files (mimari.txt, _scratch_credit_serok.mjs).
95 lines
3.9 KiB
TypeScript
95 lines
3.9 KiB
TypeScript
/// <reference types="vitest" />
|
||
import { defineConfig } from "vitest/config";
|
||
import react from "@vitejs/plugin-react-swc";
|
||
import path from "path";
|
||
import { nodePolyfills } from 'vite-plugin-node-polyfills';
|
||
import subresourceIntegrity from 'vite-plugin-subresource-integrity';
|
||
|
||
// https://vitejs.dev/config/
|
||
export default defineConfig(({ command }) => ({
|
||
test: {
|
||
globals: true,
|
||
environment: 'jsdom',
|
||
setupFiles: './src/tests/setup.ts',
|
||
alias: {
|
||
'vite-plugin-node-polyfills/shims/buffer': path.resolve(__dirname, './src/tests/mocks/buffer-shim.ts'),
|
||
'vite-plugin-node-polyfills/shims/global': path.resolve(__dirname, './src/tests/mocks/global-shim.ts'),
|
||
'vite-plugin-node-polyfills/shims/process': path.resolve(__dirname, './src/tests/mocks/process-shim.ts'),
|
||
},
|
||
},
|
||
server: {
|
||
host: "::",
|
||
port: 8082,
|
||
strictPort: false, // Allow automatic port selection if 8082 is busy
|
||
hmr: {
|
||
protocol: 'ws',
|
||
host: 'localhost',
|
||
},
|
||
watch: {
|
||
usePolling: true,
|
||
},
|
||
},
|
||
plugins: [
|
||
react(),
|
||
nodePolyfills({
|
||
globals: {
|
||
Buffer: true,
|
||
global: true,
|
||
process: true,
|
||
},
|
||
protocolImports: true,
|
||
}),
|
||
// SRI: production build sırasında <script>/<link> tag'lerine
|
||
// sha384 integrity hash ekle. CDN/proxy compromise olsa bile
|
||
// tampered asset browser tarafından load edilmez.
|
||
command === 'build' ? subresourceIntegrity({ algorithm: 'sha384' }) : null,
|
||
].filter(Boolean),
|
||
resolve: {
|
||
mainFields: ['browser', 'module', 'main', 'exports'],
|
||
alias: {
|
||
// Rollup cannot resolve virtual shim modules in production — alias to real file.
|
||
// Dev mode: the plugin's own virtual module handles it; do NOT override it here.
|
||
...(command === 'build' ? {
|
||
'vite-plugin-node-polyfills/shims/process': path.resolve(__dirname, './src/lib/process-shim.ts'),
|
||
} : {}),
|
||
"@": path.resolve(__dirname, "./src"),
|
||
"@pezkuwi/i18n": path.resolve(__dirname, "../shared/i18n"),
|
||
"@pezkuwi/lib": path.resolve(__dirname, "../shared/lib"),
|
||
"@pezkuwi/utils": path.resolve(__dirname, "../shared/utils"),
|
||
"@pezkuwi/theme": path.resolve(__dirname, "../shared/theme"),
|
||
"@local/types": path.resolve(__dirname, "../shared/types"),
|
||
"@pezkuwi/components": path.resolve(__dirname, "../shared/components"),
|
||
"@shared": path.resolve(__dirname, "../shared"),
|
||
},
|
||
dedupe: ['react', 'lucide-react', 'sonner', '@pezkuwi/util-crypto', '@pezkuwi/util', '@pezkuwi/api', '@pezkuwi/extension-dapp', '@pezkuwi/keyring'],
|
||
},
|
||
optimizeDeps: {
|
||
include: ['@pezkuwi/util-crypto', '@pezkuwi/util', '@pezkuwi/api', '@pezkuwi/extension-dapp', '@pezkuwi/keyring', 'buffer'],
|
||
},
|
||
// Strip all console.* and debugger statements from production bundles so the
|
||
// 600+ dev-time console calls never ship. Dev keeps full logging.
|
||
esbuild: command === 'build' ? { drop: ['console', 'debugger'] } : {},
|
||
build: {
|
||
rollupOptions: {
|
||
external: [],
|
||
onwarn(warning, warn) {
|
||
// Suppress the buffer shim warning - it's handled by vite-plugin-node-polyfills
|
||
if (warning.message?.includes('vite-plugin-node-polyfills/shims/buffer')) {
|
||
return;
|
||
}
|
||
warn(warning);
|
||
},
|
||
output: {
|
||
manualChunks: {
|
||
'pezkuwi': ['@pezkuwi/api', '@pezkuwi/extension-dapp', '@pezkuwi/keyring', '@pezkuwi/util', '@pezkuwi/util-crypto'],
|
||
'vendor': ['react', 'react-dom', 'react-router-dom'],
|
||
'ui': ['@radix-ui/react-dialog', '@radix-ui/react-dropdown-menu', '@radix-ui/react-select', '@radix-ui/react-tabs', '@radix-ui/react-toast'],
|
||
'forms': ['react-hook-form', '@hookform/resolvers', 'zod'],
|
||
'i18n': ['i18next', 'react-i18next', 'i18next-browser-languagedetector']
|
||
}
|
||
}
|
||
},
|
||
chunkSizeWarningLimit: 600
|
||
},
|
||
// assetsInclude: ['**/*.json'], // Disabled: interferes with node_modules JSON imports (crypto-browserify)
|
||
})); |