generated from nhcarrigan/template
feat: Multiple Features, Accessibility, Security, and UX Improvements #59
Assignees
gurkirat
hanna (Hanna Rose)
hikari (Hikari)
minori (Minori)
naomi (Naomi Carrigan)
rain
teklu
tim
Clear assignees
gurkirat
hanna (Hanna Rose)
hikari (Hikari)
minori (Minori)
naomi (Naomi Carrigan)
rain
teklu
tim
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: nhcarrigan/library#59
Reference in New Issue
Block a user
Delete Branch "feat/polish"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
This PR implements a comprehensive set of polish features including:
Issues Closed
Closes #51
Closes #52
Closes #53
Closes #54
Closes #55
Closes #56
Closes #57
Features Implemented
About Page (#51)
Series Support (#54)
seriesandseriesOrderfields to Books and Games/books/series/:nameand/games/series/:nameLeaderboard (#55)
profilePublic: true)Activity Feed (#56)
Time Tracking (#57)
timeSpentfield (stored in minutes) to all media typesEntity Detail Pages
Simplified Card Design
Accessibility Improvements (#53)
Security Improvements
Technical Details
Files Changed
Database Changes
seriesandseriesOrderto Book and Game modelstimeSpentto all media models (Game, Book, Music, Show, Manga)Achievement,UserAchievementmodels (from previous PR)API Changes
/leaderboard,/activity,/achievements/*,/*/series/:nameFrontend Changes
/about,/leaderboard,/activity,/:type/:id(detail pages)Testing Performed
Security Rating
pnpm update)Action Items
Recommended - Update development dependencies:
Credits
All features implemented by Hikari with design direction and approval from Naomi! π
πΈ This pull request represents comprehensive polish work across the entire application! β¨
Changed all activity type assignments to use ActivityType enum members (ActivityType.suggestion, ActivityType.like, etc.) instead of string literals ('SUGGESTION', 'LIKE', etc.) to ensure proper type discrimination in the union type. Frontend: - Import ActivityType as value (not just type) - Update switch cases to use enum members - Expose ActivityType in component for template access Backend: - Import ActivityType as value - Use enum members in all activity mappings This ensures TypeScript can properly discriminate the union type and provides type safety throughout the activity feed.Conducted extensive security audit covering OWASP Top 10 and implemented critical security improvements to protect against common vulnerabilities. Security Improvements: 1. Input Validation & Sanitization - Created comprehensive validation utility module - URL validation prevents javascript:, data:, vbscript:, file: URLs - Slug validation (alphanumeric, hyphens, underscores only) - Rating validation (integer 0-10 only) - String length limits across all services - Maximum lengths: displayName (100), bio (1000), URLs (2048), notes (5000), comments (10000), titles (500), tags (50) 2. Enhanced User Service Security - URL validation for all social media/website links - Slug format validation prevents XSS via slug - Length limits on all user-editable fields - Prevents malicious URLs in profile links 3. Enhanced Comment Service Security - Content length validation (10,000 characters max) - Prevents DoS attacks via massive comments - Maintained existing DOMPurify sanitization 4. Enhanced Book & Game Service Security - Comprehensive validateData() methods - Length limits on all text fields - Rating validation - Cover image URL validation - Tag and link validation 5. Improved Security Headers - Enhanced Content Security Policy (CSP) - Added HSTS with 1-year max-age, includeSubDomains, preload - Added X-Frame-Options: DENY (prevents clickjacking) - Added Referrer-Policy: strict-origin-when-cross-origin - Removed unsafe-inline from production CSP 6. Fixed Logging - Replaced console.error with Fastify structured logger - Prevents sensitive data leaks in console logs 7. Security Documentation - Created comprehensive SECURITY_AUDIT_REPORT.md - Detailed findings and recommendations - OWASP Top 10 coverage analysis Files Created: - api/src/app/utils/validation.ts (validation utilities) - SECURITY_AUDIT_REPORT.md (comprehensive audit report) Files Modified: - api/src/app/services/user.service.ts (URL/slug validation) - api/src/app/services/comment.service.ts (length validation) - api/src/app/services/book.service.ts (comprehensive validation) - api/src/app/services/game.service.ts (comprehensive validation) - api/src/app/plugins/helmet.ts (enhanced security headers) - api/src/app/routes/users/index.ts (fixed logging) Security Rating: 8.5/10 (up from 6.5/10) Critical Action Items: - Update development dependencies (6 high-severity vulnerabilities) - Apply validation pattern to Music, Art, Show, Manga services OWASP Top 10 Coverage: β A01: Broken Access Control - PROTECTED β A02: Cryptographic Failures - PROTECTED β A03: Injection - PROTECTED β A07: Auth Failures - PROTECTED β A08: Software/Data Integrity - PROTECTED β A09: Logging Failures - GOOD β A10: SSRF - PROTECTED β οΈ A06: Vulnerable Components - ACTION NEEDED (dev deps)Polish: Multiple Features, Accessibility, Security, and UX Improvementsto feat: Multiple Features, Accessibility, Security, and UX Improvements