+ Tracking 100+ repos may cause GitHub API rate limit issues. Consider reducing your selection.
+
+ 0 ? { "margin-left": "-6px" } : {}}
+ class={`avatar${i() > 0 ? " -ml-1.5" : ""}`}
>
![]()
();
+const FALLBACK_BG = "e5e7eb";
+const FALLBACK_FG = "374151";
+
+/**
+ * Registers a label color in the adopted stylesheet and returns
+ * the CSS class name. Hex values are validated before use —
+ * only [0-9a-fA-F]{6} is accepted.
+ */
+export function labelColorClass(hex: string): string {
+ const isValid = /^[0-9a-fA-F]{6}$/.test(hex);
+ const safeHex = isValid ? hex.toLowerCase() : FALLBACK_BG;
+
+ if (!registered.has(safeHex)) {
+ const bg = `#${safeHex}`;
+ const fg = isValid ? labelTextColor(safeHex) : `#${FALLBACK_FG}`;
+ getSheet().insertRule(`.lb-${safeHex} { background-color: ${bg}; color: ${fg}; }`);
+ registered.add(safeHex);
+ }
+ return `lb-${safeHex}`;
+}
+
+/** Reset internal state — exposed for testing only. */
+export function _resetLabelColors(): void {
+ registered.clear();
+ if (_sheet) {
+ while (_sheet.cssRules.length > 0) _sheet.deleteRule(0);
+ }
+}
diff --git a/src/app/pages/OAuthCallback.tsx b/src/app/pages/OAuthCallback.tsx
index 09135405..335207ac 100644
--- a/src/app/pages/OAuthCallback.tsx
+++ b/src/app/pages/OAuthCallback.tsx
@@ -24,10 +24,6 @@ export default function OAuthCallback() {
const storedState = sessionStorage.getItem(OAUTH_STATE_KEY);
sessionStorage.removeItem(OAUTH_STATE_KEY);
- // Read and clear returnTo before CSRF check — always consumed, even on failure
- const returnTo = sessionStorage.getItem(OAUTH_RETURN_TO_KEY);
- sessionStorage.removeItem(OAUTH_RETURN_TO_KEY);
-
// Validate state before anything else (CSRF protection)
if (!stateFromUrl || !storedState || stateFromUrl !== storedState) {
setError("Invalid OAuth state. Please try signing in again.");
@@ -64,6 +60,9 @@ export default function OAuthCallback() {
return;
}
+ // Read and clear returnTo only after successful auth (preserves it for retry on failure)
+ const returnTo = sessionStorage.getItem(OAUTH_RETURN_TO_KEY);
+ sessionStorage.removeItem(OAUTH_RETURN_TO_KEY);
navigate(sanitizeReturnTo(returnTo), { replace: true });
} catch {
setError("A network error occurred. Please try again.");
diff --git a/src/app/services/api.ts b/src/app/services/api.ts
index a0726018..82714ba0 100644
--- a/src/app/services/api.ts
+++ b/src/app/services/api.ts
@@ -205,7 +205,7 @@ function extractSearchPartialData(err: unknown): T | null {
return null;
}
-const VALID_REPO_NAME = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const VALID_REPO_NAME = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
// Allows alphanumeric/hyphen base (1-39 chars) with optional literal [bot] suffix for GitHub
// App bot accounts. Case-sensitive [bot] is intentional — GitHub always uses lowercase.
const VALID_TRACKED_LOGIN = /^[A-Za-z0-9-]{1,39}(\[bot\])?$/;
@@ -1882,6 +1882,7 @@ export async function fetchRepos(
if (!octokit) throw new Error("No GitHub client available");
const repos: RepoEntry[] = [];
+ const REPO_CAP = 1000;
if (type === "org") {
for await (const response of octokit.paginate.iterator(`GET /orgs/{org}/repos`, {
@@ -1893,6 +1894,7 @@ export async function fetchRepos(
for (const repo of response.data as RawRepo[]) {
repos.push({ owner: repo.owner.login, name: repo.name, fullName: repo.full_name, pushedAt: repo.pushed_at ?? null });
}
+ if (repos.length >= REPO_CAP) break;
}
} else {
for await (const response of octokit.paginate.iterator(`GET /user/repos`, {
@@ -1904,9 +1906,18 @@ export async function fetchRepos(
for (const repo of response.data as RawRepo[]) {
repos.push({ owner: repo.owner.login, name: repo.name, fullName: repo.full_name, pushedAt: repo.pushed_at ?? null });
}
+ if (repos.length >= REPO_CAP) break;
}
}
+ if (repos.length >= REPO_CAP) {
+ pushNotification(
+ "api",
+ `${orgOrUser} has 1000+ repos — showing the most recently active`,
+ "warning",
+ );
+ }
+
return repos;
}
@@ -2264,7 +2275,14 @@ export async function discoverUpstreamRepos(
}
if (logins.length === 0) return [];
- await Promise.allSettled(logins.map((login) => discoverForUser(login)));
+ // Process users sequentially so the repoNames.size cap check is atomic
+ // across iterations (prevents TOCTOU race from parallel writes to the shared Set).
+ // Issues + PRs searches for each user still run in parallel — they write to
+ // the same Set within a single iteration, which is safe.
+ for (const login of logins) {
+ if (repoNames.size >= CAP) break;
+ await discoverForUser(login);
+ }
if (errors.length > 0) {
pushNotification(
diff --git a/src/app/services/poll.ts b/src/app/services/poll.ts
index 02ff9d42..79926454 100644
--- a/src/app/services/poll.ts
+++ b/src/app/services/poll.ts
@@ -267,11 +267,13 @@ export async function fetchAllData(
];
for (const [result, label] of settled) {
if (result.status === "rejected") {
- const reason = result.reason;
- const statusCode = typeof reason === "object" && reason !== null && typeof (reason as Record).status === "number"
- ? (reason as Record).status as number
+ const err = result.reason;
+ // Propagate 401 to outer handler for re-auth (don't absorb as generic error)
+ if (err?.status === 401 || err?.response?.status === 401) throw err;
+ const statusCode = typeof err === "object" && err !== null && typeof (err as Record).status === "number"
+ ? (err as Record).status as number
: null;
- const message = reason instanceof Error ? reason.message : String(reason);
+ const message = err instanceof Error ? err.message : String(err);
topLevelErrors.push({ repo: label, statusCode, message, retryable: statusCode === null || (statusCode !== null && statusCode >= 500) });
}
}
diff --git a/src/app/stores/auth.ts b/src/app/stores/auth.ts
index 98b1be7d..ba3faf07 100644
--- a/src/app/stores/auth.ts
+++ b/src/app/stores/auth.ts
@@ -105,9 +105,10 @@ export function clearAuth(): void {
* navigation handles teardown. Use clearAuth() if not navigating. */
export function expireToken(): void {
localStorage.removeItem(AUTH_STORAGE_KEY);
+ localStorage.removeItem(DASHBOARD_STORAGE_KEY);
_setToken(null);
setUser(null);
- console.info("[auth] token expired (user data preserved)");
+ console.info("[auth] token expired (dashboard cache cleared)");
}
const VALIDATE_HEADERS = {
@@ -174,3 +175,16 @@ export async function validateToken(): Promise {
return false;
}
}
+
+// Cross-tab auth sync: if another tab clears the token, this tab should also clear.
+// Uses expireToken() (not clearAuth()) to avoid wiping config/view that may still be valid.
+if (typeof window !== "undefined") {
+ window.addEventListener("storage", (e: StorageEvent) => {
+ if (e.key === AUTH_STORAGE_KEY && e.newValue === null && _token()) {
+ // Re-check: a rapid sign-out/sign-in may have already replaced the token
+ if (localStorage.getItem(AUTH_STORAGE_KEY) !== null) return;
+ expireToken();
+ window.location.replace("/login");
+ }
+ });
+}
diff --git a/src/app/stores/cache.ts b/src/app/stores/cache.ts
index d1b46495..c2ced352 100644
--- a/src/app/stores/cache.ts
+++ b/src/app/stores/cache.ts
@@ -65,8 +65,12 @@ export async function setCacheEntry(
) {
// Emergency eviction: delete oldest 50% of entries, then retry once
await evictOldestPercent(50);
- const db = await getDb();
- await db.put("cache", entry);
+ try {
+ const db = await getDb();
+ await db.put("cache", entry);
+ } catch {
+ console.warn("[cache] Still over quota after emergency eviction — entry dropped");
+ }
} else {
throw err;
}
diff --git a/src/app/stores/view.ts b/src/app/stores/view.ts
index cad1a4de..92fd6694 100644
--- a/src/app/stores/view.ts
+++ b/src/app/stores/view.ts
@@ -4,6 +4,7 @@ import { createEffect, onCleanup, untrack } from "solid-js";
import { pushNotification } from "../lib/errors";
export const VIEW_STORAGE_KEY = "github-tracker:view";
+const IGNORED_ITEMS_CAP = 500;
const IssueFiltersSchema = z.object({
role: z.enum(["all", "author", "assignee"]).default("all"),
@@ -55,6 +56,7 @@ export const ViewStateSchema = z.object({
ignoredAt: z.number(),
})
)
+ .max(IGNORED_ITEMS_CAP)
.default([]),
globalFilter: z
.object({
@@ -146,6 +148,10 @@ export function ignoreItem(item: IgnoredItem): void {
produce((draft) => {
const already = draft.ignoredItems.some((i) => i.id === item.id);
if (!already) {
+ // FIFO eviction: remove oldest if at cap
+ if (draft.ignoredItems.length >= IGNORED_ITEMS_CAP) {
+ draft.ignoredItems.shift();
+ }
draft.ignoredItems.push(item);
}
})
@@ -160,6 +166,17 @@ export function unignoreItem(id: string): void {
);
}
+export function pruneStaleIgnoredItems(): void {
+ const thirtyDaysAgo = Date.now() - 30 * 24 * 60 * 60 * 1000;
+ setViewState(
+ produce((draft) => {
+ draft.ignoredItems = draft.ignoredItems.filter(
+ (i) => i.ignoredAt > thirtyDaysAgo
+ );
+ })
+ );
+}
+
export function setSortPreference(
tabId: string,
field: string,
diff --git a/src/worker/index.ts b/src/worker/index.ts
index 2eed9bae..105fff0a 100644
--- a/src/worker/index.ts
+++ b/src/worker/index.ts
@@ -3,7 +3,8 @@ export interface Env {
GITHUB_CLIENT_ID: string;
GITHUB_CLIENT_SECRET: string;
ALLOWED_ORIGIN: string;
- SENTRY_DSN: string; // e.g. "https://key@o123456.ingest.sentry.io/7890123"
+ SENTRY_DSN?: string; // e.g. "https://key@o123456.ingest.sentry.io/7890123"
+ SENTRY_SECURITY_TOKEN?: string; // Optional: Sentry security token for Allowed Domains validation
}
// Predefined error strings only (SDR-006)
@@ -53,11 +54,44 @@ function errorResponse(
}
const SECURITY_HEADERS: Record = {
+ "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
"X-Content-Type-Options": "nosniff",
"Referrer-Policy": "strict-origin-when-cross-origin",
"X-Frame-Options": "DENY",
};
+// Simple in-memory rate limiter for token exchange endpoint.
+// Not durable across isolate restarts, but catches burst abuse.
+// Note: CF-Connecting-IP is set by Cloudflare's proxy layer; if the workers.dev
+// route is enabled, an attacker could spoof this header. Disable the workers.dev
+// route in the Cloudflare dashboard for production use.
+const TOKEN_RATE_LIMIT = 10; // max requests per window
+const TOKEN_RATE_WINDOW_MS = 60_000; // 1 minute
+const _tokenRateMap = new Map();
+
+function checkTokenRateLimit(ip: string): boolean {
+ const now = Date.now();
+ const entry = _tokenRateMap.get(ip);
+ if (!entry || now >= entry.resetAt) {
+ _tokenRateMap.set(ip, { count: 1, resetAt: now + TOKEN_RATE_WINDOW_MS });
+ return true;
+ }
+ entry.count++;
+ if (entry.count > TOKEN_RATE_LIMIT) return false;
+ return true;
+}
+
+// Periodic cleanup to prevent unbounded map growth.
+// Only runs when the map exceeds a threshold to avoid O(N) scan on every request.
+const PRUNE_THRESHOLD = 100;
+function pruneTokenRateMap(): void {
+ if (_tokenRateMap.size < PRUNE_THRESHOLD) return;
+ const now = Date.now();
+ for (const [ip, entry] of _tokenRateMap) {
+ if (now >= entry.resetAt) _tokenRateMap.delete(ip);
+ }
+}
+
// CORS: strict equality only (SDR-004)
function getCorsHeaders(
requestOrigin: string | null,
@@ -82,6 +116,10 @@ const SENTRY_ENVELOPE_MAX_BYTES = 256 * 1024; // 256 KB — Sentry rejects >200K
interface ParsedDsn { host: string; projectId: string; publicKey: string }
+// Module-level cache is safe here: value derived entirely from env.SENTRY_DSN
+// (a deployment constant, never user input). Shared across requests in the same
+// Worker isolate, which is intentional for performance. Do NOT follow this pattern
+// for request-scoped or user-controlled data.
let _dsnCache: { dsn: string; parsed: ParsedDsn | null } | undefined;
/** Parse host, project ID, and public key from a Sentry DSN URL. Returns null if invalid. */
@@ -99,8 +137,9 @@ function parseSentryDsn(dsn: string): ParsedDsn | null {
/** Get cached parsed DSN, re-parsing only when the DSN string changes. */
function getOrCacheDsn(env: Env): ParsedDsn | null {
- if (!_dsnCache || _dsnCache.dsn !== env.SENTRY_DSN) {
- _dsnCache = { dsn: env.SENTRY_DSN, parsed: parseSentryDsn(env.SENTRY_DSN) };
+ const dsn = env.SENTRY_DSN ?? "";
+ if (!_dsnCache || _dsnCache.dsn !== dsn) {
+ _dsnCache = { dsn, parsed: parseSentryDsn(dsn) };
}
return _dsnCache.parsed;
}
@@ -171,9 +210,15 @@ async function handleSentryTunnel(
// Forward to Sentry ingest endpoint
const sentryUrl = `https://${allowedDsn.host}/api/${allowedDsn.projectId}/envelope/`;
try {
+ const sentryHeaders: Record = {
+ "Content-Type": "application/x-sentry-envelope",
+ };
+ if (env.SENTRY_SECURITY_TOKEN) {
+ sentryHeaders["X-Sentry-Token"] = env.SENTRY_SECURITY_TOKEN;
+ }
const sentryResp = await fetch(sentryUrl, {
method: "POST",
- headers: { "Content-Type": "application/x-sentry-envelope" },
+ headers: sentryHeaders,
body,
});
@@ -279,7 +324,10 @@ async function handleCspReport(request: Request, env: Env): Promise {
scrubbedPayloads.map((payload) =>
fetch(sentryUrl, {
method: "POST",
- headers: { "Content-Type": "application/csp-report" },
+ headers: {
+ "Content-Type": "application/csp-report",
+ ...(env.SENTRY_SECURITY_TOKEN ? { "X-Sentry-Token": env.SENTRY_SECURITY_TOKEN } : {}),
+ },
body: JSON.stringify(payload),
}).catch(() => null)
)
@@ -308,6 +356,20 @@ async function handleTokenExchange(
return errorResponse("method_not_allowed", 405, cors);
}
+ pruneTokenRateMap();
+ const ip = request.headers.get("CF-Connecting-IP") ?? "unknown";
+ if (!checkTokenRateLimit(ip)) {
+ log("warn", "token_exchange_rate_limited", {}, request);
+ return new Response(JSON.stringify({ error: "rate_limited" }), {
+ status: 429,
+ headers: {
+ "Content-Type": "application/json",
+ ...cors,
+ ...SECURITY_HEADERS,
+ },
+ });
+ }
+
log("info", "token_exchange_started", {}, request);
const contentType = request.headers.get("Content-Type") ?? "";
diff --git a/tests/components/OAuthCallback.test.tsx b/tests/components/OAuthCallback.test.tsx
index b6223d6c..56854fb5 100644
--- a/tests/components/OAuthCallback.test.tsx
+++ b/tests/components/OAuthCallback.test.tsx
@@ -314,7 +314,7 @@ describe("OAuthCallback", () => {
expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBeNull();
});
- it("OAUTH_RETURN_TO_KEY is removed from sessionStorage after reading", async () => {
+ it("OAUTH_RETURN_TO_KEY is preserved while token exchange is in flight", async () => {
sessionStorage.setItem(OAUTH_RETURN_TO_KEY, "/settings");
setupValidState();
setWindowSearch({ code: "fakecode", state: "teststate" });
@@ -322,12 +322,12 @@ describe("OAuthCallback", () => {
renderCallback();
- await waitFor(() => {
- expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBeNull();
- });
+ // returnTo is not consumed until auth completes — preserved for retry on failure
+ await new Promise((r) => setTimeout(r, 50));
+ expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBe("/settings");
});
- it("OAUTH_RETURN_TO_KEY is cleared even when CSRF check fails (stale key protection)", async () => {
+ it("OAUTH_RETURN_TO_KEY is preserved when CSRF check fails (only consumed on success)", async () => {
sessionStorage.setItem(OAUTH_RETURN_TO_KEY, "/settings");
sessionStorage.setItem(OAUTH_STATE_KEY, "expected-state");
setWindowSearch({ code: "fakecode", state: "wrong-state" });
@@ -337,7 +337,49 @@ describe("OAuthCallback", () => {
await waitFor(() => {
screen.getByText(/Invalid OAuth state/i);
});
- expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBeNull();
+ // returnTo is preserved for the user's next legitimate auth attempt
+ expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBe("/settings");
+ });
+
+ it("OAUTH_RETURN_TO_KEY is preserved when validateToken returns false", async () => {
+ sessionStorage.setItem(OAUTH_RETURN_TO_KEY, "/settings");
+ setupValidState();
+ setWindowSearch({ code: "fakecode", state: "teststate" });
+ vi.stubGlobal(
+ "fetch",
+ vi.fn().mockResolvedValue({
+ ok: true,
+ json: async () => ({ access_token: "tok123" }),
+ })
+ );
+ vi.mocked(authStore.validateToken).mockResolvedValue(false);
+
+ renderCallback();
+
+ await waitFor(() => {
+ screen.getByText(/Could not verify token/i);
+ });
+ expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBe("/settings");
+ });
+
+ it("OAUTH_RETURN_TO_KEY is preserved when token exchange fails", async () => {
+ sessionStorage.setItem(OAUTH_RETURN_TO_KEY, "/settings");
+ setupValidState();
+ setWindowSearch({ code: "fakecode", state: "teststate" });
+ vi.stubGlobal(
+ "fetch",
+ vi.fn().mockResolvedValue({
+ ok: false,
+ json: async () => ({ error: "bad_verification_code" }),
+ })
+ );
+
+ renderCallback();
+
+ await waitFor(() => {
+ screen.getByText(/Failed to complete sign in/i);
+ });
+ expect(sessionStorage.getItem(OAUTH_RETURN_TO_KEY)).toBe("/settings");
});
it("navigates to / when OAUTH_RETURN_TO_KEY is not set", async () => {
diff --git a/tests/components/shared/UserAvatarBadge.test.tsx b/tests/components/shared/UserAvatarBadge.test.tsx
index 49f408ff..4e7239fb 100644
--- a/tests/components/shared/UserAvatarBadge.test.tsx
+++ b/tests/components/shared/UserAvatarBadge.test.tsx
@@ -95,7 +95,7 @@ describe("UserAvatarBadge", () => {
// Second avatar wrapper should have a negative margin-left style
const avatarWrappers = container.querySelectorAll(".avatar");
expect(avatarWrappers.length).toBe(2);
- // First has no negative margin; second does
- expect((avatarWrappers[1] as HTMLElement).style.marginLeft).toBe("-6px");
+ // First has no negative margin class; second does
+ expect(avatarWrappers[1].classList.contains("-ml-1.5")).toBe(true);
});
});
diff --git a/tests/lib/label-colors.test.ts b/tests/lib/label-colors.test.ts
new file mode 100644
index 00000000..666ef49f
--- /dev/null
+++ b/tests/lib/label-colors.test.ts
@@ -0,0 +1,51 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { labelColorClass, _resetLabelColors } from "../../src/app/lib/label-colors";
+
+describe("labelColorClass", () => {
+ beforeEach(() => {
+ _resetLabelColors();
+ });
+
+ it("returns lb- class for valid 6-char hex", () => {
+ expect(labelColorClass("abc123")).toBe("lb-abc123");
+ });
+
+ it("lowercases hex for consistent class names", () => {
+ expect(labelColorClass("ABC123")).toBe("lb-abc123");
+ });
+
+ it("returns fallback class for invalid hex", () => {
+ expect(labelColorClass("gggggg")).toBe("lb-e5e7eb");
+ expect(labelColorClass("")).toBe("lb-e5e7eb");
+ expect(labelColorClass("abc")).toBe("lb-e5e7eb");
+ expect(labelColorClass("abc1234")).toBe("lb-e5e7eb");
+ });
+
+ it("returns fallback class for injection attempts", () => {
+ expect(labelColorClass("abc123; color: red")).toBe("lb-e5e7eb");
+ expect(labelColorClass("