Updating Readme Branch :) - #62
Merged
Merged
Conversation
…ic grafana upstream block)
main.ts:21 sets app.setGlobalPrefix('api', { exclude: ['metrics'] }),
and six controllers also declare api/ in their own path. Nest
concatenates them, so those routes only exist at /api/api/.... nginx
doesn't rewrite (proxy_pass https://backend_upstream; with no trailing
path), so the URL the browser sends is the URL Nest matches.
Solution:
Fixed the path in six files by taking out the 'api/' prefix.
- setup() refuses to run while 2FA is enabled (409): it stored the new secret immediately, locking the user out of their own authenticator even when the QR was never confirmed. - add POST /auth/2fa/disable, requiring a valid current code, so re-enrolling a device is possible without stripping the second factor from a hijacked session. - /auth/me no longer reports a pending token as authenticated, and the events gateway rejects one: reloading the page during the challenge used to grant the app, chat, matchmaking and gameplay with no code. - expose isTwoFactorEnabled on req.user (already-loaded row, no extra query) and drive the profile UI from it instead of local state, which is why the "Secure my account" button kept coming back after a reload.
…y Esteban on Mac)
Fix/2fa unreachable
backend/Dockerfile.dev set no USER, so the dev container ran as root and wrote its build output into the bind-mounted ./backend. dist/ ended up root:root on the host, `rm -rf backend/dist` failed with Permission denied, and make aborted before reaching `docker system prune -af` — leaving certs deleted, dist undeletable and nothing pruned. - Dockerfile.dev now runs as USER node, matching the prod image. The chown -R node:node /app has to precede it: everything above ran as root, and both the runtime `npm install` into the bind mount and the dist/ Nest writes there must work as node. It also makes the anonymous /app/node_modules volume seed node-owned, which is what would otherwise EACCES on startup. - Drop the chown of /etc/nginx/certs: that path doesn't exist at build time and the runtime mount is read-only anyway. - fclean removes dist/ from inside a container, so trees left by images built before this change are still cleanable. Leading '-' so a missing daemon warns instead of skipping the prune.
…-13) Added comprehensive validation and memory bounds to the WebSocket chat architecture to prevent DoS vulnerabilities and unrestricted data growth. Backend: - Created ChatMessageDto with class-validator to enforce a 1-500 character limit and trim whitespace via @Transform. - Applied ValidationPipe to ChatGateway, wrapping validation errors in WsException so they can be serialized and sent to the client. - Implemented in-memory rate limiting (5 messages per 5 seconds) for WS connections, clearing buckets on disconnect to prevent memory leaks. - Capped getGlobalHistory in ChatService to return only the latest 100 messages to prevent unbounded payload sizes. - Emitted 'message_error' events for both rate-limit and validation failures. Frontend (Layout.tsx): - Removed 'authorId' from the emit payload to comply with the backend's strict whitelist validation (forbidNonWhitelisted: true). - Added a soft 500-character maxLength limit to the input, coupled with a visual character counter that appears at 400 characters. - Capped the local React state array for messages to 200 items using slice to prevent unbounded memory growth in long-lived client tabs. - Added a listener for 'message_error' to display backend validation and rate-limiting feedback to the user.
…ts-SELinux Adjust ,Z flag to make volume mounts compatile with SELinux
- add ChatMessageDto with length 1-500 and trim transform - apply ValidationPipe to send_message with WsException factory - per-socket rate limit (5 msg / 5s) with cleanup on disconnect - bound getGlobalHistory to newest 100, oldest-first - maxLength + trim + disabled send on frontend - replace hardcoded '245 online' with real count Closes BUG-13
…nament Nathan/disconnect tournament
The container fallback added in the previous commit ran unconditionally, and the `docker system prune -af` on the next line removes the image it just pulled. Every fclean therefore re-downloaded node:20-alpine to run a single rm, on a tree the host user can now delete itself. - it tries the plain rm first and only fall back to the root container when it fails. Since Dockerfile.dev switched to USER node (uid 1000, same as the host user), backend/dist comes out host-owned and the fallback is dead code in the normal case -- kept only for trees left by older images. - it keeps the leading '-' so a missing daemon still warns rather than aborting before the prune.
Fix/makefclean root owned
…removed GameManager call
Delete tournament.controller.ts entirely — no frontend caller for any route (verified by repo-wide grep); tournament flow runs over WebSocket via EventsGateway/TournamentService. Guarding would have left report-winner reachable by any authenticated user with no room ownership check. Repro now returns 404 on both POSTs. Closes BUG-06
…nament fix: improve game lifecycle and disconnect handling
Remove unused location variable from PartyGame component.
fix : BUG-08 — Any anonymous visitor can read every user's statistics and match history
fix(tournament): remove unauthenticated write endpoints (BUG-06)
The F5 guard read the navigation type at GameRoute mount, but that entry stays "reload" for the document's whole lifetime, so the first click into any game mode after any refresh got bounced home. Decide once at bundle load, against the URL actually reloaded, before BrowserRouter reads it. Also unblock the build: PartyGame had duplicate setIsInGame/joinSentRef declarations from the #56/#57 merge, and the prod compose was missing the SELinux ,z relabel on the cert mounts that dev already had.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.