diegosouzapw
14714aa9f5
feat: refactor dashboard with shared UI component library
...
Introduce reusable shared components (Button, Card, Modal, Table,
StatusBadge, EmptyState) and refactor dashboard pages to use them.
Extract client components from server pages, centralize provider
constants, and update CI Node.js matrix from 18 to 20.
2026-02-15 16:11:56 -03:00
diegosouzapw
0e238a61fb
feat(core): implement 26 action items from critical analysis + bump v0.4.0
...
- Security: AES-256-GCM encryption for API keys/tokens, CI security audit
- Accessibility: ARIA labels, aria-live regions, skip-to-content, contrast utility
- Components: Tooltip, CloudSyncStatus, SystemMonitor, StreamTracker
- Utils: costEstimator, promptInjectionGuard middleware, Zod validation schemas
- Docs: openapi.yaml +9 routes, API_REFERENCE internal APIs, version bumps
- Quality: coverage thresholds 60/50/50, error handling improvements
2026-02-15 12:33:56 -03:00
diegosouzapw
597c590a1d
feat(phase10): docs restructuring, component decomposition, and cleanup
...
- Split README (1326→211 lines): USER_GUIDE, API_REFERENCE, TROUBLESHOOTING
- Expand CONTRIBUTING.md (112→273 lines)
- Extract RequestLoggerDetail from RequestLoggerV2 (910→665 lines)
- Extract ProxyLogDetail from ProxyLogger (677→519 lines)
- Add accessibility attrs (aria-label, role=dialog) to extracted modals
- Migrate not-found.js inline styles to TailwindCSS gradient classes
- Remove continue-on-error from E2E CI step
- Add PolicyEngine class with glob-based policy matching
- Create a11yAudit.js (WCAG rule checker)
- Fix policyEngine test import path
2026-02-15 11:53:40 -03:00
diegosouzapw
1cbbc33f20
feat(security): FASE-01 to FASE-06 security hardening
...
FASE-01 — Security Hardening:
- Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast)
- Create secretsValidator.js with enforceSecrets() at startup
- Create inputSanitizer.js (prompt injection + PII detection)
- Integrate sanitizer in chat.js handler pipeline
- Add structured logging to silent catch blocks in proxy.js
- Remove .passthrough() from Zod updateSettingsSchema
- Remove insecure npm fs dependency
- Update .env.example with generation commands
FASE-02 — CI/CD & Tests:
- Create ci.yml workflow (lint, build, test, coverage, e2e)
- Fix test scripts (test now runs actual tests)
- Add test:unit, test:security, test:coverage (c8), test:all
- Add security rules to ESLint (no-eval, no-implied-eval, no-new-func)
FASE-03 — Architecture:
- Create settingsCache.js (eliminate self-fetch anti-pattern)
- Create domain/types.js and domain/responses.js
FASE-04 — Observability:
- Create correlationId.js (AsyncLocalStorage tracing)
- Create circuitBreaker.js (full state machine + registry)
- Create requestTimeout.js (per-provider timeouts)
FASE-05 — Code Quality:
- Create structuredLogger.js (JSON/human-readable logging)
FASE-06 — Documentation:
- Update SECURITY.md with hardening practices
- Create CONTRIBUTING.md with dev setup and PR checklist
Tests: 52/52 pass (23 security + 15 observability + 14 integration)
2026-02-14 18:21:47 -03:00
