diegosouzapw
32c0f40021
fix: auto-skip onboarding and enforce login on VM deployments
...
- getSettings() auto-sets setupComplete=true when INITIAL_PASSWORD env is set
- proxy.js middleware enforces login when INITIAL_PASSWORD exists (even without DB hash)
- Settings API reports hasPassword=true when INITIAL_PASSWORD is configured
- Login page hides '123456' default hint when a custom password is set
Fixes fresh Docker/VM deployments getting stuck on onboarding wizard
and being accessible without authentication.
2026-02-16 11:24:15 -03:00
diegosouzapw
33c28f73db
refactor(phase5-6): domain persistence, policy engine, OAuth extraction, proxy decoupling
...
Phase 5 — Foundation & Security:
- SQLite domain state persistence (5 tables, 4 modules: fallback, budget, lockout, circuit breaker)
- Write-through cache pattern for state survival across restarts
- Race condition fix in route.js (Promise-based singleton)
- Default password hardening (.env.example)
- Server init error handling improvement
Phase 6 — Architecture Refactoring:
- OAuth providers extracted into 12 individual modules (providers.js 1051→144 lines)
- Policy Engine (lockout→budget→fallback) with evaluateRequest/evaluateFirstAllowed
- Deterministic round-robin via persistent counter Map
- Telemetry window fix with proper recordedAt timestamps
- Proxy decoupled from API settings (direct import vs HTTP self-fetch)
Tests: 295 pass (22 new: domain-persistence 16, policy-engine 6)
Docs: CHANGELOG, README, ARCHITECTURE.md updated
2026-02-15 08:12:12 -03:00
diegosouzapw
e87067f2fb
feat(pipeline): wire 7 backend modules into request pipeline
...
Batch 1 — Pipeline Wiring:
- server-init.js: initialize compliance audit_log, run expired log cleanup, log server.start
- chat.js: wire circuitBreaker (provider resilience), modelAvailability (TTL cooldowns),
requestTelemetry (7-phase lifecycle), requestId, costRules (budget check/record),
compliance audit logging. All wiring is non-breaking with try/catch guards.
- proxy.js: replace bare fetch() with fetchWithTimeout (5s timeout on /api/settings),
add X-Request-Id header for end-to-end tracing
- 307/307 tests pass, build succeeds
2026-02-14 20:06:44 -03:00
diegosouzapw
1cbbc33f20
feat(security): FASE-01 to FASE-06 security hardening
...
FASE-01 — Security Hardening:
- Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast)
- Create secretsValidator.js with enforceSecrets() at startup
- Create inputSanitizer.js (prompt injection + PII detection)
- Integrate sanitizer in chat.js handler pipeline
- Add structured logging to silent catch blocks in proxy.js
- Remove .passthrough() from Zod updateSettingsSchema
- Remove insecure npm fs dependency
- Update .env.example with generation commands
FASE-02 — CI/CD & Tests:
- Create ci.yml workflow (lint, build, test, coverage, e2e)
- Fix test scripts (test now runs actual tests)
- Add test:unit, test:security, test:coverage (c8), test:all
- Add security rules to ESLint (no-eval, no-implied-eval, no-new-func)
FASE-03 — Architecture:
- Create settingsCache.js (eliminate self-fetch anti-pattern)
- Create domain/types.js and domain/responses.js
FASE-04 — Observability:
- Create correlationId.js (AsyncLocalStorage tracing)
- Create circuitBreaker.js (full state machine + registry)
- Create requestTimeout.js (per-provider timeouts)
FASE-05 — Code Quality:
- Create structuredLogger.js (JSON/human-readable logging)
FASE-06 — Documentation:
- Update SECURITY.md with hardening practices
- Create CONTRIBUTING.md with dev setup and PR checklist
Tests: 52/52 pass (23 security + 15 observability + 14 integration)
2026-02-14 18:21:47 -03:00
diegosouzapw
699329944e
feat: initial OmniRoute release (rebranded from 9router)
...
This project is inspired by and originally forked from 9router by decolua
(https://github.com/decolua/9router ).
Full rebrand: 9router → OmniRoute across all source code, configuration,
Docker, documentation, and assets.
2026-02-13 16:29:27 -03:00
