dmg/minecraft-account-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 34 Wiki Activity

feat(admin): browse Discord suggestions in the portal
CI / validate (push) Successful in 7m26s
Details
Release / release (push) Successful in 9m43s
Details

Browse Source
This commit is contained in:
dmg
2026-09-10 08:21:08 -04:00
parent 0af4884f7e
commit 2402e9e42d
15 changed files with 441 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security-review.md
+5 -4
View File
@@ -1,6 +1,6 @@
# Security review
Review timestamp: 2026-09-10T12:00:10Z
Review timestamp: 2026-09-10T12:20:32Z
## Scope
@@ -8,11 +8,12 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
## Automated checks
- Full source Semgrep `auto`: 0 findings across 169 scanned files (331 rules; 13 files excluded by ignore patterns).
- Full source Semgrep `auto`: 0 findings across 178 scanned files (331 rules; 13 files excluded by ignore patterns).
- `npm audit` and `npm audit --omit=dev`: 0 known vulnerabilities after remediation. Baseline had six affected entries (two moderate, two high, two critical), covering Next.js/Sharp, the NextAuth dependency path, Vitest/mocker, and js-yaml.
- Resolved patched versions: Next.js and eslint-config-next 16.3.4, Sharp 0.35.4, Vitest/mocker 4.1.11, js-yaml 4.3.2. Retained Next.js's PostCSS override at 8.5.25. No forced major dependency upgrades or database changes.
- TypeScript, 181 workspace tests, Next.js production build, and Velocity Java tests/shaded plugin build pass with patched dependencies. ESLint exits successfully with two new framework-rule warnings about existing `window.location.assign()` calls in `map-view-toggle.tsx`; those unrelated navigation behaviors were not changed.
- Verification is local source evidence, not a claim that patched artifacts have been deployed. API CI run 1979 passed for the preceding API source `1a01c0ed641f4eda83f81c855c38651aa116933e`.
- TypeScript, 196 workspace tests, Next.js production build, and Velocity Java tests/shaded plugin build pass with patched dependencies. ESLint exits successfully with two new framework-rule warnings about existing `window.location.assign()` calls in `map-view-toggle.tsx`; those unrelated navigation behaviors were not changed.
- Verification is local source evidence, not a claim that patched artifacts have been deployed. API CI run 1979 passed for `1a01c0ed641f4eda83f81c855c38651aa116933e`; dependency-fix CI run 1985 passed for `0af4884f7e16161d0c0ea3a8f9c26b3fa9384cf9`.
- Suggestions UI tests verify both page guards, malformed-ID rejection, literal text rendering (including script-like content), read-only API usage, explicit auth/error states, aborted obsolete reads, and pagination focus. Actual Discord permissions/Message Content access and production browser acceptance remain rollout checks.
## Implemented controls