Repository navigation
feat(security): step 6 — headers, proxy matching, server-only, prerender check + build in CI - #53
Merged
Merged
Conversation
- next.config: COOP/CORP same-origin, poweredByHeader off, images.unoptimized (no next/image in use), logging.serverFunctions off so `next dev` stops printing server-action arguments. - proxy: /api/auth public check matches the segment, not the prefix; matcher exclusions anchored so look-alike paths stay gated. - CSP: MP origins accepted only over https (loopback http in dev), base-uri 'none', opt-in CSP_REPORT_URI emitting report-uri/report-to plus Reporting-Endpoints. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- `server-only` on every service, auth, env, tool-params.server and the MP client/credentials modules; a client import now fails `next build` (verified by planting one). Vitest aliases it to the no-op entry; the codegen CLIs run tsx with --conditions=react-server. - scripts/check-prerender.mjs fails when any route besides Next's built-in /_not-found and /_global-error is statically prerendered (no CSP nonce). - CI `test` job now runs `npm run build` (placeholder env) and the prerender check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… close TODOs - security reference: new headers, proxy path matching, CSP source validation, CSP_REPORT_URI, customer-clone notes, prerender check, and the enforced-CSP walk result. - GOTCHA-046 (server-only) and GOTCHA-047 (prerender check). - CLAUDE.md: CI now builds; server-only practice; codegen --conditions flag. - Delete the step6 and held-CSP TODOs; index at 0 open. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last two open TODOs: step 6 of the 2026-09-30 playbook audit and the held CSP notes for customer clones.
Headers and proxy
next.config.ts: COOP/CORPsame-origin,poweredByHeader: false,images.unoptimized(nothing usesnext/image, so the optimizer was only SSRF surface),logging.serverFunctions: false(stopsnext devprinting server-action arguments such as household records).proxy.ts:/api/authis public only as a whole path segment (/api/authznow gets the session check). Matcher exclusions are anchored, so look-alike paths like/favicon.ico-adminare still gated.data:,javascript:, plain-http and credentialed URLs are dropped.base-uri 'none'.CSP_REPORT_URI: addsreport-uri+report-toand aReporting-Endpointsheader. Unset means no reporting, and the repo ships no collector.Build guards
import 'server-only'in every service,auth.ts,env.ts,tool-params.server.tsand the MP client/credentials modules. Tested by importingdomainTimezoneServicefrom a client component, which madenext buildfail with theserver-onlytrace.server-onlyto its no-op entry. Themp:generate*scripts now runtsx --conditions=react-server.scripts/check-prerender.mjs(npm run check:prerender) fails when any route other than/_not-foundor/_global-erroris statically prerendered. Tested with a planted static page.testjob: new Build step (placeholder env, no MP call) and Check prerendered routes step.Verification
lint,typecheckandtest:coveragepass: 2191 tests, 99.13% statements..env.localpasses.<style>applied), contact search and household load. Zero CSP violations. Headers checked with curl on the real server.UserMenuisn't mounted anywhere, so a production build has no sign-out control. This was already the case before this PR.Docs
Security reference (headers, matching, reporting, customer-clone roll-out), GOTCHA-046/047, CLAUDE.md (CI builds now, server-only practice). Both TODOs deleted; the index shows 0 open.
🤖 Generated with Claude Code