Antigravity
|
f7da22d409
|
feat(score): rate limiting + focus trap + skip-link + touch targets + cache
CI / Lint, Unit Tests & Build (push) Failing after 4m44s
CI / Deploy production (on server) (push) Has been skipped
SÉCURITÉ 8→9:
- lib/rate-limit.ts: Redis rate limiter (incr + expire)
- chat/route: 15 req/min max
- 6 routes IA: 20 req/min max (tags, title, labels, markdown, overview, summary)
- link-preview: cache Redis 5min par URL+userId
- auth-providers: rate limit login 5 req/5min
UX 7.5→8.5:
- search-modal: focus trap (Tab cycle + Shift+Tab)
- search-modal: ref modal pour querySelector focusable
- layout: skip-link 'Skip to content' (sr-only focus:not-sr-only)
- note-actions: boutons h-8 w-8 → h-9 w-9 (36px → touch target)
0 erreur TS, 199/199 tests
|
2026-07-05 18:31:06 +00:00 |
|
Antigravity
|
718f4c6900
|
perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)
Deploy to Production / Build and Deploy (push) Successful in 1m35s
MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect
memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo
Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)
Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation
|
2026-05-03 18:41:38 +00:00 |
|