10b5f655d5
HTTP (`http::*`):
- `HttpService` trait (picloud-shared) + reqwest-backed `HttpServiceImpl`
(manager-core), wired into the `Services` bundle.
- SSRF deny-list applied to the resolved IP via a custom reqwest
`dns_resolver` (covers every redirect hop + defeats DNS rebinding) plus
a literal-IP check at URL-parse time. Scheme/port restrictions, request
+ response body caps (stream-with-cap), layered timeout. Error reason is
a CIDR category, never the IP. `PICLOUD_HTTP_ALLOW_PRIVATE` dev override
(logs a startup warning).
- Rhai bridge with three-arg split `verb(url, body, opts)` (resolves the
brief's body-vs-opts contradiction; unknown opt keys throw). Body
dispatch by type; response `#{status,headers,body,body_raw}` with JSON
auto-parse; non-2xx does not throw.
- `Capability::AppHttpRequest` → existing `script:write` scope (no new
Scope variant). `SdkCallCx` gains `script_id` (attribution + User-Agent).
Cron triggers (4th trigger kind):
- Migration 0017 widens the kind/source_kind CHECKs and adds
`cron_trigger_details`. `cron`/`chrono-tz` parse + validate 6-field
schedules and IANA timezones.
- `spawn_cron_scheduler` polls due triggers and enqueues to the universal
outbox; the dispatcher delivers them (one-line match-arm extension).
Catch-up fires exactly once per trigger per tick, not once per missed
window. `ctx.event.cron` for handlers.
- `POST /api/v1/admin/apps/{id}/triggers/cron` reuses the v1.1.3
cross-app + kind!=module target check.
- Dashboard: admin-gated Triggers tab (cron create form + list).
Follow-ups: redact module backend errors at the resolver boundary (log
original at error level); pin `rhai = "=1.24"`; CHANGELOG incl. retroactive
v1.1.3 cross-app-trigger security note. Version bumps: workspace 1.1.4,
SDK 1.5, dashboard 0.10.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
54 lines
1.5 KiB
JSON
54 lines
1.5 KiB
JSON
{
|
|
"name": "picloud-dashboard",
|
|
"version": "0.10.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"format": "prettier --write .",
|
|
"lint": "prettier --check . && eslint .",
|
|
"test": "vitest run",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:ui": "playwright test --ui",
|
|
"test:e2e:install": "playwright install --with-deps chromium"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.18.0",
|
|
"@playwright/test": "^1.60.0",
|
|
"@sveltejs/adapter-static": "^3.0.8",
|
|
"@sveltejs/kit": "^2.17.0",
|
|
"@sveltejs/vite-plugin-svelte": "^5.0.3",
|
|
"@types/node": "^22.10.5",
|
|
"eslint": "^9.18.0",
|
|
"eslint-config-prettier": "^10.0.1",
|
|
"eslint-plugin-svelte": "^3.0.0",
|
|
"globals": "^15.14.0",
|
|
"prettier": "^3.4.2",
|
|
"prettier-plugin-svelte": "^3.3.3",
|
|
"svelte": "^5.19.0",
|
|
"svelte-check": "^4.1.4",
|
|
"typescript": "^5.7.3",
|
|
"typescript-eslint": "^8.20.0",
|
|
"vite": "^6.0.7",
|
|
"vitest": "^3.0.5"
|
|
},
|
|
"overrides": {
|
|
"cookie": "^0.7.2"
|
|
},
|
|
"dependencies": {
|
|
"@codemirror/autocomplete": "^6.20.2",
|
|
"@codemirror/commands": "^6.10.3",
|
|
"@codemirror/lang-json": "^6.0.2",
|
|
"@codemirror/language": "^6.12.3",
|
|
"@codemirror/search": "^6.7.0",
|
|
"@codemirror/state": "^6.6.0",
|
|
"@codemirror/view": "^6.43.0",
|
|
"@lezer/highlight": "^1.2.3",
|
|
"codemirror": "^6.0.2"
|
|
}
|
|
}
|