Commit graph

15 commits

Author SHA1 Message Date
64c4487b8e Fix CI recursive clone and document CI workflow strategy in PROMPT.md 2026-01-25 12:31:55 -03:00
f8a907bd81 Update PROMPT.md and feature gating 2026-01-22 20:24:05 -03:00
4ed05f3f19 feat(i18n): add missing translation keys to TRANSLATION_KEYS array
- Add people-* keys (title, subtitle, search, tabs, form fields)
- Add crm-* keys (stages, stats, metrics)
- Add billing-* keys (subtitle, new-payment, revenue metrics)
- Add products-* keys (subtitle, items, stats)
2026-01-12 14:13:35 -03:00
c67aaa677a feat(security): Complete security infrastructure implementation
SECURITY MODULES ADDED:
- security/auth.rs: Full RBAC with roles (Anonymous, User, Moderator, Admin, SuperAdmin, Service, Bot, BotOwner, BotOperator, BotViewer) and permissions
- security/cors.rs: Hardened CORS (no wildcard in production, env-based config)
- security/panic_handler.rs: Panic catching middleware with safe 500 responses
- security/path_guard.rs: Path traversal protection, null byte prevention
- security/request_id.rs: UUID request tracking with correlation IDs
- security/error_sanitizer.rs: Sensitive data redaction from responses
- security/zitadel_auth.rs: Zitadel token introspection and role mapping
- security/sql_guard.rs: SQL injection prevention with table whitelist
- security/command_guard.rs: Command injection prevention
- security/secrets.rs: Zeroizing secret management
- security/validation.rs: Input validation utilities
- security/rate_limiter.rs: Rate limiting with governor crate
- security/headers.rs: Security headers (CSP, HSTS, X-Frame-Options)

MAIN.RS UPDATES:
- Replaced tower_http::cors::Any with hardened create_cors_layer()
- Added panic handler middleware
- Added request ID tracking middleware
- Set global panic hook

SECURITY STATUS:
- 0 unwrap() in production code
- 0 panic! in production code
- 0 unsafe blocks
- cargo audit: PASS (no vulnerabilities)
- Estimated completion: ~98%

Remaining: Wire auth middleware to handlers, audit logs for sensitive data
2025-12-28 19:29:18 -03:00
61618a9641 Update PROMPT.md - 0 warnings achieved, document fix patterns 2025-12-28 14:29:44 -03:00
5da86bbef2 Fix clippy warnings: match arms, async/await, Debug impls, formatting
- Fix match arms with identical bodies by consolidating patterns
- Fix case-insensitive file extension comparisons using eq_ignore_ascii_case
- Fix unnecessary Debug formatting in log/format macros
- Fix clone_from usage instead of clone assignment
- Fix let...else patterns where appropriate
- Fix format! append to String using write! macro
- Fix unwrap_or with function calls to use unwrap_or_else
- Add missing fields to manual Debug implementations
- Fix duplicate code in if blocks
- Add type aliases for complex types
- Rename struct fields to avoid common prefixes
- Various other clippy warning fixes

Note: Some 'unused async' warnings remain for functions that are
called with .await but don't contain await internally - these are
kept async for API compatibility.
2025-12-26 08:59:25 -03:00
e2a5bf091a Update server components and keywords 2025-12-23 15:52:35 -03:00
a491cc13a6 Update botserver 2025-12-21 23:40:43 -03:00
2cff6bf430 fix: make exec_in_container return errors instead of silently warning
- Changed from warn() to error() and return Err()
- Added info logging for each command executed
- Now we can see why downloads/installs fail
2025-12-19 19:59:15 -03:00
57bf5b8754 feat: add ON EMAIL and ON CHANGE keywords for event-driven monitoring
- Add ON EMAIL keyword with FROM/SUBJECT filters
- Add ON CHANGE keyword with account:// syntax (gdrive, onedrive, dropbox, local)
- Add TriggerKind::EmailReceived (5) and FolderChange (6)
- Add migration 6.1.3_bot_hierarchy_monitors with:
  - email_monitors, folder_monitors tables
  - email_received_events, folder_change_events tables
  - user_organizations table
  - Bot hierarchy: parent_bot_id, enabled_tabs_json, inherit_parent_config
- Add 26 unit tests (12 on_email, 12 on_change, 2 trigger_kind)
- Update PROMPT.md with weekly maintenance checklist
- Zero warnings, zero errors
2025-12-18 16:17:58 -03:00
824a8b742e Lowercase botserver/botbook references 2025-12-12 23:20:42 -03:00
6c4ecea2fc feat(auth): Add OAuth login for Google, Discord, Reddit, Twitter, Microsoft, Facebook
- Create core/oauth module with OAuthProvider enum and shared types
- Implement providers.rs with auth URLs, token exchange, user info endpoints
- Add routes for /auth/oauth/providers, /auth/oauth/{provider}, and callbacks
- Update login.html with OAuth button grid and dynamic provider loading
- Add OAuth config settings to config.csv with setup documentation and links
- Uses HTMX for login form, minimal JS for OAuth provider visibility
2025-12-04 22:53:40 -03:00
d9b09e24d4 feat(email): implement email read tracking with pixel support
- Add email-read-pixel config parameter to enable/disable tracking
- Implement tracking pixel injection in HTML emails
- Add sent_email_tracking table with migration
- Create 4 new API endpoints:
  - GET /api/email/tracking/pixel/{id} - serve pixel & record read
  - GET /api/email/tracking/status/{id} - get email read status
  - GET /api/email/tracking/list - list all tracked emails
  - GET /api/email/tracking/stats - get aggregate statistics
- Store tracking data: read_at, read_count, IP, user_agent
- Integrate with send_email() to auto-inject pixel when enabled
2025-12-04 18:15:09 -03:00
5fe12526e8 Update PROMPT.md with new LLM workflow and coding rules
New rules added:
- Two LLM work modes: Execution (fazer) vs Review (conferir)
- Rust code only in architecture.md (gbapp chapter)
- Scan and delete misplaced ALL_CAPS.md files
- HTMX-first: minimize JS, delegate to server
- Local assets only: no CDN references
- Documentation validation process for chapters
- No dead code: implement real code, never use _ prefix
- cargo audit must pass with 0 warnings
- diesel only, remove sqlx references
- Library consolidation guidance
2025-12-04 13:55:19 -03:00
9f3af41566 Remove obsolete CAPS.md documentation files
Deleted planning/tracking documents that are no longer needed:
- MISSING_IMPLEMENTATIONS.md (all 5 apps now implemented)
- GAP_ANALYSIS.md (analysis complete, implemented)
- IMPLEMENTATION_SUMMARY.md (implementations done)
- LIBRARY_MIGRATION.md (migration guide)
- ROADMAP.md (feature planning)
- START_CODING_PROMPT.md (coding guide)
- CHANGELOG.md (version history)
- templates/TEMPLATE_PLAN.md (template planning)
- templates/integration/public-apis.gbai/KEYWORDS_CHECKLIST.md
- templates/integration/public-apis.gbai/QUICKSTART.md
- botlib/VERSION.md (version history)

Kept: README.md, PROMPT.md, and SUMMARY.md (mdbook structure)
2025-12-04 12:28:05 -03:00