Skip to content

Release 0.5.0 alpha2 to master branch #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
PaperStrange wants to merge 14 commits into from
Closed

Release 0.5.0 alpha2 to master branch #14

PaperStrange wants to merge 14 commits into from

Conversation

@PaperStrange
Copy link
Owner

@PaperStrange PaperStrange commented Mar 25, 2025

Changes 🏗️

Patch release focused on frontend stability, error handling, and resilience improvements

Major Improvements

  • Fixed critical React Router nesting issues that caused runtime errors
  • Implemented Material UI ThemeProvider for consistent styling across components
  • Added proper error boundaries and fallback UI for backend service unavailability
  • Created comprehensive stability test suite with automated CI verification

####Technical Enhancements

  • Standardized API module organization with namespaced exports
  • Implemented proper ESLint global declarations for external libraries
  • Added graceful degradation for service failures
  • Enhanced component resilience with error boundaries

Testing Improvements

  • Added Router structure validation tests
  • Created Theme Provider presence tests
  • Implemented backend resilience tests
  • Added automated stability checks to CI/CD pipeline

Documentation Updates

  • Created comprehensive stability tests README
  • Updated core module documentation with API organization guidelines
  • Enhanced project refactoring records with stability improvements
  • Updated GitHub workflows documentation with stability checks

Known Issues

  • No new issues introduced

Checklist 📋

For code changes:

  • I have clearly listed my changes in the PR description
  • I have made a test plan
  • I have tested my changes according to the test plan: docs\stability-test-plan.md
Details Refer to src\tests, Results refer to docs\test-execution-results.md

For configuration changes:

  • .env.example is updated or already compatible with my changes
  • package.json, package-lock.json is updated or already compatible with my changes
  • I have included a list of my configuration changes in the PR description (under Changes)
Details Refer to .cursor\.milestones, .cursor\.project, .cursor\.todos

PaperStrange and others added 14 commits March 23, 2025 15:05
@PaperStrange
Feat: add feedback and visualization components for beta launch
0e3e40b
@PaperStrange
Feat: embed RBAC system
e019bc5
@PaperStrange
Feat: add email-verification and reset logic
5826c94
@PaperStrange
Feat: enhance onboarding flow and add statical dashboard
caa55a3
@PaperStrange
Docs: update with new features and new test cases
e1b6f09
@PaperStrange
Fix: remove security vulnerabilities
4a5a40b
@PaperStrange
Docs: add security.md
6a62003
@PaperStrange
Feat: init github action and workflow fix #issue 3
40908ef
@PaperStrange
Feat: implement secure token vault system for API key management and …
b6b7b46 
…enhance documentation
@PaperStrange
Fix: apply new token security solution to related codebase
7baa93c
@PaperStrange
Fix: fix issue #3 workflow error [![TourGuideAI CI/CD Pipeline](https…
9d31f13 
…://github.com/PaperStrange/TourGuideAI/actions/workflows/ci-cd.yml/badge.svg)](https://github.com/PaperStrange/TourGuideAI/actions/workflows/ci-cd.yml)
@PaperStrange
Fix: fix issue #3 fix workflow error https://github.com/PaperStrange/…
8ef2be9 
…TourGuideAI/actions/workflows/ci-cd.yml
@PaperStrange
Fix: fix issue #3 enhance frontend stability and error handling updat…
2afd0c6 
…e documentations
@PaperStrange
Docs: update package lists
faa62de
@PaperStrange PaperStrange self-assigned this Mar 25, 2025
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 25, 2025
View reviewed changes
.github/workflows/ci-cd.yml

- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v4

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'TourGuideAI CI/CD Pipeline' step
Uses Step
Loading
uses 'aws-actions/configure-aws-credentials' with ref 'v4', not a pinned commit hash
.github/workflows/ci-cd.yml

- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v4

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'TourGuideAI CI/CD Pipeline' step
Uses Step
Loading
uses 'aws-actions/configure-aws-credentials' with ref 'v4', not a pinned commit hash
.github/workflows/dependency-updates.yml

# Use Dependabot to update dependencies
- name: Enable Dependabot
uses: dependabot/fetch-metadata@v1.6.0

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Dependency Updates' step
Uses Step
Loading
uses 'dependabot/fetch-metadata' with ref 'v1.6.0', not a pinned commit hash
.github/workflows/dependency-updates.yml

# Alternative: Use Renovate for more control
- name: Update dependencies with Renovate
uses: renovatebot/github-action@v39.0.5

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Dependency Updates' step
Uses Step
Loading
uses 'renovatebot/github-action' with ref 'v39.0.5', not a pinned commit hash
.github/workflows/e2e-tests.yml
Comment on lines +15 to +67
runs-on: ubuntu-latest
timeout-minutes: 30

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '18'
cache: 'npm'

- name: Install Dependencies
run: npm ci

- name: Install Playwright
run: npx playwright install --with-deps

- name: Build Application
run: npm run build

- name: Start Application
run: |
npm run start:server &
npm run start:client &
npx wait-on http://localhost:3000 http://localhost:5000/api/health

- name: Run Playwright Tests
run: npx playwright test

- name: Store Playwright Report
uses: actions/upload-artifact@v4
if: always()
with:
name: playwright-report
path: playwright-report/
retention-days: 14

- name: Store Playwright Screenshots
uses: actions/upload-artifact@v4
if: failure()
with:
name: playwright-screenshots
path: test-results/
retention-days: 14

- name: Publish Test Results
uses: EnricoMi/publish-unit-test-result-action@v2
if: always()
with:
files: |
playwright-report/*.xml No newline at end of file

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions Job or Workflow does not set permissions
.github/workflows/security-scan.yml

# Run Trivy vulnerability scanner
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Security Scan' step
Uses Step
Loading
uses 'aquasecurity/trivy-action' with ref 'master', not a pinned commit hash
.github/workflows/security-scan.yml

# Secret scanning
- name: Secret Scanning with GitLeaks
uses: gitleaks/gitleaks-action@v2

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Security Scan' step
Uses Step
Loading
uses 'gitleaks/gitleaks-action' with ref 'v2', not a pinned commit hash
.github/workflows/security-scan.yml

# Check package.json for issues
- name: Package.json security audit
uses: lirantal/lockfile-lint-action@master

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Security Scan' step
Uses Step
Loading
uses 'lirantal/lockfile-lint-action' with ref 'master', not a pinned commit hash
.github/workflows/security-scan.yml
# OWASP ZAP Baseline Scan
- name: ZAP Baseline Scan
uses: zaproxy/action-baseline@v0.7.0
uses: zaproxy/action-baseline@v0.9.0

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Security Scan' step
Uses Step
Loading
uses 'zaproxy/action-baseline' with ref 'v0.9.0', not a pinned commit hash
.github/workflows/security-scan.yml

# License compliance scanning
- name: License Scanning
uses: fossas/fossa-action@main

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Security Scan' step
Uses Step
Loading
uses 'fossas/fossa-action' with ref 'main', not a pinned commit hash
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 25, 2025
View reviewed changes
server/middleware/authMiddleware.js
// Extract token from request
const token = jwtAuth.extractTokenFromRequest(req);

if (!token) {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive
action
Loading
, but a
user-provided value
Loading
controls it.
server/middleware/authMiddleware.js
// Extract token from request
const token = jwtAuth.extractTokenFromRequest(req);

if (!token) {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive
action
Loading
, but a
user-provided value
Loading
controls it.
server/routes/auth.js

// Send welcome email
emailService.sendWelcomeEmail(user)
.catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to userWithoutPassword
Loading
as clear text.

Copilot Autofix

AI 10 months ago

To fix the problem, we should avoid logging sensitive user information. Instead of logging the entire userId, we can log a generic message or a hashed version of the userId to maintain some level of traceability without exposing the actual identifier. This way, we can still have useful logs for debugging without compromising user privacy.

  • Replace the logging statements that include { error, userId: user.id } with a more generic message or a hashed version of the userId.
  • Update the relevant lines in server/routes/auth.js.
Suggested changeset 1
server/routes/auth.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/routes/auth.js b/server/routes/auth.js
--- a/server/routes/auth.js
+++ b/server/routes/auth.js
@@ -126,3 +126,3 @@
     emailService.sendWelcomeEmail(user)
-      .catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));
+      .catch(error => logger.error('Error sending welcome email', { error: error.message }));
     
@@ -130,3 +130,3 @@
     emailService.sendVerificationEmail(user)
-      .catch(error => logger.error('Error sending verification email', { error, userId: user.id }));
+      .catch(error => logger.error('Error sending verification email', { error: error.message }));
     
EOF
@@ -126,3 +126,3 @@
emailService.sendWelcomeEmail(user)
.catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));
.catch(error => logger.error('Error sending welcome email', { error: error.message }));

@@ -130,3 +130,3 @@
emailService.sendVerificationEmail(user)
.catch(error => logger.error('Error sending verification email', { error, userId: user.id }));
.catch(error => logger.error('Error sending verification email', { error: error.message }));

Copilot is powered by AI and may make mistakes. Always verify output.
server/routes/auth.js

// Send email verification
emailService.sendVerificationEmail(user)
.catch(error => logger.error('Error sending verification email', { error, userId: user.id }));

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to userWithoutPassword
Loading
as clear text.

Copilot Autofix

AI 10 months ago

To fix the problem, we should avoid logging sensitive information such as user identifiers. Instead, we can log a generic error message without including sensitive details. This ensures that sensitive data is not exposed in the logs while still providing useful information for debugging purposes.

  • Replace the logging statements that include sensitive information with more generic messages.
  • Specifically, update the logging statements in the catch blocks to exclude the userId field.
  • No additional methods, imports, or definitions are needed to implement these changes.
Suggested changeset 1
server/routes/auth.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/routes/auth.js b/server/routes/auth.js
--- a/server/routes/auth.js
+++ b/server/routes/auth.js
@@ -126,3 +126,3 @@
     emailService.sendWelcomeEmail(user)
-      .catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));
+      .catch(error => logger.error('Error sending welcome email', { error }));
     
@@ -130,3 +130,3 @@
     emailService.sendVerificationEmail(user)
-      .catch(error => logger.error('Error sending verification email', { error, userId: user.id }));
+      .catch(error => logger.error('Error sending verification email', { error }));
     
EOF
@@ -126,3 +126,3 @@
emailService.sendWelcomeEmail(user)
.catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));
.catch(error => logger.error('Error sending welcome email', { error }));

@@ -130,3 +130,3 @@
emailService.sendVerificationEmail(user)
.catch(error => logger.error('Error sending verification email', { error, userId: user.id }));
.catch(error => logger.error('Error sending verification email', { error }));

Copilot is powered by AI and may make mistakes. Always verify output.
server/routes/auth.js
if (sendInvite) {
// Send welcome email
emailService.sendWelcomeEmail(user)
.catch(error => logger.error('Error sending welcome email', { error, userId: user.id }));

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to userWithoutPassword
Loading
as clear text.
server/services/emailService.js
html
});
} catch (error) {
logger.error('Error sending password reset email', { error, email });

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This logs sensitive data returned by
an access to passwordResetToken
Loading
as clear text.
This logs sensitive data returned by
an access to passwordResetExpires
Loading
as clear text.

Copilot Autofix

AI 10 months ago

To fix the problem, we should avoid logging sensitive information such as email addresses directly. Instead, we can log a generic message or use a placeholder to indicate the presence of sensitive data without exposing it. This can be achieved by removing the email parameter from the logger.error call and replacing it with a generic message.

  • Update the logger.error call in the sendPasswordResetEmail function to remove the email parameter.
  • Ensure that the log message still provides enough context to understand the error without exposing sensitive information.
Suggested changeset 1
server/services/emailService.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/services/emailService.js b/server/services/emailService.js
--- a/server/services/emailService.js
+++ b/server/services/emailService.js
@@ -329,3 +329,3 @@
   } catch (error) {
-    logger.error('Error sending password reset email', { error, email });
+    logger.error('Error sending password reset email', { error });
     return false;
EOF
@@ -329,3 +329,3 @@
} catch (error) {
logger.error('Error sending password reset email', { error, email });
logger.error('Error sending password reset email', { error });
return false;
Copilot is powered by AI and may make mistakes. Always verify output.
server/utils/tokenProvider.js
} else {
// Otherwise create a new secret
const secretId = await vaultService.storeSecret(secretType, serviceName, token);
this.secretIdMapping[serviceName] = secretId;

Check failure

Code scanning / CodeQL

Remote property injection High

A property name to write to depends on a
user-provided value
Loading
.
server/utils/tokenProvider.js

return true;
} catch (error) {
logger.error(`Failed to store token for ${serviceName}`, { error });

Check warning

Code scanning / CodeQL

Log injection Medium

Log entry depends on a
user-provided value
Loading
.

Copilot Autofix

AI 10 months ago

To fix the log injection issue, we need to sanitize the serviceName before logging it. Specifically, we should remove any newline characters from the serviceName to prevent log injection. This can be done using String.prototype.replace to ensure no line endings are present in the user input.

Suggested changeset 1
server/utils/tokenProvider.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/utils/tokenProvider.js b/server/utils/tokenProvider.js
--- a/server/utils/tokenProvider.js
+++ b/server/utils/tokenProvider.js
@@ -173,3 +173,4 @@
     } catch (error) {
-      logger.error(`Failed to store token for ${serviceName}`, { error });
+      const sanitizedServiceName = serviceName.replace(/\n|\r/g, "");
+      logger.error(`Failed to store token for ${sanitizedServiceName}`, { error });
       throw error;
EOF
@@ -173,3 +173,4 @@
} catch (error) {
logger.error(`Failed to store token for ${serviceName}`, { error });
const sanitizedServiceName = serviceName.replace(/\n|\r/g, "");
logger.error(`Failed to store token for ${sanitizedServiceName}`, { error });
throw error;
Copilot is powered by AI and may make mistakes. Always verify output.
server/utils/tokenProvider.js

return true;
} catch (error) {
logger.error(`Failed to rotate token for ${serviceName}`, { error });

Check warning

Code scanning / CodeQL

Log injection Medium

Log entry depends on a
user-provided value
Loading
.

Copilot Autofix

AI 10 months ago

To fix the log injection issue, we need to sanitize the serviceName before logging it. Specifically, we should remove any newline characters from the serviceName to prevent log injection. This can be done using String.prototype.replace to ensure no line endings are present in the user input.

Suggested changeset 2
server/utils/tokenProvider.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/utils/tokenProvider.js b/server/utils/tokenProvider.js
--- a/server/utils/tokenProvider.js
+++ b/server/utils/tokenProvider.js
@@ -196,3 +196,4 @@
     } catch (error) {
-      logger.error(`Failed to rotate token for ${serviceName}`, { error });
+      const sanitizedServiceName = serviceName.replace(/\n|\r/g, "");
+      logger.error(`Failed to rotate token for ${sanitizedServiceName}`, { error });
       throw error;
EOF
@@ -196,3 +196,4 @@
} catch (error) {
logger.error(`Failed to rotate token for ${serviceName}`, { error });
const sanitizedServiceName = serviceName.replace(/\n|\r/g, "");
logger.error(`Failed to rotate token for ${sanitizedServiceName}`, { error });
throw error;
server/routes/admin.js
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server/routes/admin.js b/server/routes/admin.js
--- a/server/routes/admin.js
+++ b/server/routes/admin.js
@@ -65,3 +65,4 @@
   } catch (error) {
-    logger.error('Error rotating token', { error, serviceName: req.body.serviceName });
+    const sanitizedServiceName = req.body.serviceName.replace(/\n|\r/g, "");
+    logger.error('Error rotating token', { error, serviceName: sanitizedServiceName });
     res.status(500).json({
EOF
@@ -65,3 +65,4 @@
} catch (error) {
logger.error('Error rotating token', { error, serviceName: req.body.serviceName });
const sanitizedServiceName = req.body.serviceName.replace(/\n|\r/g, "");
logger.error('Error rotating token', { error, serviceName: sanitizedServiceName });
res.status(500).json({
Copilot is powered by AI and may make mistakes. Always verify output.
server/utils/vaultService.js
try {
await fs.access(this.vaultPath);
// Load existing vault
const encryptedVault = await fs.readFile(this.vaultPath, 'utf8');

Check failure

Code scanning / CodeQL

Potential file system race condition High

The file may have changed since it
was checked
Loading
.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@PaperStrange PaperStrange

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@PaperStrange