Keysat
3f22ef7600
P2 batch from the 2026-06-13 full-eval (EVALUATION.md / ROADMAP.md), reviewed by the reviewer agent. App-code + packaging only; no schema or data change, existing /data untouched. Input validation: malformed JSON bodies, invalid date, and out-of-range or non-numeric pagination on /api/workouts now return 400 instead of 500. New lib/http.ts readJsonBody maps a bad body to a ZodError across the 11 CRUD routes whose catch maps ZodError to 400; me/import and admin/signups guard request.json() in an explicit try/catch. Rate limiting: POST /api/auth now shares the UI login server action's per-IP 10-per-15min cap and returns 429 + Retry-After. clientIpFromHeaders reads the rightmost (trusted-proxy-appended) X-Forwarded-For entry instead of the spoofable leftmost. Container: drops root. The entrypoint prepares /data as root, chowns it to nextjs, then exec su-exec nextjs:nodejs node server.js (su-exec added to the runner image). The container drop needs live sideload verification.
Proof of Work
Self-hosted multi-user workout planner and logger. Plan training cycles, log daily workouts, search your history, and curate a shared exercise library across everyone on the instance. Distributed as a StartOS 0.4 sideload package.
Repo layout
proof-of-work/ Next.js app (TypeScript, Prisma + SQLite, Tailwind, PWA)
start9/0.4/ StartOS 0.4 package wrapper (manifest, Dockerfile,
entrypoint, version graph, change-credentials action)
Everything else is generated at build time.
Local development
cd proof-of-work
npm install
npx prisma generate # important after schema changes
npx prisma db push # create the dev DB at prisma/data/app.db
npm run db:seed # ONLY seeds the InstanceSettings singleton — no admin
npm run dev # http://localhost:3000
For local dev you'll need to create an admin manually since the
StartOS action isn't available — easiest is npx tsx a one-off
script, or just open Prisma Studio (npm run db:studio) and add a
User row with isAdmin: true + a bcrypt hash you generate with
node -e 'require("bcrypt").hash("yourpassword", 10).then(console.log)'.
Multi-user
Fresh installs ship with no admin user on purpose — the operator
must run the StartOS Action Set admin credentials (Services → Proof
of Work → Actions) before anyone can log in. This eliminates the
default-credentials footgun.
Once the admin exists, they can open sign-ups for additional users:
- In-app: log in as admin -> Settings -> Instance Settings -> Allow new sign-ups.
- StartOS: Services -> Proof of Work -> Actions -> Set new signups.
Both write to the same InstanceSettings row; either path works.
When sign-ups are open, anyone reaching the URL can create an account at
/auth/signup. New users start with no admin privileges and are
automatically seeded the full curated exercise library.
Building the StartOS package
See start9/0.4/DEPLOY_040.md for the full deployment / cutover guide. Short version:
cd start9/0.4
npm ci
make clean
make x86 # produces proof-of-work_x86_64.s9pk
make install # sideload to the host in ~/.startos/config.yaml
Curated exercise library
proof-of-work/prisma/exercises.seed.json is the canonical library
shipped to every install. It seeds fresh installs (via prisma/seed.ts)
and is re-applied on every boot to existing installs (via
docker_entrypoint.sh + ensureExerciseLibrary.cjs) so updates flow to
all users on package upgrade.
Refresh the JSON from the maintainer's live host:
./start9/0.4/refresh_seed.sh <ssh-target> # pull a fresh /data snapshot
cd proof-of-work && npm run sync-library # extract Exercise table -> JSON
git diff prisma/exercises.seed.json
The system is additive only — removing an exercise from the JSON does
not delete it from existing installs (users may have logged sets against
it). Users' own custom exercises (isCustom = true) are never touched.
Privacy
start9/0.4/seed/data/app.db is your live /data snapshot. It contains
real workout history and a bcrypt'd password hash. The top-level
.gitignore keeps it out of git; do NOT commit it to any public repo.