Keysat
aec2b7775b
Fixes from the 2026-06-12 full-eval (P0 + two P1s); code-only, no schema change. Without these the "private CRM" premise was breachable on the LAN: - P0: the /assets/ route joined the request path onto FRONTEND_DIR without normalizing '..' (get_path/urlparse pass it through), so an unauthenticated GET /assets/../../data/crm.db read any file the process could — the LP DB, the JWT signing secret (-> admin-token forgery), the Gmail key. Add a realpath containment check that 404s anything resolving outside FRONTEND_ROOT. - P1: the LP-outreach drafter built its redaction Boundary with no ner_fn, so unknown people/firms in raw email bodies reached Claude in the clear. Pass the local-Qwen NER backstop (ner_fn=_ner_local), matching architect_grounding; fails closed via the existing scrub_unavailable path if the local model is down. - P1: get-by-id handlers leaked soft-deleted records by direct ID. Add deleted_at IS NULL to every get-by-id path — contacts, organizations, opportunities, lp_profiles — and to the nested related-data sub-selects in the contact/opportunity detail payloads, matching the list-handler convention. Bumps the package to v0.1.0:74 (utils.ts + versions/v0.1.0.74.ts + graph). Full report in EVALUATION.md; remaining P2/P3 triaged in AGENTS.md Current state.
43 lines
2.0 KiB
TypeScript
43 lines
2.0 KiB
TypeScript
import { VersionGraph } from '@start9labs/start-sdk'
|
|
import { v_0_1_0_39 } from './v0.1.0.39'
|
|
import { v_0_1_0_40 } from './v0.1.0.40'
|
|
import { v_0_1_0_41 } from './v0.1.0.41'
|
|
import { v_0_1_0_42 } from './v0.1.0.42'
|
|
import { v_0_1_0_43 } from './v0.1.0.43'
|
|
import { v_0_1_0_44 } from './v0.1.0.44'
|
|
import { v_0_1_0_45 } from './v0.1.0.45'
|
|
import { v_0_1_0_46 } from './v0.1.0.46'
|
|
import { v_0_1_0_47 } from './v0.1.0.47'
|
|
import { v_0_1_0_48 } from './v0.1.0.48'
|
|
import { v_0_1_0_49 } from './v0.1.0.49'
|
|
import { v_0_1_0_50 } from './v0.1.0.50'
|
|
import { v_0_1_0_51 } from './v0.1.0.51'
|
|
import { v_0_1_0_52 } from './v0.1.0.52'
|
|
import { v_0_1_0_53 } from './v0.1.0.53'
|
|
import { v_0_1_0_54 } from './v0.1.0.54'
|
|
import { v_0_1_0_55 } from './v0.1.0.55'
|
|
import { v_0_1_0_56 } from './v0.1.0.56'
|
|
import { v_0_1_0_57 } from './v0.1.0.57'
|
|
import { v_0_1_0_58 } from './v0.1.0.58'
|
|
import { v_0_1_0_59 } from './v0.1.0.59'
|
|
import { v_0_1_0_60 } from './v0.1.0.60'
|
|
import { v_0_1_0_61 } from './v0.1.0.61'
|
|
import { v_0_1_0_62 } from './v0.1.0.62'
|
|
import { v_0_1_0_63 } from './v0.1.0.63'
|
|
import { v_0_1_0_64 } from './v0.1.0.64'
|
|
import { v_0_1_0_65 } from './v0.1.0.65'
|
|
import { v_0_1_0_66 } from './v0.1.0.66'
|
|
import { v_0_1_0_67 } from './v0.1.0.67'
|
|
import { v_0_1_0_68 } from './v0.1.0.68'
|
|
import { v_0_1_0_69 } from './v0.1.0.69'
|
|
import { v_0_1_0_70 } from './v0.1.0.70'
|
|
import { v_0_1_0_71 } from './v0.1.0.71'
|
|
import { v_0_1_0_72 } from './v0.1.0.72'
|
|
import { v_0_1_0_73 } from './v0.1.0.73'
|
|
import { v_0_1_0_74 } from './v0.1.0.74'
|
|
|
|
export const versionGraph = VersionGraph.of({
|
|
current: v_0_1_0_74,
|
|
other: [v_0_1_0_39, v_0_1_0_40, v_0_1_0_41, v_0_1_0_42, v_0_1_0_43, v_0_1_0_44, v_0_1_0_45, v_0_1_0_46, v_0_1_0_47, v_0_1_0_48, v_0_1_0_49, v_0_1_0_50, v_0_1_0_51, v_0_1_0_52, v_0_1_0_53, v_0_1_0_54, v_0_1_0_55, v_0_1_0_56, v_0_1_0_57, v_0_1_0_58, v_0_1_0_59, v_0_1_0_60, v_0_1_0_61, v_0_1_0_62, v_0_1_0_63, v_0_1_0_64, v_0_1_0_65, v_0_1_0_66, v_0_1_0_67, v_0_1_0_68, v_0_1_0_69, v_0_1_0_70, v_0_1_0_71, v_0_1_0_72, v_0_1_0_73],
|
|
})
|