-
Notifications
You must be signed in to change notification settings - Fork 0
Claude/fix main package lock 011 cv4 t qrtydsb2 r nvi6 f kjs #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
990552b
2bd8e77
67b352f
7ff6c42
d4a2d3c
c231297
fd09fb8
2e59274
8e11b92
2a56a48
38c9791
48facfa
a128038
2f28106
7af84a3
c1d0cdd
d80166d
dbac191
51b2ed3
e3ca847
59f37c6
cf54d48
7ae6db0
cb817ff
2247038
35d52ae
8b76fb8
46717d6
e087184
d78fa77
61a23d0
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,28 +1,28 @@ | ||||||||||
| # Database Configuration | ||||||||||
| DATABASE_URL="postgresql://postgres:password@localhost:5432/basednet" | ||||||||||
| POSTGRES_USER="postgres" | ||||||||||
| POSTGRES_PASSWORD="password" | ||||||||||
| POSTGRES_HOST="localhost" | ||||||||||
| DATABASE_URL="postgresql://neondb_owner:npg_loex42GnkyEf@ep-small-flower-a5hbgnie-pooler.us-east-2.aws.neon.tech/neondb?sslmode=require" | ||||||||||
| POSTGRES_USER="neondb_owner" | ||||||||||
| POSTGRES_PASSWORD="npg_loex42GnkyEf" | ||||||||||
| POSTGRES_HOST="ep-small-flower-a5hbgnie-pooler.us-east-2.aws.neon.tech" | ||||||||||
| POSTGRES_PORT="5432" | ||||||||||
| POSTGRES_DB="basednet" | ||||||||||
| POSTGRES_DB="neondb" | ||||||||||
|
|
||||||||||
| # IPFS Configuration | ||||||||||
| IPFS_PROJECT_ID="" | ||||||||||
| IPFS_PROJECT_SECRET="" | ||||||||||
| IPFS_GATEWAY="https://ipfs.io/ipfs/" | ||||||||||
| IPFS_PROJECT_ID="971d5aadc982cc62695b" | ||||||||||
| IPFS_PROJECT_SECRET="11ed2bf0f5a3ec55c8aa8a515b4851deb4489837cdabf4e67681e00ce38af265" | ||||||||||
|
Comment on lines
+10
to
+11
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Security Vulnerability: IPFS API credentials are exposed in plaintext. This allows unauthorized access to your IPFS services and potential data manipulation1.
Suggested change
Footnotes
|
||||||||||
| IPFS_GATEWAY="turquoise-selected-locust-947.mypinata.cloud" | ||||||||||
|
Comment on lines
+2
to
+12
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Hardcoding secrets like database credentials, API keys, and tokens directly into the Instead of hardcoding, use a |
||||||||||
|
|
||||||||||
| # Authentication | ||||||||||
| INDIE_AUTH_CLIENT_ID="" | ||||||||||
| INDIE_AUTH_CLIENT_SECRET="" | ||||||||||
| INDIE_AUTH_REDIRECT_URI="http://localhost:3000/api/auth/callback" | ||||||||||
| INDIE_AUTH_CLIENT_ID="https://basednet.lol" | ||||||||||
| INDIE_AUTH_CLIENT_SECRET="a0cb2bbadb0befc7cedfe9f40a9355c52ad107dfdd628a7c009348de579fbb1a" | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Security Vulnerability: Authentication secrets are hardcoded and exposed. This compromises the entire authentication system security1.
Suggested change
Footnotes
|
||||||||||
| INDIE_AUTH_REDIRECT_URI="https://basednet.lol/callback" | ||||||||||
|
|
||||||||||
| # API Keys & Security | ||||||||||
| NEXTAUTH_SECRET="basednet-nextauth-secret-key-change-in-production" | ||||||||||
| NEXTAUTH_URL="http://localhost:3000" | ||||||||||
| NEXTAUTH_URL="https://basednet.lol" | ||||||||||
|
|
||||||||||
| # Rate Limiting | ||||||||||
| UPSTASH_REDIS_REST_URL="" | ||||||||||
| UPSTASH_REDIS_REST_TOKEN="" | ||||||||||
| UPSTASH_REDIS_REST_URL="https://witty-stingray-45983.upstash.io" | ||||||||||
| UPSTASH_REDIS_REST_TOKEN="AbOfAAIjcDFhM2M1N2FhNzA3MjY0NTkwYWQ0YjRmNjQ2ODVjMGIwYnAxMA" | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Security Vulnerability: Redis access token is exposed in plaintext. This allows unauthorized access to your rate limiting and caching infrastructure1.
Suggested change
Footnotes
|
||||||||||
|
|
||||||||||
| # Federation | ||||||||||
| ACTIVITY_PUB_DOMAIN="" | ||||||||||
|
|
@@ -35,8 +35,10 @@ ENABLE_FEDERATION=true | |||||||||
| ENABLE_CHAT=true | ||||||||||
|
|
||||||||||
| # Services | ||||||||||
| PINATA_API_KEY="" | ||||||||||
| PINATA_SECRET_KEY="" | ||||||||||
| PINATA_API_KEY="971d5aadc982cc62695b" | ||||||||||
| PINATA_SECRET_KEY="11ed2bf0f5a3ec55c8aa8a515b4851deb4489837cdabf4e67681e00ce38af265" | ||||||||||
|
|
||||||||||
| # Analytics & Monitoring | ||||||||||
| SENTRY_DSN="" | ||||||||||
| SENTRY_DSN="https://e8030cc6502f8f8391a6eefb8350b1f0@o4509050597605376.ingest.us.sentry.io/4509050617856000" | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛑 Security Vulnerability: Sentry DSN contains sensitive project information that should not be exposed in version control1.
Suggested change
Footnotes
|
||||||||||
| SENTRY_ORG="basednet" | ||||||||||
| SENTRY_PROJECT="basednet" | ||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1 +1,2 @@ | ||||||||||||||||||||||||||||||||||
| node_modules | ||||||||||||||||||||||||||||||||||
| .vercel | ||||||||||||||||||||||||||||||||||
|
Comment on lines
1
to
+2
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. P1 | Confidence: High The gitignore has been drastically reduced from 42 lines to only 2 lines, removing protection for critical files. This change exposes build artifacts (.next/, out/, dist/), environment files (.env, .env*.local), IDE configurations, debug logs, and OS-specific files to version control. This will lead to repository bloat, potential secret leakage, and conflicts between development environments.
Suggested change
|
||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| name: Deploy to Vercel | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| deploy: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '20' | ||
| cache: 'npm' | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Install Vercel CLI | ||
| run: npm install --global vercel@latest | ||
|
|
||
| - name: Pull Vercel Environment Information | ||
| run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }} | ||
|
|
||
| - name: Build Project Artifacts | ||
| run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }} | ||
|
|
||
| - name: Deploy Project Artifacts to Vercel | ||
| run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} | ||
|
Comment on lines
+1
to
+33
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The Please add |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| # Deploying BasedNet using GitHub Actions and Vercel | ||
|
|
||
| ## Overview | ||
|
|
||
| This document outlines an improved approach to deploying BasedNet to Vercel using GitHub Actions. This approach offers several advantages over direct deployment from a local machine: | ||
|
|
||
| 1. **Consistent Environment**: Builds happen in a clean Ubuntu environment, avoiding Windows-specific path issues | ||
| 2. **Automated Workflow**: Deployments are triggered automatically when you push to the main branch | ||
| 3. **Reproducible Builds**: Every build uses the same setup, reducing "works on my machine" problems | ||
| 4. **Version Control**: Deployment configuration is tracked in version control | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| Before using this deployment method, you'll need: | ||
|
|
||
| 1. A GitHub account with your BasedNet code pushed to a repository | ||
| 2. A Vercel account linked to your GitHub account | ||
| 3. A Vercel project created for BasedNet | ||
|
|
||
| ## Setup Instructions | ||
|
|
||
| ### 1. Generate a Vercel API Token | ||
|
|
||
| 1. Log in to your [Vercel dashboard](https://vercel.com/dashboard) | ||
| 2. Go to Settings → Tokens | ||
| 3. Create a new token with "Full Account" scope | ||
| 4. Copy the token value (you won't be able to see it again) | ||
|
|
||
| ### 2. Add the Vercel Token to GitHub Secrets | ||
|
|
||
| 1. Go to your GitHub repository | ||
| 2. Navigate to Settings → Secrets and variables → Actions | ||
| 3. Click "New repository secret" | ||
| 4. Name: `VERCEL_TOKEN` | ||
| 5. Value: Paste your Vercel API token | ||
| 6. Click "Add secret" | ||
|
|
||
| ### 3. Initial Setup on Vercel | ||
|
|
||
| 1. From the Vercel dashboard, click "Add New..." → "Project" | ||
| 2. Import your GitHub repository | ||
| 3. Configure your project settings: | ||
| - Framework Preset: Next.js | ||
| - Root Directory: ./ | ||
| - Build Command: npm run build | ||
| - Output Directory: .next | ||
| 4. Add all required environment variables from your `.env` file | ||
| 5. Deploy once manually through the Vercel interface to set up the project | ||
|
|
||
| ### 4. Use GitHub Actions for Future Deployments | ||
|
|
||
| After the initial setup, all future deployments will happen automatically through GitHub Actions when you push to the main branch. | ||
|
|
||
| ## How It Works | ||
|
|
||
| The workflow file `.github/workflows/vercel-deploy.yml` defines the deployment process: | ||
|
|
||
| 1. Checkout the code from GitHub | ||
| 2. Set up Node.js | ||
| 3. Install dependencies | ||
| 4. Install Vercel CLI | ||
| 5. Pull environment variables from Vercel | ||
| 6. Build the project | ||
| 7. Deploy to Vercel | ||
|
|
||
| ## Troubleshooting | ||
|
|
||
| If you encounter deployment issues: | ||
|
|
||
| 1. Check the GitHub Actions logs for detailed build information | ||
| 2. Verify all required environment variables are set in Vercel | ||
| 3. Ensure your Vercel token has the correct permissions | ||
| 4. Check that the Node.js version in the workflow matches your project requirements | ||
|
|
||
| ## Manual Deployment | ||
|
|
||
| You can also trigger a deployment manually: | ||
|
|
||
| 1. Go to your GitHub repository | ||
| 2. Navigate to Actions → "Deploy to Vercel" workflow | ||
| 3. Click "Run workflow" | ||
| 4. Select the branch you want to deploy | ||
| 5. Click "Run workflow" | ||
|
|
||
| This will start the deployment process without requiring a code push. | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| The GitHub Actions workflow is configured to deploy only on pushes to the main branch and manual triggers. This prevents unauthorized deployments from feature branches. | ||
|
|
||
| The Vercel token is stored securely in GitHub Secrets and is never exposed in logs or outputs. | ||
|
|
||
| ## Additional Resources | ||
|
|
||
| - [GitHub Actions Documentation](https://docs.github.com/en/actions) | ||
| - [Vercel CLI Documentation](https://vercel.com/docs/cli) | ||
| - [Next.js Deployment Documentation](https://nextjs.org/docs/deployment) |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| # Deploying BasedNet using GitHub Actions and Vercel | ||
|
|
||
| ## Overview | ||
|
|
||
| This document outlines an improved approach to deploying BasedNet to Vercel using GitHub Actions. This approach offers several advantages over direct deployment from a local machine: | ||
|
|
||
| 1. **Consistent Environment**: Builds happen in a clean Ubuntu environment, avoiding Windows-specific path issues | ||
| 2. **Automated Testing & Linting**: Tests and linting are run before each deployment | ||
| 3. **Automated Workflow**: Deployments are triggered automatically when you push to the main branch | ||
| 4. **Reproducible Builds**: Every build uses the same setup, reducing "works on my machine" problems | ||
| 5. **Version Control**: Deployment configuration is tracked in version control | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| Before using this deployment method, you'll need: | ||
|
|
||
| 1. A GitHub account with your BasedNet code pushed to a repository | ||
| 2. A Vercel account linked to your GitHub account | ||
| 3. A Vercel project created for BasedNet | ||
|
|
||
| ## Setup Instructions | ||
|
|
||
| ### 1. Generate a Vercel API Token | ||
|
|
||
| 1. Log in to your [Vercel dashboard](https://vercel.com/dashboard) | ||
| 2. Go to Settings → Tokens | ||
| 3. Create a new token with "Full Account" scope | ||
| 4. Copy the token value (you won't be able to see it again) | ||
|
|
||
| ### 2. Add Required Secrets to GitHub | ||
|
|
||
| 1. Go to your GitHub repository | ||
| 2. Navigate to Settings → Secrets and variables → Actions | ||
| 3. Add the following repository secrets: | ||
| - `VERCEL_TOKEN`: Your Vercel API token | ||
| - `DATABASE_URL`: Your PostgreSQL connection string | ||
| - `DB_PASSWORD`: Your database password | ||
|
|
||
| ### 3. Initial Setup on Vercel | ||
|
|
||
| 1. From the Vercel dashboard, click "Add New..." → "Project" | ||
| 2. Import your GitHub repository | ||
| 3. Configure your project settings: | ||
| - Framework Preset: Next.js | ||
| - Root Directory: ./ | ||
| - Build Command: npm run build | ||
| - Output Directory: .next | ||
| 4. Add all required environment variables from your `.env` file | ||
| 5. Link your local project to Vercel by running: | ||
| ``` | ||
| npm run setup:github | ||
| ``` | ||
|
|
||
| ### 4. Use GitHub Actions for Future Deployments | ||
|
|
||
| After the initial setup, all future deployments will happen automatically through GitHub Actions when you push to the main branch. | ||
|
|
||
| ## How It Works | ||
|
|
||
| The workflow file `.github/workflows/deploy.yml` defines the deployment process: | ||
|
|
||
| 1. **Testing Stage**: | ||
| - Sets up a PostgreSQL service for testing | ||
| - Runs your test suite against the test database | ||
| - Ensures all tests pass before proceeding | ||
|
|
||
| 2. **Linting Stage**: | ||
| - Checks your code for style and potential issues | ||
| - Ensures code quality before deployment | ||
|
|
||
| 3. **Deployment Stage**: | ||
| - Only runs if both test and lint stages pass | ||
| - Only runs for pushes to the main branch | ||
| - Checkout the code from GitHub | ||
| - Set up Node.js | ||
| - Install dependencies | ||
| - Install Vercel CLI | ||
| - Pull environment variables from Vercel | ||
| - Build the project | ||
| - Deploy to Vercel | ||
| - Run any required database migrations | ||
|
|
||
| ## Troubleshooting | ||
|
|
||
| If you encounter deployment issues: | ||
|
|
||
| 1. Check the GitHub Actions logs for detailed build information | ||
| 2. Verify all required environment variables are set in Vercel | ||
| 3. Ensure your Vercel token has the correct permissions | ||
| 4. Check that the Node.js version in the workflow matches your project requirements | ||
| 5. Look for test or linting errors that might be causing the deployment to fail | ||
|
|
||
| ## Manual Deployment | ||
|
|
||
| You can also trigger a deployment manually: | ||
|
|
||
| 1. Go to your GitHub repository | ||
| 2. Navigate to Actions → "Deploy Basednet" workflow | ||
| 3. Click "Run workflow" | ||
| 4. Select the branch you want to deploy | ||
| 5. Click "Run workflow" | ||
|
|
||
| This will start the deployment process without requiring a code push. | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| The GitHub Actions workflow is configured to deploy only on pushes to the main branch and manual triggers. This prevents unauthorized deployments from feature branches. | ||
|
|
||
| The Vercel token and database credentials are stored securely in GitHub Secrets and are never exposed in logs or outputs. | ||
|
|
||
| ## Additional Resources | ||
|
|
||
| - [GitHub Actions Documentation](https://docs.github.com/en/actions) | ||
| - [Vercel CLI Documentation](https://vercel.com/docs/cli) | ||
| - [Next.js Deployment Documentation](https://nextjs.org/docs/deployment) |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| { | ||
| "compilerOptions": { | ||
| "baseUrl": ".", | ||
| "paths": { | ||
| "@/*": ["src/*"] | ||
| } | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| /** @type {import('next').NextConfig} */ | ||
| const nextConfig = { | ||
| reactStrictMode: true, | ||
|
|
||
| env: { | ||
| NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET, | ||
| NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol', | ||
| }, | ||
|
Comment on lines
+5
to
+8
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security Risk: Exposing Secrets to Client-side Recommended Solution: // Remove NEXTAUTH_SECRET from the env object
env: {
NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol',
}, |
||
|
|
||
| // Optimize for Vercel deployment | ||
| output: 'standalone', // Creates a standalone build that's optimized for Vercel | ||
|
|
||
| experimental: { | ||
| // Enable modern features | ||
| serverComponentsExternalPackages: [], // For better handling of server components | ||
| optimizeCss: true, // For CSS optimization | ||
| }, | ||
|
|
||
| // Disable unnecessary source maps in production | ||
| productionBrowserSourceMaps: false, | ||
|
|
||
| // Improve build performance | ||
| swcMinify: true, | ||
|
|
||
| // Disable image optimization if not needed (reduces build time) | ||
| images: { | ||
| unoptimized: process.env.NODE_ENV === 'development', | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Performance Risk: Image Optimization Based on NODE_ENV Recommended Solution: |
||
| }, | ||
| }; | ||
|
|
||
| // Exporting the configuration without Sentry for now | ||
| module.exports = nextConfig; | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| /** @type {import('next').NextConfig} */ | ||
| const nextConfig = { | ||
| reactStrictMode: true, | ||
|
|
||
| env: { | ||
| NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET, | ||
| NEXTAUTH_URL: process.env.NEXTAUTH_URL || 'https://basednet.lol', | ||
| }, | ||
|
Comment on lines
+5
to
+8
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security Issue: Exposure of Sensitive Environment VariableThe Recommended Solution: |
||
|
|
||
| // Optimize for Vercel deployment | ||
| output: 'standalone', // Creates a standalone build that's optimized for Vercel | ||
|
|
||
| experimental: { | ||
| // Enable modern features | ||
| optimizeCss: true, // For CSS optimization | ||
| serverExternalPackages: [], // For better handling of server components | ||
| }, | ||
|
|
||
| // Disable unnecessary source maps in production | ||
| productionBrowserSourceMaps: false, | ||
|
|
||
| // Improve build performance | ||
|
|
||
| // Disable image optimization if not needed (reduces build time) | ||
| images: { | ||
| unoptimized: process.env.NODE_ENV === 'development', | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Logic Issue: Reliance on
|
||
| }, | ||
| }; | ||
|
|
||
| // Exporting the configuration without Sentry for now | ||
| module.exports = nextConfig; | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛑 Security Vulnerability: Database credentials are hardcoded and exposed. This creates a critical security risk allowing unauthorized database access1.
Footnotes
CWE-798: Use of Hard-coded Credentials - https://cwe.mitre.org/data/definitions/798.html ↩