2 Commits

Include renames

Author	SHA1	Message	Date
Lauri Ojansivu	1d82ef8eae	Security/speed/tests logging: store in the existing WeKan DB (no new files). ... Per correction: use only the existing WeKan database via Meteor JavaScript queries (works on FerretDB and MongoDB); do not create files/DBs under WRITABLE_PATH; and have FerretDB report problems to WeKan rather than writing itself. - models/eventLog.js: one `eventlog` collection (stream: security|speed|tests). - server/lib/{securityLog,speedLog,testLog}.js: thin wrappers that insert one document via EventLog.insertAsync (fire-and-forget, never throw). - models/lib/securityLogFormat.js slimmed to just sanitizeDetail; remove the node:sqlite event store (server/lib/eventStore.js) and all file/path/schema helpers. - Add a Tests stream: log anything that would fail an existing WeKan test. - Design docs (WeKan.md, FerretDB.md) rewritten: DB-collection storage, grouped counts for the summary, Admin Reports read the collection, and FerretDB reports problems to WeKan which records them (no FerretDB DB/file writes). - tests/securityLog.test.cjs updated (sanitizer + catalog + collection wiring + no-filesystem guards); verified via Python mirror.	2026-07-19 13:12:59 +03:00
Lauri Ojansivu	9f07aa4506	Security/speed logging: foundation loggers + first upload/avatar/SSRF wiring. ... Implements the core of docs/Security/Remediation/WeKan.md: - models/lib/securityLogFormat.js: pure, unit-testable helpers (dated run-dir path, disk-space guard, one-line format, parse, per-category/Bleed/severity tally, summary render). - models/lib/securityCategories.js: general-category <-> hall-of-fame *Bleed catalog (RedirectBleed, LiveBleed, SourceBleed, MetricsBleed, InviteBleed, ...). - server/lib/securityLog.js + speedLog.js: best-effort, never-throwing writers to WRITABLE_PATH/files/security|speed/YYYY-MM/DD/HH_MM_SS/ (wekan-log.txt + wekan-summary.txt / wekan-speed-*), with a disk-space check before every write and a dropped-events counter. - Wire first remediation/rejection points to emit events: avatar-URL scheme rejection (setAvatarUrl), Trello live-import attachment SSRF block, and avatar localization SSRF block (covers the requested attachment/avatar rejection + sanitization logging). - tests/securityLog.test.cjs (unit + negative tests), wired into test:unit:node. Admin Panel Reports (Security/Speed UI), the FerretDB Go logger, and full guard coverage are the next phase (fully specified in the design docs).	2026-07-19 12:45:03 +03:00