Graham McIntie
1590f78bdc
- LIKE wildcard injection: sanitize %, _ in search queries (devices, sites, gaiia) - Jason.decode! → Jason.decode with error handling for untrusted input - inspect() leak: replace with generic error messages, log details server-side - SSRF protection: URL validator blocks private IPs, localhost, non-HTTP schemes - SSRF validation added to HTTP monitoring executor and integration credentials - GraphQL complexity limits: always applied, not just in prod - GraphQL introspection: also check GET query params, not just body - Stripe webhook: explicit nil/empty checks for signature and body - Cookie security: secure flag for session (prod), http_only+secure for remember_me - Honeybadger API key: read from env var with fallback - String.to_integer → Integer.parse with fallback for URL params - String.to_atom → whitelist map for HTTP methods - Gaiia webhook: remove secret_len and expected signature from log - Admin API: add rate limiting pipeline - to_atom_keys: per-key fallback instead of all-or-nothing rescue
98 lines
2.1 KiB
Bash
Executable file
98 lines
2.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# TowerOps development helper script
|
|
# Usage: ./tools/dev.sh <command> [args...]
|
|
set -e
|
|
|
|
export PATH="/nix/var/nix/profiles/default/bin:$PATH"
|
|
|
|
PROJ_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$PROJ_DIR"
|
|
|
|
NIX_CMD="nix develop .#default --command"
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
TowerOps Dev Helper
|
|
|
|
Usage: ./tools/dev.sh <command> [args...]
|
|
|
|
Commands:
|
|
compile Compile the project
|
|
test [path] Run tests (optionally for a specific path)
|
|
test-file <f> Run tests for a specific file
|
|
push [msg] Git add, commit, push to origin main
|
|
format Run mix format
|
|
routes Show Phoenix routes
|
|
migrate Run migrations (dev + test)
|
|
reset-db Reset the database
|
|
server Start services + Phoenix server
|
|
deps Fetch dependencies
|
|
EOF
|
|
exit 1
|
|
}
|
|
|
|
cmd_compile() {
|
|
$NIX_CMD mix compile "$@"
|
|
}
|
|
|
|
cmd_test() {
|
|
$NIX_CMD env -u DATABASE_URL MIX_ENV=test mix test "$@"
|
|
}
|
|
|
|
cmd_test_file() {
|
|
if [ -z "$1" ]; then
|
|
echo "Error: test-file requires a file path"
|
|
echo "Usage: ./tools/dev.sh test-file test/path/to/test.exs"
|
|
exit 1
|
|
fi
|
|
$NIX_CMD env -u DATABASE_URL MIX_ENV=test mix test "$1"
|
|
}
|
|
|
|
cmd_push() {
|
|
local msg="${1:-update}"
|
|
git add -A
|
|
git commit -m "$msg"
|
|
git push origin main
|
|
}
|
|
|
|
cmd_format() {
|
|
$NIX_CMD mix format "$@"
|
|
}
|
|
|
|
cmd_routes() {
|
|
$NIX_CMD mix phx.routes "$@"
|
|
}
|
|
|
|
cmd_migrate() {
|
|
echo "==> Migrating dev database..."
|
|
$NIX_CMD mix ecto.migrate
|
|
echo "==> Migrating test database..."
|
|
$NIX_CMD env -u DATABASE_URL MIX_ENV=test mix ecto.migrate
|
|
}
|
|
|
|
cmd_reset_db() {
|
|
$NIX_CMD mix ecto.reset "$@"
|
|
}
|
|
|
|
cmd_server() {
|
|
$NIX_CMD bash -c "start-services && mix phx.server"
|
|
}
|
|
|
|
cmd_deps() {
|
|
$NIX_CMD mix deps.get "$@"
|
|
}
|
|
|
|
# --- Main dispatch ---
|
|
case "${1:-}" in
|
|
compile) shift; cmd_compile "$@" ;;
|
|
test) shift; cmd_test "$@" ;;
|
|
test-file) shift; cmd_test_file "$@" ;;
|
|
push) shift; cmd_push "$@" ;;
|
|
format) shift; cmd_format "$@" ;;
|
|
routes) shift; cmd_routes "$@" ;;
|
|
migrate) shift; cmd_migrate "$@" ;;
|
|
reset-db) shift; cmd_reset_db "$@" ;;
|
|
server) shift; cmd_server "$@" ;;
|
|
deps) shift; cmd_deps "$@" ;;
|
|
*) usage ;;
|
|
esac
|