Clintchiz and Claude Opus 5
b209936f86
docs: design for the authz permissions system
...
Separates declaration (what permissions, roles, policies and attributes exist)
from assignment (who holds what), building on the decision primitives already
in advanced.ts rather than replacing them.
Covers the registry and app/authz discovery, the PermissionStore interface
with memory and db adapters, tenant-scoped assignments meeting the existing
TenantMembership, deny-wins precedence, fail-closed behaviour, the audit sink,
codegen and CLI introspection, and the seam for propagating subject context to
the inter-app communication system.
Records two decisions worth keeping: cross-app sharing needs no runtime
catalog distribution (declarations are static code in the shared package;
only assignments are shared, via the database), and can() stays off Context
to avoid a core -> authz dependency cycle.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-08-04 15:57:22 +05:30
Clintchiz and Claude Opus 5
c64434a131
fix(security): close SSRF, credential-leak, and auth bypass findings in 0.8.4
...
Audit of 0.8.4 found the repo's own gates green, so these came from manual
review; each is covered by a new regression test.
security/fetch.ts
- safeFetch re-attached Authorization/Cookie on a same-origin redirect that
followed a cross-origin hop (a -> b -> b), handing credentials to the second
host. Compare against the origin the caller trusted, not the previous hop.
- The private-network guard resolved the host, approved it, then let fetch
resolve again, so a low-TTL record could answer public for the check and
private for the connection. Pin the connection to the validated address,
preserving Host and TLS serverName. Opt out with pinDns: false.
- 0:0:0:0:0:ffff:127.0.0.1, ::ffff:7f00:1 and fec0::1 were not treated as
private. Add uncompressed IPv4-mapped forms, site-local IPv6, 198.18/15
and 192.0.0/24.
security/url.ts
- sanitizeUrl returned "//evil.com" verbatim via the relative-path fast path,
bypassing the host checks it had just run; in an href that navigates
cross-origin. Resolve protocol-relative input instead.
dev-server/gateway.ts
- Malformed base64 in an Authorization header threw out of checkAuth on an
unauthenticated path. Fail closed.
- split(":", 2) truncated passwords at the first colon, so a password
containing ":" could never authenticate.
- The credential compare short-circuited on length mismatch, leaking length
by timing. Extracted as verifyBasicAuth so it is testable.
authz/index.ts
- Namespace wildcards only matched the first segment, so "post:comment:*"
did not grant "post:comment:delete". Match at every depth.
uploader/operations.ts
- Validate transcoder dimensions and bitrate rather than trusting the declared
type, and reject ".." path segments.
package.json
- The brace-expansion override pinned 5.0.8, which is inside the advisory
range >=4.0.0 <5.0.9. Bump to 5.0.9; bun audit is now clean.
Verified: check:production passes (typecheck, lint, 1033 tests, format,
ASVS, public-API baseline, editor checks).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-08-04 15:57:22 +05:30
Clintchiz
72e4d3eceb
release: WRNexusJS 0.8.0
Quality / quality (ubuntu-latest) (push) Failing after 12m19s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-04 12:19:09 +05:30
Clintchiz
4cebacadfe
release: WRNexusJS 0.8.3
Quality / quality (ubuntu-latest) (push) Failing after 12m9s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 19:47:30 +05:30
Clintchiz
e8f630f12d
fix: format generated docs before release verification
Quality / quality (ubuntu-latest) (push) Failing after 21s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 02:32:11 +05:30
Clintchiz
4550a11460
release: WRNexusJS 0.8.2
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 02:14:54 +05:30
Clintchiz
3c6b659f36
release: WRNexusJS 0.8.1
Quality / quality (ubuntu-latest) (push) Failing after 13m28s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:34:56 +05:30
Clintchiz
1a1d2e9d08
perf: accelerate production request hot paths
Quality / quality (ubuntu-latest) (push) Failing after 12m23s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:08:43 +05:30
Clintchiz
fed1d5d3f4
perf: omit unused UI CSS and minify final bundles
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:03:33 +05:30
Clintchiz
b61020babd
fix: update PWA workers without reloading pages
Quality / quality (ubuntu-latest) (push) Failing after 12m52s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:54:29 +05:30
Clintchiz
379f80cbd0
fix: force PWA worker updates
Quality / quality (ubuntu-latest) (push) Failing after 12m26s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:46:52 +05:30
Clintchiz
649e3d9127
fix: constrain PWA caching and extend font CSP
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:38:23 +05:30
Clintchiz
b3e9b99e13
fix: harden generated identifiers and types
Quality / quality (ubuntu-latest) (push) Failing after 12m50s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:02:37 +05:30
Clintchiz
586a6db8ff
release: WRNexusJS 0.8.0
Quality / quality (ubuntu-latest) (push) Failing after 21s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-02 23:18:51 +05:30
Clintchiz
87507edf59
release: WRNexusJS 0.7.0
2026-08-01 10:04:42 +05:30
Clintchiz
c54144f2e4
fix(release): format generated UI references before verification
2026-08-01 07:14:45 +05:30
Clintchiz
2b06b00d35
fix(release): format generated UI references before verification
2026-08-01 07:14:16 +05:30
Clintchiz
28d931dfff
docs(ui): refresh component reference
2026-08-01 07:11:54 +05:30
Clintchiz
e2f7bea299
fix(release): stabilize generated UI references
2026-08-01 07:02:22 +05:30
Clintchiz
d5e834bc78
release: WRNexusJS 0.6.0
2026-08-01 06:50:37 +05:30
Clintchiz
687d345882
release: WRNexusJS 0.6.0
2026-08-01 01:09:58 +05:30
Clintchiz
3e565e8d03
Pre Release New Changes
2026-07-31 16:30:13 +05:30
Clintchiz
358a520bc5
release: WRNexusJS 0.5.14
2026-07-30 21:29:25 +05:30
Clintchiz
9dffe83f32
release: WRNexusJS 0.5.13
2026-07-30 20:46:47 +05:30
Clintchiz
d64e899993
release: WRNexusJS 0.5.12
2026-07-30 18:59:01 +05:30
Clintchiz
f37303b22d
release: WRNexusJS 0.5.11
2026-07-30 15:03:52 +05:30
Clintchiz
d1b0c55b53
release: WRNexusJS 0.5.10
2026-07-30 13:36:29 +05:30
Clintchiz
8fc6f15402
feat(wrn): support native structured prop expressions
2026-07-29 16:46:18 +05:30
Clintchiz
6afe32f63f
release: WRNexusJS 0.5.0
2026-07-29 12:51:10 +05:30
Clintchiz
76c768099d
release: WRNexusJS 0.4.0
2026-07-27 12:54:43 +05:30
Clintchiz
30e5721e84
release: WRNexusJS 0.4.0
2026-07-27 12:42:18 +05:30
Clintchiz
8b728a3e5d
New Captcha Package added
2026-07-25 13:38:18 +05:30
Clintchiz
d0aded0392
release: WRNexusJS 0.3.6
2026-07-24 15:30:48 +05:30
Clintchiz
c81dedff17
release: WRNexusJS 0.3.5
2026-07-24 12:46:44 +05:30
Clintchiz
44ba847210
release: WRNexusJS 0.3.4
2026-07-22 21:48:39 +05:30
Clintchiz
798f06d4c0
release: WRNexusJS 0.3.4
2026-07-22 21:44:57 +05:30
Clintchiz
173e230d7f
release: WRNexusJS 0.3.4
2026-07-22 21:40:38 +05:30
Clintchiz
bbec4cc7bb
docs(ui): refresh component reference
2026-07-22 21:38:20 +05:30
Clintchiz
504bd4358f
release: WRNexusJS 0.3.4
2026-07-22 21:37:23 +05:30
Clintchiz
e543fd026d
release: WRNexusJS 0.3.4
2026-07-22 21:30:37 +05:30
Clintchiz
d51662826d
release: WRNexusJS 0.3.4
2026-07-22 21:25:53 +05:30
Clintchiz
e2d9ea1ece
release: WRNexusJS 0.3.3
2026-07-22 20:37:59 +05:30
Clintchiz
58ba2f2046
release: WRNexusJS 0.3.2
2026-07-22 20:10:44 +05:30
Clintchiz
304819dfe9
release: WRNexusJS 0.3.1
2026-07-22 18:42:20 +05:30
Clintchiz
07d8fb59d6
release: WRNexusJS 0.3.0
2026-07-22 17:29:08 +05:30
Clintchiz
13dfa31d19
release: WRNexusJS 0.2.79
2026-07-22 12:56:07 +05:30
Clintchiz
c6fc0f1f63
release: WRNexusJS 0.2.78
2026-07-22 01:53:18 +05:30
Clintchiz
7ff5b3e8c5
release: WRNexusJS 0.2.77
2026-07-22 01:26:10 +05:30
Clintchiz
569365143b
release: WRNexusJS 0.2.76
2026-07-21 13:09:09 +05:30
Clintchiz
69b6cd431f
release: WRNexusJS 0.2.75
2026-07-21 12:30:46 +05:30
Clintchiz
2ca2d02b22
feat: support WRN imports and dynamic public shell
2026-07-21 11:15:06 +05:30
Clintchiz
0013c0771d
chore(release): prepare WRNexusJS 0.2.73
2026-07-20 16:34:20 +05:30
Clintchiz
0b8856b3b5
chore(release): prepare WRNexusJS 0.2.72
2026-07-20 16:15:03 +05:30
Clintchiz
45e6fd3cb9
fix(dev-server): invalidate WRN cache by content
2026-07-20 16:07:38 +05:30
Clintchiz
54f5309fca
fix(ui): render polished SSR-safe component variants
2026-07-20 15:55:38 +05:30
Clintchiz
944f83d3f4
fix: use public origins for SSO redirects
2026-07-20 15:04:20 +05:30
Clintchiz
a75779fa4d
fix: pin production runtime in applications
2026-07-20 14:45:56 +05:30
Clintchiz
2b4083c6db
fix: surface app errors in gateway logs
2026-07-20 14:26:27 +05:30
Clintchiz
aa2595ec01
fix: log production request failures
2026-07-20 13:48:47 +05:30
Clintchiz
b3e5e5b999
feat: configure workspace environment runtimes
2026-07-20 09:22:26 +05:30
Clintchiz
3888453e0d
build: stage private packages for 0.2.66
2026-07-20 00:10:16 +05:30
Clintchiz
b95bdc6e77
release: prepare WRNexusJS 0.2.66
2026-07-20 00:10:04 +05:30
Clintchiz
1745d8d676
feat: add reusable public chrome and named environments
2026-07-20 00:03:35 +05:30
Clintchiz
f72aec7c8c
feat(ui): add professional visual fallbacks
2026-07-19 23:09:56 +05:30
Clintchiz
33730c68ab
fix(gateway): keep production app ports private
2026-07-19 22:24:28 +05:30
Clintchiz
5ce45b4973
feat(cli): add production workspace command
2026-07-19 21:57:55 +05:30
Clintchiz
dcdb5e766d
fix(ui): polish linked catalog cards
2026-07-19 21:29:25 +05:30
Clintchiz
a3e21163c1
feat(ui): expose app theme contract and public components
2026-07-19 20:23:20 +05:30
Clintchiz
c5326f7622
fix: normalize component boundary spacing
2026-07-19 20:08:14 +05:30
Clintchiz
eaea2c5f72
fix: keep page shells transparent
2026-07-19 19:52:14 +05:30
Clintchiz
ca8f746f41
chore: ignore packaged VS Code extensions
2026-07-19 18:58:31 +05:30
Clintchiz
94ae40d8bd
feat: add typed WRN declarations
2026-07-19 18:44:27 +05:30
Clintchiz
0d3ec79ee4
release: complete UI component catalog 0.2.58
2026-07-19 18:14:06 +05:30
Clintchiz
c0c09426ff
release: WRNexusJS 0.2.57
2026-07-19 17:45:13 +05:30
Clintchiz
14e2878417
fix: tolerate autocrlf publish staging
2026-07-19 17:29:03 +05:30
Clintchiz
180239ef4c
release: WRNexusJS 0.2.56
2026-07-19 17:25:37 +05:30
Clintchiz
12beb6f4ba
release: WRNexusJS 0.2.55
2026-07-19 17:14:12 +05:30
Clintchiz
6dbc75c370
release: WRNexusJS 0.2.54
2026-07-19 15:51:27 +05:30
Clintchiz
7cee13526e
release: WRNexusJS 0.2.53
2026-07-19 14:40:06 +05:30
Clintchiz
3bb096057e
release: WRNexusJS 0.2.52
2026-07-19 14:23:10 +05:30
Clintchiz
646d16f83d
fix(vscode): repair WRN language diagnostics and activation
2026-07-19 14:02:17 +05:30
Clintchiz
df4c1d3e7d
release: WRNexusJS 0.2.51
2026-07-19 13:38:23 +05:30
Clintchiz
17dc7c1a06
release: WRNexusJS 0.2.50
2026-07-19 13:08:49 +05:30
Clintchiz
c72cbbd780
release: WRNexusJS 0.2.49
2026-07-19 12:29:13 +05:30
Clintchiz
1cda2a01b3
release: WRNexusJS 0.2.49
2026-07-19 12:03:49 +05:30
Clintchiz
9ca1cc6b0f
release: WRNexusJS 0.2.49
2026-07-18 19:33:57 +05:30
Clintchiz
aa6badbd31
release: WRNexusJS 0.2.48
2026-07-18 19:11:00 +05:30
Clintchiz
4a3ee3baa7
release: WRNexusJS 0.2.48
2026-07-18 19:07:23 +05:30
Clintchiz
95ca1c0625
New UI Components
2026-07-18 16:00:13 +05:30
Clintchiz
d22824fa62
release: WRNexusJS 0.2.47
2026-07-18 13:12:16 +05:30
Clintchiz
973d580bc5
release: WRNexusJS 0.2.46
2026-07-15 20:09:47 +05:30
Clintchiz
8a8328a308
release: WRNexusJS 0.2.44
2026-07-15 19:41:42 +05:30
Clintchiz
0f915c3c98
release: WRNexusJS 0.2.44
2026-07-15 18:54:29 +05:30
Clintchiz
9aa13fb4db
release: WRNexusJS 0.2.43
2026-07-15 18:41:55 +05:30
Clintchiz
9070a1ef9c
release: WRNexusJS 0.2.42
2026-07-15 18:15:22 +05:30
Clintchiz
4230de7065
release: WRNexusJS 0.2.41
2026-07-15 14:52:56 +05:30
Clintchiz
0006aef2c4
release: WRNexusJS 0.2.40
2026-07-15 14:02:27 +05:30
Clintchiz
7dfca4a190
release: WRNexusJS 0.2.40
2026-07-15 13:42:18 +05:30
Clintchiz
29bbeefe92
release: WRNexusJS 0.2.39
2026-07-15 13:22:20 +05:30
Clintchiz
98445c2ec7
release: WRNexusJS 0.2.38
2026-07-15 10:26:24 +05:30
ClintchizandClaude Opus 5