5 Commits

Author	SHA1	Message	Date
Gan, Jimmy	dac163d88c	security: fix critical vulnerabilities (issues #2 and #3) ... Issue #2: Unprotected Chat Summary Trigger (CRITICAL) - Add authentication and admin authorization to /trigger endpoint - Add path validation to prevent directory traversal - Block access to system directories (/etc, /root, /sys, /proc, /boot) - Add tests for unauthorized access and invalid paths Issue #3: Exception Information Disclosure (HIGH) - Replace raw exception messages with generic errors - Log full exception details server-side with logger.exception() - Affected files: auth.py, files.py, passkey.py, opc_agents.py - Prevents information leakage about system architecture Security Impact: - Prevents unauthenticated file system writes - Reduces reconnaissance opportunities for attackers - Maintains security while preserving debugging capability Tests: 214 passing, all security tests verified	2026-04-08 00:57:14 +08:00
Gan, Jimmy	b981c06d59	feat: comprehensive test infrastructure improvements ... - Fix unit test imports: add env setup in conftest.py before module imports - Add 24 new auth router tests (RBAC, preferences, password validation) - Add 16 new tests for litellm and chat_summary routers - Apply black formatting and ruff linting across codebase - Add pre-commit hooks configuration (black, ruff, file checks) - Increase CI coverage threshold from 40% to 50% Test Results: - 206 tests passing (91 unit + 115 integration) - Coverage: 58.79% on core modules - auth.py: 57% → 85%, litellm.py: 23% → 87%, chat_summary.py: 41% → 100% - auth_service: 96.51%, config: 100%, rbac: 93.48%	2026-04-08 00:21:32 +08:00
Gan, Jimmy	5da2ae01a0	fix: complete OPC system implementation ... - Add database connection retry logic (3 attempts, 5s delay) - Add missing database functions: get_task_by_id, get_agent_execution, approve_agent_execution, update_agent_config, update_execution_status - Complete agent execution approval workflow - Fix agent executor to handle approved executions - Fix inefficient task queries (use direct ID lookup) - Add error action handling in agent executor - Improve LiteLLM error handling with specific exception types - Reduce LiteLLM timeout from 60s to 30s - Fix execution status update to only set started_at once - Consolidate WebSocket datetime serialization with helper function - Implement update agent endpoint	2026-04-03 22:30:51 +08:00
Gan, Jimmy	6cffc1f9ff	fix: update OPC routers to use request.state.user instead of Depends(_inject_user)	2026-04-02 00:45:26 +08:00
Gan, Jimmy	1ca019fa48	feat: add OPC (One Person Company) management system with Kanban board ... Phase 1 MVP implementation: - PostgreSQL database schema for tasks, agents, executions, time tracking - Backend API: task CRUD, agent management, automatic time tracking - Frontend: Kanban board with drag-and-drop (Parking Lot → In Progress → Done) - Task modal for creating/editing tasks with tags, priority, assignee - 3 core agents seeded: PM, CTO, COO - Agent approval workflow: CxO level requires approval, others auto-execute - Automatic time tracking: starts on in_progress, stops on done - RBAC integration: OPC page accessible to admin/member roles Features: - Drag-and-drop tasks between columns - Assign tasks to humans or AI agents - Priority badges (low, medium, high, urgent) - Tags and due dates - Task history tracking - Time entry tracking with automatic timer - Agent execution records with approval workflow Next steps: - Initialize OPC database on NAS - Implement agent executor service - Add WebSocket for real-time updates - Add email notifications - Add PDF invoice generation	2026-03-31 14:31:31 +08:00