Untone 05c188df62
Some checks failed
Deploy on push / deploy (push) Failing after 39s
[0.9.29] - 2025-09-26
### 🚨 CRITICAL Security Fixes
- **🔒 Open Redirect Protection**: Добавлена строгая валидация redirect_uri против whitelist доменов
- **🔒 Rate Limiting**: Защита OAuth endpoints от брутфорса (10 попыток за 5 минут на IP)
- **🔒 Logout Endpoint**: Критически важный endpoint для безопасного отзыва httpOnly cookies
- **🔒 Provider Validation**: Усиленная валидация OAuth провайдеров с логированием атак
- **🚨 GlitchTip Alerts**: Автоматические алерты безопасности в GlitchTip при критических событиях

### 🛡️ Security Modules
- **auth/oauth_security.py**: Модуль безопасности OAuth с валидацией и rate limiting + GlitchTip алерты
- **auth/logout.py**: Безопасный logout с поддержкой JSON API и browser redirect
- **tests/test_oauth_security.py**: Комплексные тесты безопасности (11 тестов)
- **tests/test_oauth_glitchtip_alerts.py**: Тесты интеграции с GlitchTip (8 тестов)

### 🔧 OAuth Improvements
- **Minimal Flow**: Упрощен до минимума - только httpOnly cookie, нет JWT в URL
- **Simple Logic**: Нет error параметра = успех, максимальная простота
- **DRY Refactoring**: Устранено дублирование кода в logout и валидации

### 🎯 OAuth Endpoints
- **Старт**: `v3.dscrs.site/oauth/{provider}` - с rate limiting и валидацией
- **Callback**: `v3.dscrs.site/oauth/{provider}/callback` - безопасный redirect_uri
- **Logout**: `v3.dscrs.site/auth/logout` - отзыв httpOnly cookies
- **Финализация**: `testing.discours.io/oauth?redirect_url=...` - минимальная схема

### 📊 Security Test Coverage
-  Open redirect attack prevention
-  Rate limiting protection
-  Provider validation
-  Safe fallback mechanisms
-  Cookie security (httpOnly + Secure + SameSite)
-  GlitchTip integration (8 тестов алертов)

### 📝 Documentation
- Создан `docs/oauth-minimal-flow.md` - полное описание минимального flow
- Обновлена документация OAuth в `docs/auth/oauth.md`
- Добавлены security best practices
2025-09-26 21:03:45 +03:00
2025-09-26 21:03:45 +03:00
2025-09-03 13:01:38 +03:00
2025-09-26 21:03:45 +03:00
2025-08-30 22:20:58 +03:00
2025-09-26 21:03:45 +03:00
2025-09-01 16:29:50 +03:00
2025-09-16 11:49:24 +03:00
2025-09-16 12:52:14 +03:00
2025-09-16 12:52:14 +03:00
2025-08-31 22:42:21 +03:00
2025-09-26 21:03:45 +03:00
2025-09-10 12:39:00 +03:00
2025-09-21 14:23:53 +03:00
2025-09-26 21:03:45 +03:00
2025-09-25 08:48:36 +03:00
2025-07-31 18:55:59 +03:00
..
2024-11-14 14:00:33 +03:00
2025-09-10 11:16:53 +03:00
2025-09-25 09:40:12 +03:00
2024-02-21 23:12:47 +03:00
2025-09-16 11:49:24 +03:00
2025-09-26 21:03:45 +03:00
2025-09-10 11:59:09 +03:00
2025-07-02 22:30:21 +03:00
2025-08-17 16:33:54 +03:00
2025-09-16 12:43:46 +03:00
2025-07-02 22:30:21 +03:00
2025-06-19 11:28:48 +03:00
2025-09-24 13:35:49 +03:00
2025-09-16 11:59:57 +03:00
2025-09-25 08:52:55 +03:00
2025-09-26 21:03:45 +03:00
2025-09-25 08:48:36 +03:00
2025-08-17 17:56:31 +03:00
2025-09-01 15:09:36 +03:00
2025-09-22 23:56:04 +03:00
2025-07-02 22:30:21 +03:00
2025-09-25 09:40:12 +03:00
2025-07-25 12:26:31 +03:00

Discours.io Core

🚀 Modern community platform with GraphQL API, RBAC system, and comprehensive testing infrastructure.

🎯 Features

  • 🔐 Authentication: JWT + OAuth (Google, GitHub, Facebook)
  • 🏘️ Communities: Full community management with roles and permissions
  • 🔒 RBAC System: Role-based access control with inheritance
  • 🌐 GraphQL API: Modern API with comprehensive schema
  • 🧪 Testing: Complete test suite with E2E automation
  • 🚀 CI/CD: Automated testing and deployment pipeline

🚀 Quick Start

Prerequisites

  • Python 3.11+
  • Node.js 18+
  • Redis
  • uv (Python package manager)

Installation

# Clone repository
git clone <repository-url>
cd core

# Install Python dependencies
uv sync --group dev

# Install Node.js dependencies
cd panel
npm ci
cd ..

# Setup environment
cp .env.example .env
# Edit .env with your configuration

Development

# Start backend server
uv run python dev.py

# Start frontend (in another terminal)
cd panel
npm run dev

🧪 Testing

Run All Tests

uv run pytest tests/ -v

Test Categories

Run only unit tests

uv run pytest tests/ -m "not e2e" -v

Run only integration tests

uv run pytest tests/ -m "integration" -v

Run only e2e tests

uv run pytest tests/ -m "e2e" -v

Run browser tests

uv run pytest tests/ -m "browser" -v

Run API tests

uv run pytest tests/ -m "api" -v

Skip slow tests

uv run pytest tests/ -m "not slow" -v

Run tests with specific markers

uv run pytest tests/ -m "db and not slow" -v

Test Markers

  • unit - Unit tests (fast)
  • integration - Integration tests
  • e2e - End-to-end tests
  • browser - Browser automation tests
  • api - API-based tests
  • db - Database tests
  • redis - Redis tests
  • auth - Authentication tests
  • slow - Slow tests (can be skipped)

E2E Testing

E2E tests automatically start backend and frontend servers:

  • Backend: http://localhost:8000
  • Frontend: http://localhost:3000

🚀 CI/CD Pipeline

GitHub Actions Workflow

The project includes a comprehensive CI/CD pipeline that:

  1. 🧪 Testing Phase

    • Matrix testing across Python 3.11, 3.12, 3.13
    • Unit, integration, and E2E tests
    • Code coverage reporting
    • Linting and type checking
  2. 🚀 Deployment Phase

    • Staging: Automatic deployment on dev branch
    • Production: Automatic deployment on main branch
    • Dokku integration for seamless deployments

Local CI Testing

Test the CI pipeline locally:

# Run local CI simulation
chmod +x scripts/test-ci-local.sh
./scripts/test-ci-local.sh

CI Server Management

The ./ci-server.py script manages servers for CI:

# Start servers in CI mode
CI_MODE=true python3 ./ci-server.py

📊 Project Structure

core/
├── auth/           # Authentication system
├── orm/            # Database models
├── resolvers/      # GraphQL resolvers
├── services/       # Business logic
├── panel/          # Frontend (SolidJS)
├── tests/          # Test suite
├── scripts/        # CI/CD scripts
└── docs/           # Documentation

🔧 Configuration

Environment Variables

  • DATABASE_URL - Database connection string
  • REDIS_URL - Redis connection string
  • JWT_SECRET - JWT signing secret
  • OAUTH_* - OAuth provider credentials

Database

  • Development: SQLite (default)
  • Production: PostgreSQL
  • Testing: In-memory SQLite

📚 Documentation

🤝 Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Add tests for new functionality
  5. Ensure all tests pass
  6. Submit a pull request

Development Workflow

# Create feature branch
git checkout -b feature/your-feature

# Make changes and test
uv run pytest tests/ -v

# Commit changes
git commit -m "feat: add your feature"

# Push and create PR
git push origin feature/your-feature

📈 Status

Tests Coverage Python Node.js

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

Description
ядро платформы
Readme MIT 12 MiB
Languages
Python 74.6%
TypeScript 19.2%
CSS 6.1%