Tomas Dvorak and Devin
55edbf8b56
feat: phase 6 production hardening + DB-to-DB transfer
...
Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
auth middleware; scope picker + badges in Settings UI; scopeless legacy
keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY
Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
(migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)
Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
(429s = configured rate limiter working)
Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.
Authored By: TDvorak <[email protected] https://devin.ai )
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-17 09:15:42 +02:00
Tomas Dvorak
deb56d9a23
feat: phase 5 distribution — tauri shell, pwa, desktop release artifacts
...
- apps/desktop: Tauri 2 thin shell; connect screen stores the deployment
URL, webview renders the remote console, tray with Show/Change Server/
Quit, close-to-tray, single-instance
- frontend: vite-plugin-pwa generates manifest + Workbox SW (shell
precache, /api /auth /mailpit NetworkOnly), install banner on
beforeinstallprompt, rasterized PWA icons
- release.yml: desktop bundle matrix (linux/macos/windows) attached to
GitHub Releases
- workspace 0.5.0; Dockerfiles copy the desktop workspace manifest
Authored By: TDvorak <[email protected]
2026-09-16 19:59:53 +02:00
Tomas Dvorak
e25eb92339
feat: phase 4 integrations — connectors, rybbit analytics, webhooks
...
- core.integrations (migration 00005) with AES-256-GCM-encrypted
credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
/api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
POST …/deploy-markers. Events: issue.created (new fingerprint on
ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
over the raw body; in-process dispatcher, 3 attempts, quadratic
backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0
Authored By: TDvorak <[email protected]
2026-09-16 18:47:31 +02:00
Tomas Dvorak
627bd89d5e
feat: phase 2 databases via DBX (v0.3.0)
...
- dbx-mcp persistent stdio subprocess in Go backend (internal/dbx),
lazy start + single retry, tool failures surface as 502
- core.db_connections registry: per-project connections, credentials
server-side only, managed entries protected (409)
- platform-postgres + platform-dragonfly auto-register per project
- REST proxy: list/create/delete/test, databases, tables, describe,
schema context, SQL query, redis command
- Databases page: connection list, schema/table browser, column
inspector, SQL editor with result grid + row detail, redis console
- backend image moved to debian-slim for glibc; pinned dbx release
with SHA256 verification
Authored By: TDvorak <[email protected]
2026-09-16 14:54:33 +02:00
Tomas Dvorak and Devin
420502eec1
feat: ship phase 1 surface area (v0.2.0)
...
- primora CLI + @primora/mcp server over generated client
- auth users admin panel, mobile bottom nav
- release workflow: GHCR images, compiled binaries, npm tarballs
- fix gzip Content-Length truncation, nginx upstream re-resolution
Authored By: TDvorak <[email protected] https://devin.ai )
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-16 14:04:43 +02:00
Tomas Dvorak
7ddfb1f52b
initiall commit
2026-04-10 12:03:31 +02:00
