mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Tomas DvorakandDevin
2d6135121e
Stress-test remediation across MCP, CLI, and backend:
- primora_vault_exec rewritten as an allow-list (was deny-list):
colon-form single-token commands bypassed it, leaking every vault
secret; verbatim env-name injection allowed NODE_OPTIONS=--require
host RCE. Now fixed read-mostly command set, arg/path deny regex,
strict env-name grammar, loader-hook name blocklist. All prior
bypasses verified denied; allowed commands still inject.
- SSRF: webhook/job URL validation now blocks cloud metadata IPs
(169.254.169.254, fd00:ec2::254) inside the link-local allowance
and non-canonical IP encodings (decimal/hex bare hosts) smuggled
as "docker service names".
- Path params encodeURIComponent in all client consumers — encodeURI
left ?#& intact, smuggling query segments through {name} params.
- primora_upload_object strict-validates contentBase64 — Buffer.from
silently dropped invalid chars.
- MCP no-creds startup degrades instead of crashing mid-handshake.
- GET /api/v1/context — API-key self-discovery; fixes the CLI dead
end (login --api-key validates the key + seeds org/project,
use/context/whoami work under key auth).
- CLI: unknown commands / bare group exit 1 with hints; mri numeric
coercion reversed via raw-argv restore (007 stays "007");
login --json; orgs:rm / projects:rm / buckets:rm behind --yes;
fetch-failed errors name the cause.
- Error hygiene: pgx.ErrNoRows -> 404, pgconn codes -> clean
400/409 without SQLSTATE leaks, validator failures formatted,
services.InputError maps input faults to 400 (webhook URL/event
errors were 500s), presign on local driver -> 400.
- Webhook events accept wildcard patterns (*, ns.*, custom.*)
matched via SQL LIKE — client-published events can be webhooked.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
84 lines
2.6 KiB
TypeScript
84 lines
2.6 KiB
TypeScript
import { ProjectsService } from "@primora/api-client";
|
|
|
|
import { loadConfig } from "../config.js";
|
|
import { configureClient, requireAuth, requireOrg } from "../http.js";
|
|
import { isJson, printJson, printTable, success } from "../out.js";
|
|
|
|
interface ListOptions {
|
|
org?: string;
|
|
q?: string;
|
|
json?: boolean;
|
|
}
|
|
|
|
export async function cmdProjectsList(options: ListOptions): Promise<void> {
|
|
const cfg = loadConfig();
|
|
requireAuth(cfg);
|
|
configureClient(cfg);
|
|
|
|
const organizationId = requireOrg(cfg, options.org);
|
|
const { items } = await ProjectsService.listProjects({
|
|
organizationId,
|
|
q: options.q || undefined,
|
|
});
|
|
if (isJson(options)) {
|
|
printJson(items);
|
|
return;
|
|
}
|
|
printTable(
|
|
["ID", "SLUG", "NAME", "ROLE"],
|
|
items.map((pr) => [pr.id, pr.slug, pr.name, pr.membership_role ?? "—"]),
|
|
);
|
|
}
|
|
|
|
export async function cmdProjectsCreate(
|
|
name: string,
|
|
options: { org?: string; slug?: string; description?: string; json?: boolean },
|
|
): Promise<void> {
|
|
const cfg = loadConfig();
|
|
requireAuth(cfg);
|
|
configureClient(cfg);
|
|
|
|
const organizationId = requireOrg(cfg, options.org);
|
|
const slug = options.slug ?? name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
|
|
const project = await ProjectsService.createProject({
|
|
organizationId,
|
|
requestBody: { name, slug, description: options.description },
|
|
});
|
|
if (isJson(options)) {
|
|
printJson(project);
|
|
return;
|
|
}
|
|
success(`Project "${project.name}" created (${project.slug})`);
|
|
}
|
|
|
|
export async function cmdProjectsRemove(
|
|
projectRef: string,
|
|
options: { org?: string; yes?: boolean; json?: boolean },
|
|
): Promise<void> {
|
|
const cfg = loadConfig();
|
|
requireAuth(cfg);
|
|
configureClient(cfg);
|
|
|
|
let projectId = projectRef;
|
|
if (!isUuid(projectRef)) {
|
|
const me = await PlatformService.getMe();
|
|
const orgs = cfg.auth?.type === "apiKey" ? [] : me.organizations;
|
|
const found = orgs
|
|
.flatMap((o) => o.projects.map((pr) => ({ ...pr, orgId: o.id })))
|
|
.find((pr) => pr.id === projectRef || pr.slug === projectRef || pr.name === projectRef);
|
|
if (!found) throw new Error(`Project "${projectRef}" not found — pass its id directly.`);
|
|
projectId = found.id;
|
|
}
|
|
await confirmOrAbort(`Delete project "${projectRef}"? Buckets, secrets, and functions go with it.`, options.yes);
|
|
await ProjectsService.deleteProject({ projectId });
|
|
if (isJson(options)) {
|
|
printJson({ deleted: projectId });
|
|
} else {
|
|
success(`deleted project ${projectRef}`);
|
|
}
|
|
}
|
|
|
|
function isUuid(v: string): boolean {
|
|
return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
|
|
}
|