serfowiandClaude Opus 5
66dd4ac942
Stands up packages/api so the swipe path stops trusting its caller, and puts the auth library behind an interface we own. - packages/api: tRPC v11 with a Session type WE define, not one re-exported from an auth library. Swapping providers means rewriting one SessionResolver, not touching a router. - Procedure layers: public / protected / client / pro / verifiedPro / admin. Admin routes 404 rather than 403 so they cannot be probed. - deck router replaces the untrusted server action. Ownership is checked on every operation and returns NOT_FOUND, never FORBIDDEN, so job ids cannot be enumerated. 23 tests, mostly authorization. - packages/storage: presigned direct-to-R2 uploads. The server picks the key, so a caller can only write under their own user id. 14 tests. Three defects found and fixed: - The lazy db Proxy failed drizzle's is(db, PgDatabase) because it did not trap getPrototypeOf. Auth adapters dispatch on exactly that check, so this would have failed at runtime inside third-party code. Fixed and pinned with a regression test. - The open-request cap was a read-then-write race: concurrent swipes could both read 4 and both insert. Now one transaction with the job row locked. The cap is checked before the tombstone is written, so a rejected swipe leaves no trace and the card stays on the deck. - superjson was configured in two of the three required places. Without the QueryClient dehydrate/hydrate pair, RSC-prefetched data arrives as a raw envelope with no type error to warn you. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
45 lines
1.1 KiB
JSON
45 lines
1.1 KiB
JSON
{
|
|
"name": "@linkder/web",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "next dev --port 3000",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint .",
|
|
"typecheck": "tsc --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@linkder/db": "workspace:*",
|
|
"@linkder/shared": "workspace:*",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"drizzle-orm": "0.38.4",
|
|
"lucide-react": "^0.469.0",
|
|
"motion": "^11.15.0",
|
|
"next": "^15.1.4",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"tailwind-merge": "^2.6.0",
|
|
"@linkder/api": "workspace:*",
|
|
"@linkder/storage": "workspace:*",
|
|
"@trpc/server": "^11.18.0",
|
|
"@trpc/client": "^11.18.0",
|
|
"@trpc/react-query": "^11.18.0",
|
|
"@tanstack/react-query": "^5.62.0",
|
|
"superjson": "^2.2.6"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "3.2.0",
|
|
"@tailwindcss/postcss": "^4.0.0",
|
|
"@types/react": "^19.0.7",
|
|
"@types/react-dom": "^19.0.3",
|
|
"dotenv": "16.4.7",
|
|
"eslint": "^9.18.0",
|
|
"eslint-config-next": "^15.1.4",
|
|
"tailwindcss": "^4.0.0",
|
|
"typescript": "^5.7.3"
|
|
}
|
|
}
|