Skip to content

v1.0.2 — Security Hardening, Architecture & UX Polish #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
diegosouzapw merged 7 commits into from
Feb 18, 2026
Merged

v1.0.2 — Security Hardening, Architecture & UX Polish #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
400f773
feat: Implement graceful shutdown and body size guard middleware, and…
diegosouzapw Feb 18, 2026
c526485
feat: Implement initial database schema and centralize CORS configura…
diegosouzapw Feb 18, 2026
185dff8
feat(phase2+3): DI container, plugins, PII sanitizer, tool policy, au…
diegosouzapw Feb 18, 2026
c3f66a7
feat(phase4): focus indicators, session management, k6 load tests, re…
diegosouzapw Feb 18, 2026
7ca293f
fix(ui): correct Quick Start API key link to /dashboard/endpoint
diegosouzapw Feb 18, 2026
92714dc
chore: bump version to 1.0.2
diegosouzapw Feb 18, 2026
18acfe1
fix(ci): register @typescript-eslint plugin in ESLint flat config
diegosouzapw Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ jobs:
- name: Dependency audit
run: npm audit --audit-level=high --omit=dev
- name: Check for known vulnerabilities
run: npx is-my-node-vulnerable || true
run: npx is-my-node-vulnerable
continue-on-error: true

build:
name: Build
Expand Down
45 changes: 45 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

---

## [1.0.2] — 2026-02-18

@gemini-code-assist gemini-code-assist Bot Feb 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The versioning in the changelog seems a bit confusing. According to Keep a Changelog standards, versions should be in reverse chronological order. Since 1.1.0 is a later version than 1.0.2, it should appear before 1.0.2 if it was released later. If 1.1.0 is a placeholder for a future release, it's better to place its contents under an [Unreleased] section at the top of the file. This will make the version history clearer for contributors and users.


> ### 🔒 Security Hardening, Architecture Improvements & UX Polish
>
> Comprehensive audit-driven improvements across security, architecture, testing, and user experience.

### 🛡️ Security (Phase 0)

- **Auth guard** — API route protection via `withAuth` middleware for all dashboard routes
- **CSRF protection** — Token-based CSRF guard for all state-changing API routes
- **Request payload validation** — Zod schemas for provider, combo, key, and settings endpoints
- **Prompt injection guard** — Input sanitization against malicious prompt patterns
- **Body size guard** — Route-specific body size limits with dedicated audio upload threshold
- **Rate limiter** — Per-IP rate limiting with configurable windows and thresholds

### 🏗️ Architecture (Phase 1–2)

- **DI container** — Simple dependency injection container for service registration
- **Policy engine** — Consolidated `PolicyEngine` for routing, security, and rate limiting
- **SQLite migration** — Database migration system with versioned migration runner
- **Graceful shutdown** — Clean server shutdown with connection draining
- **TypeScript fixes** — Resolved all `tsc` errors; removed redundant `@ts-check` directives
- **Pipeline decomposition** — `handleSingleModelChat` decomposed into composable pipeline stages
- **Prompt template versioning** — Version-tracked prompt templates with rollback support
- **Eval scheduling** — Automated evaluation suite scheduling with cron-based runner
- **Plugin architecture** — Extensible plugin system for custom middleware and handlers

### 🧪 Testing & CI (Phase 2)

- **Coverage thresholds** — Jest coverage thresholds enforced in CI (368 tests passing)
- **Proxy pipeline integration tests** — End-to-end tests for the proxy request pipeline
- **CI audit workflow** — npm audit and security scanning in GitHub Actions
- **k6 load tests** — Performance testing with ramping VUs and custom metrics

### ✨ UX & Polish (Phase 3–4)

- **Session management** — Session info card with login time, age, user agent, and logout
- **Focus indicators** — Global `:focus-visible` styles and `--focus-ring` CSS utility
- **Audit log viewer** — Security event audit log with structured data display
- **Dashboard cleanup** — Removed unused files, fixed Quick Start links to Endpoint page
- **Documentation** — Troubleshooting guide, deployment improvements

---

## [1.1.0] — 2026-02-18

> ### 🔧 API Compatibility & SDK Hardening
Expand Down Expand Up @@ -188,4 +232,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
---

[1.1.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.1.0
[1.0.2]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.2
[1.0.0]: https://github.com/diegosouzapw/OmniRoute/releases/tag/v1.0.0
8 changes: 4 additions & 4 deletions README.de.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Image | Tag | Größe | Beschreibung |
| ------------------------ | -------- | ------ | ------------------------ |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Letztes stabiles Release |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Aktuelle Version |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Aktuelle Version |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ Das vorgeladene „OmniRoute Golden Set" enthält 10 Testfälle:
**Verbindungstest zeigt „Invalid" für OpenAI-kompatible Anbieter**

- Viele Anbieter stellen den `/models` Endpoint nicht bereit
- OmniRoute v1.0.0+ enthält Fallback-Validierung via Chat Completions
- OmniRoute v1.0.2+ enthält Fallback-Validierung via Chat Completions
- Stelle sicher, dass die Base URL den `/v1` Suffix enthält

</details>
Expand All @@ -902,7 +902,7 @@ Das vorgeladene „OmniRoute Golden Set" enthält 10 Testfälle:
## 🛠️ Technologie-Stack

- **Runtime**: Node.js 20+
- **Sprache**: TypeScript 5.9 — **100% TypeScript** in `src/` und `open-sse/` (v1.0.0)
- **Sprache**: TypeScript 5.9 — **100% TypeScript** in `src/` und `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **Datenbank**: LowDB (JSON) + SQLite (Domain-Status + Proxy-Logs)
- **Streaming**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ Siehe [CONTRIBUTING.md](CONTRIBUTING.md) für detaillierte Richtlinien.

```bash
# Release erstellen — npm-Veröffentlichung erfolgt automatisch
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.es.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Imagen | Tag | Tamaño | Descripción |
| ------------------------ | -------- | ------ | ---------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Última versión estable |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Versión actual |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Versión actual |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ El "OmniRoute Golden Set" precargado contiene 10 casos de prueba que cubren:
**Prueba de conexión muestra "Invalid" para proveedores compatibles con OpenAI**

- Muchos proveedores no exponen el endpoint `/models`
- OmniRoute v1.0.0+ incluye validación vía chat completions como fallback
- OmniRoute v1.0.2+ incluye validación vía chat completions como fallback
- Asegúrate de que la URL base incluya el sufijo `/v1`

</details>
Expand All @@ -902,7 +902,7 @@ El "OmniRoute Golden Set" precargado contiene 10 casos de prueba que cubren:
## 🛠️ Stack Tecnológico

- **Runtime**: Node.js 20+
- **Lenguaje**: TypeScript 5.9 — **100% TypeScript** en `src/` y `open-sse/` (v1.0.0)
- **Lenguaje**: TypeScript 5.9 — **100% TypeScript** en `src/` y `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **Base de Datos**: LowDB (JSON) + SQLite (estado del dominio + logs de proxy)
- **Streaming**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ Consulta [CONTRIBUTING.md](CONTRIBUTING.md) para directrices detalladas.

```bash
# Crea un release — la publicación en npm ocurre automáticamente
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.fr.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Image | Tag | Taille | Description |
| ------------------------ | -------- | ------ | ----------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Dernière version stable |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Version actuelle |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Version actuelle |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ Le « OmniRoute Golden Set » préchargé contient 10 cas de test :
**Le test de connexion affiche « Invalid » pour les fournisseurs compatibles OpenAI**

- Beaucoup de fournisseurs n'exposent pas le point de terminaison `/models`
- OmniRoute v1.0.0+ inclut une validation de secours via chat completions
- OmniRoute v1.0.2+ inclut une validation de secours via chat completions
- Assurez-vous que l'URL de base inclut le suffixe `/v1`

</details>
Expand All @@ -902,7 +902,7 @@ Le « OmniRoute Golden Set » préchargé contient 10 cas de test :
## 🛠️ Stack technologique

- **Runtime** : Node.js 20+
- **Langage** : TypeScript 5.9 — **100% TypeScript** dans `src/` et `open-sse/` (v1.0.0)
- **Langage** : TypeScript 5.9 — **100% TypeScript** dans `src/` et `open-sse/` (v1.0.2)
- **Framework** : Next.js 16 + React 19 + Tailwind CSS 4
- **Base de données** : LowDB (JSON) + SQLite (état du domaine + logs proxy)
- **Streaming** : Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ Consultez [CONTRIBUTING.md](CONTRIBUTING.md) pour les directives détaillées.

```bash
# Créer un release — la publication npm est automatique
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.it.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Immagine | Tag | Dimensione | Descrizione |
| ------------------------ | -------- | ---------- | ----------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Ultima versione stabile |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Versione attuale |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Versione attuale |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ Il "OmniRoute Golden Set" precaricato contiene 10 casi di test:
**Il test di connessione mostra "Invalid" per provider compatibili OpenAI**

- Molti provider non espongono l'endpoint `/models`
- OmniRoute v1.0.0+ include validazione fallback tramite chat completions
- OmniRoute v1.0.2+ include validazione fallback tramite chat completions
- Assicurati che la URL base includa il suffisso `/v1`

</details>
Expand All @@ -902,7 +902,7 @@ Il "OmniRoute Golden Set" precaricato contiene 10 casi di test:
## 🛠️ Stack Tecnologico

- **Runtime**: Node.js 20+
- **Linguaggio**: TypeScript 5.9 — **100% TypeScript** in `src/` e `open-sse/` (v1.0.0)
- **Linguaggio**: TypeScript 5.9 — **100% TypeScript** in `src/` e `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **Database**: LowDB (JSON) + SQLite (stato dominio + log proxy)
- **Streaming**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ Consulta [CONTRIBUTING.md](CONTRIBUTING.md) per le linee guida dettagliate.

```bash
# Crea un rilascio — la pubblicazione npm avviene automaticamente
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Image | Tag | Size | Description |
| ------------------------ | -------- | ------ | --------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Latest stable release |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Current version |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Current version |

---

Expand Down Expand Up @@ -903,7 +903,7 @@ The pre-loaded "OmniRoute Golden Set" contains 10 test cases covering:
**Connection test shows "Invalid" for OpenAI-compatible providers**

- Many providers don't expose a `/models` endpoint
- OmniRoute v1.0.0+ includes fallback validation via chat completions
- OmniRoute v1.0.2+ includes fallback validation via chat completions
- Ensure base URL includes `/v1` suffix

</details>
Expand All @@ -913,7 +913,7 @@ The pre-loaded "OmniRoute Golden Set" contains 10 test cases covering:
## 🛠️ Tech Stack

- **Runtime**: Node.js 20+
- **Language**: TypeScript 5.9 — **100% TypeScript** across `src/` and `open-sse/` (v1.0.0)
- **Language**: TypeScript 5.9 — **100% TypeScript** across `src/` and `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **Database**: LowDB (JSON) + SQLite (domain state + proxy logs)
- **Streaming**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -1014,7 +1014,7 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines.

```bash
# Create a release — npm publish happens automatically
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.pt-BR.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Imagem | Tag | Tamanho | Descrição |
| ------------------------ | -------- | ------- | --------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Última versão estável |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Versão atual |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Versão atual |

---

Expand Down Expand Up @@ -899,7 +899,7 @@ O "OmniRoute Golden Set" pré-carregado contém 10 casos de teste cobrindo:
**Teste de conexão mostra "Invalid" para provedores compatíveis com OpenAI**

- Muitos provedores não expõem endpoint `/models`
- OmniRoute v1.0.0+ inclui validação via chat completions como fallback
- OmniRoute v1.0.2+ inclui validação via chat completions como fallback
- Certifique-se de que a base URL inclui sufixo `/v1`

</details>
Expand All @@ -909,7 +909,7 @@ O "OmniRoute Golden Set" pré-carregado contém 10 casos de teste cobrindo:
## 🛠️ Stack Tecnológico

- **Runtime**: Node.js 20+
- **Linguagem**: TypeScript 5.9 — **100% TypeScript** em `src/` e `open-sse/` (v1.0.0)
- **Linguagem**: TypeScript 5.9 — **100% TypeScript** em `src/` e `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **Banco de Dados**: LowDB (JSON) + SQLite (estado do domínio + logs de proxy)
- **Streaming**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -1010,7 +1010,7 @@ Veja [CONTRIBUTING.md](CONTRIBUTING.md) para diretrizes detalhadas.

```bash
# Crie um release — publicação no npm acontece automaticamente
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.ru.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| Образ | Тег | Размер | Описание |
| ------------------------ | -------- | ------ | -------------------------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | Последний стабильный релиз |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | Текущая версия |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | Текущая версия |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ OmniRoute включает встроенный фреймворк оценки
**Тест подключения показывает «Invalid» для OpenAI-совместимых провайдеров**

- Многие провайдеры не предоставляют endpoint `/models`
- OmniRoute v1.0.0+ включает fallback-валидацию через chat completions
- OmniRoute v1.0.2+ включает fallback-валидацию через chat completions
- Убедитесь что base URL содержит суффикс `/v1`

</details>
Expand All @@ -902,7 +902,7 @@ OmniRoute включает встроенный фреймворк оценки
## 🛠️ Технологический стек

- **Runtime**: Node.js 20+
- **Язык**: TypeScript 5.9 — **100% TypeScript** в `src/` и `open-sse/` (v1.0.0)
- **Язык**: TypeScript 5.9 — **100% TypeScript** в `src/` и `open-sse/` (v1.0.2)
- **Framework**: Next.js 16 + React 19 + Tailwind CSS 4
- **База данных**: LowDB (JSON) + SQLite (состояние домена + proxy-логи)
- **Стриминг**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ OmniRoute включает встроенный фреймворк оценки

```bash
# Создайте релиз — публикация в npm происходит автоматически
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
8 changes: 4 additions & 4 deletions README.zh-CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,7 +242,7 @@ docker compose --profile cli up -d
| 镜像 | 标签 | 大小 | 描述 |
| ------------------------ | -------- | ------ | ---------- |
| `diegosouzapw/omniroute` | `latest` | ~250MB | 最新稳定版 |
| `diegosouzapw/omniroute` | `1.0.0` | ~250MB | 当前版本 |
| `diegosouzapw/omniroute` | `1.0.2` | ~250MB | 当前版本 |

---

Expand Down Expand Up @@ -892,7 +892,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
**兼容 OpenAI 的提供商连接测试显示 "Invalid"**

- 许多提供商不暴露 `/models` 端点
- OmniRoute v1.0.0+ 包含通过 chat completions 的回退验证
- OmniRoute v1.0.2+ 包含通过 chat completions 的回退验证
- 确保 base URL 包含 `/v1` 后缀

</details>
Expand All @@ -902,7 +902,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质
## 🛠️ 技术栈

- **运行时**: Node.js 20+
- **语言**: TypeScript 5.9 — `src/` 和 `open-sse/` 中 **100% TypeScript**（v1.0.0）
- **语言**: TypeScript 5.9 — `src/` 和 `open-sse/` 中 **100% TypeScript**（v1.0.2）
- **框架**: Next.js 16 + React 19 + Tailwind CSS 4
- **数据库**: LowDB (JSON) + SQLite（领域状态 + 代理日志）
- **流式传输**: Server-Sent Events (SSE)
Expand Down Expand Up @@ -957,7 +957,7 @@ OmniRoute 包含内置评估框架，用于针对黄金集测试 LLM 响应质

```bash
# 创建发布 — npm 发布自动完成
gh release create v1.0.0 --title "v1.0.0" --generate-notes
gh release create v1.0.2 --title "v1.0.2" --generate-notes
```

---
Expand Down
6 changes: 3 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@ If you discover a security vulnerability in OmniRoute, please report it responsi

| Version | Support Status |
| ------- | -------------- |
| 0.8.x | ✅ Active |
| 0.7.x | ✅ Security |
| < 0.7.0 | ❌ Unsupported |
| 1.0.x | ✅ Active |
| 0.8.x | ✅ Security |
| < 0.8.0 | ❌ Unsupported |

---

Expand Down
4 changes: 4 additions & 0 deletions eslint.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import nextVitals from "eslint-config-next/core-web-vitals";
import tseslint from "typescript-eslint";

/** @type {import("eslint").Linter.Config[]} */
const eslintConfig = [
Expand All @@ -14,6 +15,9 @@ const eslintConfig = [
// Relaxed rules for open-sse and tests (incremental adoption)
{
files: ["open-sse/**/*.ts", "tests/**/*.mjs", "tests/**/*.ts"],
plugins: {
"@typescript-eslint": tseslint.plugin,
},
rules: {
"@typescript-eslint/no-explicit-any": "warn",
"@next/next/no-assign-module-variable": "off",
Expand Down
5 changes: 2 additions & 3 deletions next.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,8 @@ const nextConfig = {
transpilePackages: ["@omniroute/open-sse"],
allowedDevOrigins: ["192.168.*"],
typescript: {
// Migration Phase: ignore TS errors during build.
// Remove after all 984 type errors are resolved.
ignoreBuildErrors: true,
// All TS errors resolved — strict checking enforced
ignoreBuildErrors: false,
},
images: {
unoptimized: true,
Expand Down
Loading
Loading