Merge pull request #44 from gbrlpzz/fix/security-hardening-and-optimizations

Harden sync/auth/offline shell; fix throttle + audit bugs

Author: gbrlpzz

README.md

@@ -213,4 +213,3 @@ exports must include failure-oriented tests and pass `npm run check`.
 
 `collect` is open-source software licensed under the
 [Apache License 2.0](LICENSE). Copyright © 2026 Gabriele Pizzi.
-

public/sw.js

@@ -1,7 +1,7 @@
 // collect service worker: precached app shell + runtime cache-first assets.
 // The hashed asset list is emitted by the Vite build (precache-manifest.json)
 // so an installed app loads offline from the first launch.
-const CACHE = "collect-shell-v4";
+const CACHE = "collect-shell-v5";
 const CORE = [
   "/",
   "/manifest.webmanifest",
@@ -82,16 +82,27 @@ self.addEventListener("fetch", (event) => {
   if (requestUrl.origin !== self.location.origin) return;
 
   if (event.request.mode === "navigate") {
+    // Two surfaces share one deployment: the marketing homepage at "/" and
+    // the installed field app at "/app". Cache each navigation under its own
+    // shell key and fall back to that key offline, so a contributor who last
+    // opened the homepage is never served the wrong shell in the field.
+    const shell = requestUrl.pathname.startsWith("/app")
+      ? "/index.html"
+      : "/homepage.html";
     event.respondWith(
       fetch(event.request)
         .then((response) => {
           if (response.ok) {
             const copy = response.clone();
-            void caches.open(CACHE).then((cache) => cache.put("/", copy));
+            void caches.open(CACHE).then((cache) => cache.put(shell, copy));
           }
           return response;
         })
-        .catch(() => caches.match("/")),
+        .catch(() =>
+          caches
+            .match(shell)
+            .then((cached) => cached ?? caches.match("/index.html")),
+        ),
     );
     return;
   }

scripts/provision.mjs

@@ -159,10 +159,10 @@ async function updateAuthConfig({
   }
 }
 
-async function issueMagicLink({ projectRef, publishableKey, appUrl, email }) {
+async function issueMagicLink({ projectRef, publishableKey, appPath, email }) {
   const supabaseUrl = `https://${projectRef}.supabase.co`;
   const response = await fetch(
-    `${supabaseUrl}/auth/v1/otp?redirect_to=${encodeURIComponent(appUrl)}`,
+    `${supabaseUrl}/auth/v1/otp?redirect_to=${encodeURIComponent(appPath)}`,
     {
       method: "POST",
       headers: {
@@ -259,7 +259,7 @@ async function main() {
     await issueMagicLink({
       projectRef,
       publishableKey,
-      appUrl,
+      appPath,
       email: adminEmail,
     });
     console.log(

src/app/submission.ts

@@ -41,9 +41,18 @@ export async function commitLocalObservation({
   const { values: cleanedValues, response: attentionResponse } =
     extractAttentionResponse(values);
 
+  // Only declared schema keys may enter the research payload. The draft also
+  // carries a UI-only "observed_date" seed for the demo schema; on real
+  // deployments that key is not a declared field and must not be persisted as
+  // research data. Filtering here also guarantees the reserved attention key
+  // (already stripped above) can never re-enter the payload.
+  const declaredKeys = new Set(project.fields.map((field) => field.key));
+  let submittedValues = Object.fromEntries(
+    Object.entries(cleanedValues).filter(([key]) => declaredKeys.has(key)),
+  );
+
   // A fresh location fix is captured at submit time when the browser permits it.
   // Failure to obtain a fix never blocks the durable local receipt.
-  let submittedValues = cleanedValues;
   // The fresh fix is written to every declared location field key so a schema
   // with a non-"location" key (e.g. "gps") still records coordinates. The
   // merge stays on cleanedValues so stripped auxiliary keys (e.g. the

src/app/syncController.ts

@@ -214,7 +214,7 @@ export function syncNow({
             // transient failures stay retryable. One failed observation never
             // blocks the rest of the queue.
             const actionRequired =
-              /unknown schema|revoked|forbidden|not authorized|permission|conflict|corrupt|assignment is not active|belongs to another|immutable|does not match the published schema|is not a published option|not configured as the first administrator|size does not match|checksum|integrity|invalid option|not active|closed/i.test(
+              /unknown schema|revoked|consent|forbidden|not authorized|permission|conflict|corrupt|assignment is not active|belongs to another|immutable|does not match the published schema|is not a published option|not configured as the first administrator|size does not match|checksum|integrity|invalid option|not active|closed/i.test(
                 message,
               );
             await recordOutboxFailure(observation.id, message, actionRequired);

src/homepage/PreviewForm.tsx

@@ -7,20 +7,30 @@ import { Icon } from "../components/Icon";
  * Email and inquiry details are required so we can properly route and respond.
  * Inserts one row into the private preview_requests queue (RLS: anonymous insert only).
  */
-const DEFAULT_SUPABASE_URL = "https://lrqlrufwrytpwhgclmyo.supabase.co";
-const DEFAULT_PUBLISHABLE_KEY =
-  "sb_publishable_BAsTV49V04O0WZVtVgohqg_BD5JReFE";
-
-const baseUrl = (
-  import.meta.env.VITE_SUPABASE_URL || DEFAULT_SUPABASE_URL
-).replace(/\/+$/, "");
-const FORM_ENDPOINT = `${baseUrl}/rest/v1/preview_requests`;
-const FORM_KEY =
-  import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY ||
-  import.meta.env.VITE_SUPABASE_ANON_KEY ||
-  DEFAULT_PUBLISHABLE_KEY;
+// The preview form posts into the same Supabase project that powers the app.
+// It must never fall back to a hardcoded production project: a self-hosted
+// build without VITE_SUPABASE_* would otherwise write interest requests into
+// someone else's database. When unconfigured, the form renders a clear note.
+/**
+ * Read the target project lazily (not at module scope) so test and runtime
+ * environments can configure VITE_SUPABASE_* after import, and so a build
+ * without the variables still renders a clear "not configured" note instead
+ * of silently posting into a hardcoded production project.
+ */
+function previewFormConfig(): { endpoint: string; key: string } | null {
+  const baseUrl = import.meta.env.VITE_SUPABASE_URL?.trim();
+  const key =
+    import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY?.trim() ||
+    import.meta.env.VITE_SUPABASE_ANON_KEY?.trim();
+  if (!baseUrl || !key) return null;
+  return {
+    endpoint: `${baseUrl.replace(/\/+$/, "")}/rest/v1/preview_requests`,
+    key,
+  };
+}
 
 export function PreviewForm({ initialEmail = "" }: { initialEmail?: string }) {
+  const config = previewFormConfig();
   const [email, setEmail] = useState(initialEmail);
   const [inquiry, setInquiry] = useState("");
   const [error, setError] = useState<string | null>(null);
@@ -33,6 +43,7 @@ export function PreviewForm({ initialEmail = "" }: { initialEmail?: string }) {
 
   const submit = async (event: React.FormEvent) => {
     event.preventDefault();
+    if (!config) return;
     setError(null);
 
     const trimmedEmail = email.trim();
@@ -50,11 +61,11 @@ export function PreviewForm({ initialEmail = "" }: { initialEmail?: string }) {
 
     setSending(true);
     try {
-      const response = await fetch(FORM_ENDPOINT, {
+      const response = await fetch(config.endpoint, {
         method: "POST",
         headers: {
-          apikey: FORM_KEY,
-          Authorization: `Bearer ${FORM_KEY}`,
+          apikey: config.key,
+          Authorization: `Bearer ${config.key}`,
           "Content-Type": "application/json",
           Prefer: "return=minimal",
         },
@@ -90,6 +101,16 @@ export function PreviewForm({ initialEmail = "" }: { initialEmail?: string }) {
     }
   };
 
+  if (!config) {
+    return (
+      <div className="hp-form" role="status">
+        <p className="hp-form-note">
+          The preview request form is not configured for this deployment.
+        </p>
+      </div>
+    );
+  }
+
   if (sent) {
     return (
       <div className="hp-form-success" role="status">

supabase/functions/_shared/config.ts

@@ -0,0 +1,27 @@
+/**
+ * Canonical deployed app origin for magic links, device-link tokens, and
+ * reminder deep links. Every function reads it from APP_URL so a self-hosted
+ * deployment never silently redirects users to another tenant's instance.
+ * Failing loudly (rather than inventing a URL) matches the client-side
+ * sendMagicLink guard, which refuses to send a broken link when VITE_APP_URL
+ * is missing.
+ */
+function appOrigin(): string {
+  const url = Deno.env.get("APP_URL")?.trim();
+  if (!url) {
+    throw new Response("APP_URL is not configured on this deployment", {
+      status: 500,
+    });
+  }
+  return url.replace(/\/+$/, "");
+}
+
+/**
+ * The installed field app entry point. The single deployment serves the app
+ * under /app (the marketing homepage lives at /), so every magic-link,
+ * device-link, and reminder redirect must target /app to reach the surface
+ * that actually processes the auth callback.
+ */
+export function appEntryUrl(): string {
+  return `${appOrigin()}/app`;
+}

supabase/functions/_shared/csv.ts

@@ -0,0 +1,16 @@
+/**
+ * Neutralize CSV/Excel formula injection and produce RFC-4180-compatible
+ * cells/rows. Values beginning with "=", "+", "-", "@", tab, or CR are
+ * prefixed with a single quote so spreadsheet applications render them as
+ * text instead of executing them as formulas.
+ */
+export function csvCell(value: unknown): string {
+  if (value === null || value === undefined) return '""';
+  const rawText = typeof value === "string" ? value : JSON.stringify(value);
+  const text = /^[=+\-@\t\r]/.test(rawText) ? `'${rawText}` : rawText;
+  return `"${text.replaceAll('"', '""')}"`;
+}
+
+export function csvRow(values: unknown[]): string {
+  return values.map(csvCell).join(",");
+}

supabase/functions/_shared/rateLimit.ts

@@ -0,0 +1,21 @@
+import type { SupabaseClient } from "npm:@supabase/supabase-js@2.112.2";
+import { sha256 } from "./hash.ts";
+
+/**
+ * Increment the shared per-source-IP request budget and report whether the
+ * caller is still allowed. This is the effective control for both the
+ * anonymous self-service sign-in-code request and the sign-in-code exchange:
+ * a code's hash cannot be known without the code itself, so per-code attempt
+ * counters can never observe a wrong guess.
+ */
+export async function bumpIpRateLimit(
+  request: Request,
+  service: SupabaseClient,
+): Promise<boolean> {
+  const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+    "";
+  const { data: allowed } = await service
+    .rpc("bump_signin_code_request", { p_ip_hash: await sha256(ip) })
+    .maybeSingle();
+  return allowed !== false;
+}

supabase/functions/claim-invites/index.ts

@@ -20,7 +20,7 @@ Deno.serve(async (request) => {
       .from("project_invites")
       .select("id,project_id")
       .eq("status", "pending")
-      .ilike("email", email);
+      .eq("email", email);
     if (inviteError) {
       return json(
         { error: "Invitations could not be checked" },