WealthLedger/frontend
5
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: align audit findings for Events, currency and auth (WealthLedger/frontend#155) #156

Merged
codex-bot merged 3 commits from fix/155-auth-admission-and-events-contract into develop 2026-11-05 07:23:08 +03:00
Conversation 0 Commits 3 Files Changed 11
+75 -8
codex-bot commented 2026-11-05 07:15:28 +03:00
Owner
Copy Link
Copy Source

Изменения

  • WealthLedger/frontend#63: показывать calculatedAt и исходное окно сохранённого прогноза Events; URL-фильтр остаётся. RTL/MSW проверяет окно до/после неудачного GET и Retry без ручного импорта.
  • WealthLedger/frontend#59: скрытый CURRENCY/cash mirror не входит в знаменатель долей позиций; regression для all-account. Backend totals/structure остаются authoritative.
  • WealthLedger/frontend#155 / WealthLedger/backend#73: nginx общий admission budget на точные POST login/register (2r/s, burst 5, 429 до upstream), без доверия неизвестной цепочке client-IP. Регистрация остаётся открытой. Один клиент может исчерпать общий бюджет.

Проверки

npm run verify: PASS (580 tests + typecheck/lint/OpenAPI/build/Storybook); nginx -t: PASS; изолированный burst 6 forwarded → 6 rejected 429 → after 4s forwarded; git diff --check: PASS.

Spec prerequisite: WealthLedger/specs#82. Для backend#73 внешнюю proxy chain и эксплуатационное поведение ещё нужно проверить; этот PR не заявляет production proof. Closes WealthLedger/frontend#59, WealthLedger/frontend#63, WealthLedger/frontend#155.

## Изменения - WealthLedger/frontend#63: показывать `calculatedAt` и исходное окно сохранённого прогноза Events; URL-фильтр остаётся. RTL/MSW проверяет окно до/после неудачного GET и Retry без ручного импорта. - WealthLedger/frontend#59: скрытый `CURRENCY`/cash mirror не входит в знаменатель долей позиций; regression для all-account. Backend totals/structure остаются authoritative. - WealthLedger/frontend#155 / WealthLedger/backend#73: nginx общий admission budget на точные POST login/register (`2r/s`, burst 5, 429 до upstream), без доверия неизвестной цепочке client-IP. Регистрация остаётся открытой. Один клиент может исчерпать общий бюджет. ## Проверки `npm run verify`: PASS (580 tests + typecheck/lint/OpenAPI/build/Storybook); `nginx -t`: PASS; изолированный burst 6 forwarded → 6 rejected 429 → after 4s forwarded; `git diff --check`: PASS. Spec prerequisite: WealthLedger/specs#82. Для backend#73 внешнюю proxy chain и эксплуатационное поведение ещё нужно проверить; этот PR не заявляет production proof. Closes WealthLedger/frontend#59, WealthLedger/frontend#63, WealthLedger/frontend#155.
codex-bot added 3 commits 2026-11-05 07:15:28 +03:00
fix: show saved events forecast window (WealthLedger/frontend#63) 9efd37c5ff
fix: exclude currency mirror from position shares (WealthLedger/frontend#59) 8153f9c407
fix: bound auth admission at nginx (WealthLedger/frontend#155)
Frontend verify / commits (pull_request) Successful in 31s
Details
Frontend verify / security (pull_request) Successful in 9s
Details
Frontend verify / verify (pull_request) Successful in 5m54s
Details
33f608e690
codex-bot merged commit 668f2ef70e into develop 2026-11-05 07:23:08 +03:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Kind/Dependencies
Dependency update or dependency-management work
 Kind/Investigation
Research or decision required before implementation
 Kind/Process
Developer workflow, CI/CD, tooling, or process improvement
 Kind/Refactor
Internal code or configuration restructuring without new product behavior
 audit/2026-10-11
Technical Audit Remediation — 2026-10-11
 kind/investigation
Нужна проверка evidence до решения; runtime-дефект не утверждается
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
codex-bot hermes-agent ksv741 publisher-bot renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: WealthLedger/frontend#156