From 08a01d843a39049272e84c397a26943167bb29cf Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 1 Sep 2026 03:02:08 +0200 Subject: [PATCH] feat: publish Toolbox 0.18.0 with sixteen new tools --- .env.example | 4 +- Containerfile.release | 20 +++- README.md | 190 ++++++++++++++++-------------- compose.example.yaml | 2 +- compose.yaml | 6 +- deploy/nginx.conf | 12 +- package-lock.json | 30 ++--- package.json | 2 +- public/SOURCE.md | 4 +- public/toolbox.catalog.json | 64 ++++++++++ release/toolbox.lock.example.json | 116 +++++++++++++++++- release/toolbox.lock.json | 116 +++++++++++++++++- scripts/assembler.test.ts | 2 +- scripts/deployment.test.ts | 73 +++++++++--- src/App.tsx | 4 +- 15 files changed, 508 insertions(+), 137 deletions(-) diff --git a/.env.example b/.env.example index ebeebdf..4695eb9 100644 --- a/.env.example +++ b/.env.example @@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal TRAEFIK_CERT_RESOLVER=netcup # Keep these two values paired when deploying a newer published toolbox release. -TOOLBOX_RELEASE_VERSION=0.17.0 -TOOLBOX_RELEASE_SHA256=116e0f335e593aef3d4b345dc6b8e37294ba4fb489ee48abdb0b46fa0251b4b9 +TOOLBOX_RELEASE_VERSION=0.18.0 +TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c diff --git a/Containerfile.release b/Containerfile.release index 428f68a..784f501 100644 --- a/Containerfile.release +++ b/Containerfile.release @@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3 FROM ${NGINX_IMAGE} AS release -ARG TOOLBOX_RELEASE_VERSION=0.17.0 -ARG TOOLBOX_RELEASE_SHA256=116e0f335e593aef3d4b345dc6b8e37294ba4fb489ee48abdb0b46fa0251b4b9 +ARG TOOLBOX_RELEASE_VERSION=0.18.0 +ARG TOOLBOX_RELEASE_SHA256=77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download RUN set -eu; \ @@ -28,6 +28,22 @@ RUN set -eu; \ test -f /tmp/toolbox/apps/sudoku/toolbox-app.json; \ test -f /tmp/toolbox/apps/colour/toolbox-app.json; \ test -f /tmp/toolbox/apps/office/toolbox-app.json; \ + test -f /tmp/toolbox/apps/image/toolbox-app.json; \ + test -f /tmp/toolbox/apps/file/toolbox-app.json; \ + test -f /tmp/toolbox/apps/epub/toolbox-app.json; \ + test -f /tmp/toolbox/apps/archive/toolbox-app.json; \ + test -f /tmp/toolbox/apps/privacy/toolbox-app.json; \ + test -f /tmp/toolbox/apps/crypto/toolbox-app.json; \ + test -f /tmp/toolbox/apps/barcode/toolbox-app.json; \ + test -f /tmp/toolbox/apps/network/toolbox-app.json; \ + test -f /tmp/toolbox/apps/geo/toolbox-app.json; \ + test -f /tmp/toolbox/apps/helper/toolbox-app.json; \ + test -f /tmp/toolbox/apps/rand/toolbox-app.json; \ + test -f /tmp/toolbox/apps/data/toolbox-app.json; \ + test -f /tmp/toolbox/apps/diff/toolbox-app.json; \ + test -f /tmp/toolbox/apps/time/toolbox-app.json; \ + test -f /tmp/toolbox/apps/text/toolbox-app.json; \ + test -f /tmp/toolbox/apps/unicode/toolbox-app.json; \ rm "/tmp/${archive}" FROM ${NGINX_IMAGE} diff --git a/README.md b/README.md index a951044..b6c1fb9 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # add·ideas Toolbox Portal `toolbox-portal` is the static launcher and release assembler for the add·ideas -browser toolbox. Version `0.2.19` reads one same-origin catalogue, shows each app +browser toolbox. Version `0.2.20` reads one same-origin catalogue, shows each app as a compact launch tile, and keeps personal pins, drag-and-drop ordering, visibility, and appearance in the current browser. Pinned tools have their own section; search, category, and clickable tag filters stay close to the tool @@ -38,7 +38,11 @@ Vite uses `base: './'`, so the built portal works at `/` or a nested static path The development catalogue at `public/toolbox.catalog.json` points to assembled paths (`./apps/pdf/`, `./apps/xslt/`, `./apps/onenote/`, `./apps/av/`, `./apps/regex/`, `./apps/svg/`, `./apps/auth/`, `./apps/sudoku/`, -`./apps/colour/`, and `./apps/office/`). +`./apps/colour/`, `./apps/office/`, `./apps/image/`, `./apps/file/`, +`./apps/epub/`, `./apps/archive/`, `./apps/privacy/`, `./apps/crypto/`, +`./apps/barcode/`, `./apps/network/`, `./apps/geo/`, `./apps/helper/`, +`./apps/rand/`, `./apps/data/`, `./apps/diff/`, `./apps/time/`, +`./apps/text/`, and `./apps/unicode/`). Those manifests will correctly appear as unavailable until an assembled release is being served. @@ -70,7 +74,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported ## Production deployment behind Traefik The committed `compose.yaml` is the shortest production path. Its release -container downloads the immutable Toolbox 0.17.0 ZIP during the image build, +container downloads the immutable Toolbox 0.18.0 ZIP during the image build, verifies SHA-256 before extracting it, and then copies only the verified static files into the pinned unprivileged nginx image. Node.js and a local portal assembly are not required on the deployment host. @@ -134,12 +138,14 @@ The app release should also publish a matching `.sha256` sidecar. The manifest must declare the pinned reverse-DNS id and version. Application and portal versions are independent. -`release/toolbox.lock.json` is the reviewed Toolbox v0.17.0 / Portal v0.2.19 +`release/toolbox.lock.json` is the reviewed Toolbox v0.18.0 / Portal v0.2.20 lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, OTP & Passkey -Tools 0.3.0, Sudoku Tools 0.2.1, Colour Tools 0.1.0, and Office Tools 0.1.0 -release bytes. Use +Tools 0.3.0, Sudoku Tools 0.2.1, Colour Tools 0.1.0, Office Tools 0.1.0, +and the initial 0.1.0 releases of Image, File, EPUB, Archive, Privacy, Crypto, +Barcode, Network, Geo, Helper, Random, Data, Diff, Time, Text, and Unicode Tools. +Use `release/toolbox.lock.example.json` as the template for a future release and verify every downloaded asset before committing updated values. Artifacts may be: @@ -160,7 +166,7 @@ npm run assemble -- \ --lock release/toolbox.lock.json \ --portal-dist dist \ --output build/toolbox \ - --archive build/add-ideas-toolbox-0.17.0.zip + --archive build/add-ideas-toolbox-0.18.0.zip ``` Existing output is refused. Pass `--force` only when replacing those exact @@ -185,10 +191,26 @@ build/toolbox/ ├── auth/ ├── sudoku/ ├── colour/ - └── office/ + ├── office/ + ├── image/ + ├── file/ + ├── epub/ + ├── archive/ + ├── privacy/ + ├── crypto/ + ├── barcode/ + ├── network/ + ├── geo/ + ├── helper/ + ├── rand/ + ├── data/ + ├── diff/ + ├── time/ + ├── text/ + └── unicode/ -build/add-ideas-toolbox-0.17.0.zip -build/add-ideas-toolbox-0.17.0.zip.sha256 +build/add-ideas-toolbox-0.18.0.zip +build/add-ideas-toolbox-0.18.0.zip.sha256 ``` The assembler verifies SHA-256 before opening an artifact, validates every app @@ -209,7 +231,7 @@ directory separately: ```sh npm run package:static -- \ --input build/toolbox \ - --output artifacts/add-ideas-toolbox-0.17.0.zip + --output artifacts/add-ideas-toolbox-0.18.0.zip ``` This also emits a `.sha256` sidecar. @@ -222,24 +244,26 @@ immutable caching only for Vite-hashed assets and narrowly matched semver-versioned FFmpeg core files, and revalidation for all other files. The opaque-origin SVG preview iframe loads its packaged controller with a URI-exact CORS and cross-origin resource-policy exception; all other files retain the -same-origin policy and every normal security header. Camera access is denied on -the shared Toolbox host and granted only to the dedicated -`auth.toolbox.add-ideas.de` origin, where Auth Tools still requests it only -after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the -exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host at -the same time; the default-deny fallback deliberately does not infer camera -grants from request paths. -Assemble first, then: +same-origin policy and every normal security header. Camera access is denied by +default. It is granted to the dedicated `auth.toolbox.add-ideas.de` origin and, +on the shared Toolbox host, only to `/apps/barcode/`; both apps still request it +only after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update +the exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host +at the same time. Random Tools is the only app whose path-specific CSP permits +an external connection, and only to `https://www.random.org`; the app requires +explicit per-session consent before making that optional request. The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's `ixsl:eval()` extension is therefore unsupported in this deployment profile; normal local XML/XSLT transformations do not require that permission. +Assemble first, then: + ```sh podman build -f Containerfile \ - -t git.add-ideas.de/lotobo/toolbox:0.17.0 . + -t git.add-ideas.de/lotobo/toolbox:0.18.0 . podman run --rm -p 8080:8080 \ - git.add-ideas.de/lotobo/toolbox:0.17.0 + git.add-ideas.de/lotobo/toolbox:0.18.0 ``` For a direct-port local deployment after assembly, use the separate example: @@ -256,8 +280,8 @@ docker login git.add-ideas.de docker buildx build \ --platform linux/amd64,linux/arm64 \ --file Containerfile.release \ - --tag git.add-ideas.de/lotobo/toolbox:0.17.0 \ - --tag git.add-ideas.de/lotobo/toolbox:0.17 \ + --tag git.add-ideas.de/lotobo/toolbox:0.18.0 \ + --tag git.add-ideas.de/lotobo/toolbox:0.18 \ --push . ``` @@ -279,11 +303,11 @@ needs permission to push code, releases, and container packages to 3. Verify downloaded app assets with `sha256sum -c .sha256`; copy those exact values into a reviewed toolbox lock. 4. Run the assembler and serve `build/toolbox` from a nested test path. Open - all ten apps, switch between them, and confirm the encoded `toolbox` + all 26 apps, switch between them, and confirm the encoded `toolbox` context. 5. Verify the distribution with - `(cd build && sha256sum -c add-ideas-toolbox-0.17.0.zip.sha256)`. -6. Commit the reviewed lock, tag the toolbox release (for example `v0.17.0`), and + `(cd build && sha256sum -c add-ideas-toolbox-0.18.0.zip.sha256)`. +6. Commit the reviewed lock, tag the toolbox release (for example `v0.18.0`), and push the branch and tag to Gitea. 7. In Gitea, open **Releases → New release**, select the tag, and upload the static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a @@ -298,69 +322,63 @@ must not re-resolve app versions or substitute a newer release. ## Existing tools -| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | -| ------------------- | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` | -| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` | -| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity | -| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable | -| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics | -| **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository | -| **`auth-tools`** | Current local-first v0.3.0 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration | -| **`sudoku-tools`** | Current local-first v0.2.1 release; dedicated repository | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell | -| **`colour-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert, composite, interpolate, pick, sample, analyse and export colours locally | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps; large visual and native pickers; local image sampling and palette extraction; contrast, gamut and colour-vision-deficiency analysis; harmonies and design-token export | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools | -| **`office-tools`** | Initial local-first v0.1.0 read-only release; dedicated repository | Open and view word-processing documents, spreadsheets and presentations locally | DOCX, XLSX and PPTX plus ODT, ODS and ODP; document, sheet and slide views with search, outline or thumbnail navigation and zoom; text, tables, images, styles, metadata, cached formula values and presentation notes | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity | +| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | +| ------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **`pdf-tools`** | Existing; dedicated repository | Merge, split, reorder, rotate and export PDF pages | Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace | Workers and IndexedDB; large-document memory control; future signature inspection through `crypto-tools`; metadata and safe-sharing through `privacy-tools` | +| **`xslt-tools`** | Existing; dedicated repository | Develop, test and run XSLT transformations | XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics | Lazy SaxonJS loading; relocatable assets; useful handoffs to `data-tools`, `schema-tools` and `diff-tools` | +| **`onenote-tools`** | Existing rich-reader release; dedicated repository | Open, browse, inspect and export OneNote sections and packages locally | Desktop/unfragmented FSSHTTPB `.one`/`.onetoc2`; none/LZX/MSZIP/Quantum and multi-cabinet `.onepkg`; trees, rich text, images, tables, ink, attachments and export | Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity | +| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable | +| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics | +| **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository | +| **`auth-tools`** | Current local-first v0.3.0 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration | +| **`sudoku-tools`** | Current local-first v0.2.1 release; dedicated repository | Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally | 4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects | Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell | +| **`colour-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert, composite, interpolate, pick, sample, analyse and export colours locally | General colour conversion; arbitrary RGBA compositing; multi-stop colour steps; large visual and native pickers; local image sampling and palette extraction; contrast, gamut and colour-vision-deficiency analysis; harmonies and design-token export | Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools | +| **`office-tools`** | Initial local-first v0.1.0 read-only release; dedicated repository | Open and view word-processing documents, spreadsheets and presentations locally | DOCX, XLSX and PPTX plus ODT, ODS and ODP; document, sheet and slide views with search, outline or thumbnail navigation and zoom; text, tables, images, styles, metadata, cached formula values and presentation notes | Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity | +| **`image-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, crop, rotate, resize, compare and batch-convert raster images locally | Static JPEG, PNG and WebP; bounded queues; aspect presets; fit/fill/exact resize; PNG/JPEG/WebP export; per-result operation reports | Animated and multi-picture inputs are inspect-only; canvas re-encoding does not preserve arbitrary metadata, ICC profiles, HDR precision or byte identity | +| **`file-tools`** | Initial local-first v0.1.0 release; dedicated repository | Identify, inspect, hash and inventory local files | Signature and claimed-MIME comparison; paged hex/ASCII and string views; SHA-256/SHA-512; deterministic JSON/CSV manifests; duplicate candidates | Detection and entropy are heuristics rather than validation or malware analysis; v0.1 intentionally does not mutate, split, join or rename files | +| **`epub-tools`** | Initial local-first v0.1.0 release; dedicated repository | Read, inspect, validate and repair EPUB 2/3 publications | Package, metadata, spine, EPUB 3 nav and EPUB 2 NCX views; sandboxed reading; link checks; metadata and cover editing; text/chapter/report export; normalized rebuilds | Strict bounded ZIP and XML handling; active and external content are blocked; DRM is detected but never bypassed; focused preflight is not a complete EPUBCheck implementation | +| **`archive-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, create, compare and safely extract archive content | ZIP/ZIP64, TAR/USTAR/PAX, gzip and tar.gz; inert previews; deterministic ZIP/TAR output; cross-format inventory comparison; selected-file repackaging | Path, entry-count, expanded-size and compression-ratio limits; no direct filesystem restoration, nested expansion, encrypted or multipart ZIP support; links and special entries are blocked | +| **`privacy-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect image metadata and make independently verified sharing copies | Deep JPEG, PNG and WebP scans for EXIF/IPTC/XMP/profiles/previews/provenance and trailing data; orientation-normalized pixel re-encoding; source/output hashes; JSON and ZIP reports | Not an anonymity guarantee; static supported images only; re-encoding can change pixels and remove colour, resolution and authenticity information; reports can themselves contain sensitive metadata | +| **`crypto-tools`** | Initial local-first v0.1.0 inspection release; dedicated repository | Inspect certificate, request, revocation-list, key and JWK material | Bounded PEM/DER X.509, CSR and CRL inspection; public/private key identification; JWK/JWKS warnings and RFC 7638 thumbprints; explicit issuer-signature links; DNS SAN hostname checks | No browser/OS trust implication, complete RFC 5280 path validation, revocation service, issuance, key generation, private-key decryption or general signature verification | +| **`barcode-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate and decode QR codes and common barcodes | SVG QR, Data Matrix, PDF417, Aztec and selected linear formats; bounded image or opt-in camera decode; structured QR payloads; CSV batch ZIP; GTIN and quiet-zone assistance | Decoded payloads remain inert text and are never opened automatically; camera is path-scoped and user initiated; generated output, GS1 allocation and print quality still require applicable interoperability checks | +| **`network-tools`** | Initial offline v0.1.0 release; dedicated repository | Calculate IP networks and construct or inspect common network values | IPv4/IPv6 canonicalization and CIDR ranges; URL/query parsing without navigation; DNS-record construction; response-header inspection; CSP builder; MIME reference | Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations | +| **`geo-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, convert, simplify and analyse geospatial files | GeoJSON, GPX, KML and coordinate CSV; WGS 84 bounds, distance and elevation; Douglas–Peucker simplification; decimal/DMS conversion; coordinate-only sketch | Small Point/LineString/Polygon model with scalar properties; conversion losses are explicit; no CRS transformation, basemap request or survey-grade claim | +| **`helper-tools`** | Initial v0.1.0 app and reusable package release | Encode, convert, inspect and calculate with shared bounded primitives | Base/byte/text/URL conversion; Unicode and line transforms; exact number and unit conversion; hashes; CIDR; timestamps; hardened JSON/CSV; secure and seeded random primitives; deep-linked calculator workspaces | Framework-free `@add-ideas/toolbox-helpers` package is consumed directly by eleven v0.1 apps; operations disclose strictness, limits and non-cryptographic seeded boundaries | +| **`rand-tools`** | Initial local-first v0.1.0 release; dedicated repository | Generate secure or reproducible random values through focused workspaces | Unbiased WebCrypto integers/strings; seeded reproducible generation; UUIDv4/v7 and ULID; dice; sampling, shuffle, passphrases and normal distribution; optional RANDOM.ORG integers | Secure local generation never falls back; deterministic output is not secret; the one remote source requires explicit per-session consent and a path-specific CSP and may still be unavailable through CORS or service limits | +| **`data-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect, format, query, flatten and convert structured data | JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; all-format conversion with loss/coercion reports; spreadsheet-formula neutralization | Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability | +| **`diff-tools`** | Initial local-first v0.1.0 release; dedicated repository | Compare text, JSON, XML and delimited data semantically | Line/word/code-point/grapheme text diff; exact newline state; object-aware exact-number JSON and RFC 6902; namespace-aware XML rules; keyed CSV/TSV; unified/side-by-side views and portable reports | Normalization settings and ignored distinctions remain visible; bounded disposable worker; v0.1 intentionally excludes images, binary documents, directories and archives | +| **`time-tools`** | Initial local-first v0.1.0 release; dedicated repository | Convert timestamps and explore zones, arithmetic and recurrence | Exact signed nanosecond epochs; IANA-zone comparisons and DST ambiguity; wall-clock versus elapsed arithmetic; bounded cron and RRULE previews; business days; escaped UTC ICS export | Uses the browser's IANA data and does not model leap seconds; regional holidays are never inferred; recurrence and skipped/ambiguous local-time choices are explicit | +| **`text-tools`** | Initial local-first v0.1.0 release; dedicated repository | Build ordered, inspectable plain-text transformation pipelines | Line endings, trimming, whitespace, sort/deduplicate, locale case, Unicode normalization, transliteration, escapes, wrapping, columns, explicit file decoding and versioned recipes | Exact source/result and per-step changes stay visible; compatibility normalization, transliteration, narrow encodings and selected transforms warn when they may be lossy | +| **`unicode-tools`** | Initial local-first v0.1.0 release; dedicated repository | Search and inspect Unicode characters, emoji, scripts, text and confusables | Checksum-pinned Unicode 17.0 catalogue; character/alias/code-point search; emoji and named sequences; UTF-8/UTF-16/escape inspection; grapheme segmentation; normalization; UTS #39 skeleton; selected Unihan fields; symbol collections | Official Unicode data is redistributed under Unicode-3.0 and is not scraped from symbol sites; private-use and surrogate ranges are not misrepresented as assigned characters; confusable and mixed-script results are review signals, not security verdicts | ## Planned tools -| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | -| -------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **`flow-tools`** | Later platform layer | Compose local processing operations across tools | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations | -| **`file-tools`** | High priority; dedicated repository | Identify, inspect and organize local files | Magic-byte detection; hex view; decoded strings; checksums; directory manifests; split/join; duplicate detection; trailing-data detection; batch-rename preview | All inputs are untrusted; format inspectors require strict size and nesting limits; natural entry point to archive, privacy, crypto and package tools | -| **`image-tools`** | High priority; dedicated repository | Edit and batch-process raster images | Crop, resize, rotate, compress, convert, contact sheets, sprites, responsive sets, favicon generation, metadata removal and visual quality comparison | Use workers and off-main-thread rendering; preserve or deliberately remove colour profiles; integrate with colour, SVG, PDF and privacy tools | -| **`subtitle-tools`** | Medium priority; dedicated repository | Edit, validate and synchronize captions | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses | -| **`midi-tools`** | Medium specialist app | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional | | -| **`3d-tools`** | Large specialist app | Inspect STL, OBJ and glTF; dimensions, bounding boxes, mesh simplification and common geometry defects; worker/GPU use and file limits | | -| **`query-tools`** | High-value but large; dedicated repository | Analyse local tabular and relational data with SQL | CSV, JSON, NDJSON, Parquet and SQLite; schema inference; joins; aggregation; pivots; charts; export to common data formats | WASM memory and streaming; distinguish this analytical product from document-oriented `data-tools`; query work must remain local | -| **`epub-tools`** | Medium app | EPUB inspection, metadata and cover editing, link validation, chapter extraction and structural repair; sanitize embedded HTML and SVG | | -| **`scan-tools`** | Large app | Camera/document correction; crop, deskew and threshold; page assembly; local OCR; PDF output; model downloads and memory use must be explicit | | -| **`package-tools`** | Medium priority | Inspect compound and package-based formats | EPUB; DOCX/XLSX/PPTX; ODF; JAR; APK; browser extensions; package trees; manifests; relationships; embedded media; signatures; orphaned parts | Generic container inspector with format adapters; complements rather than replaces `onenote-tools`, `epub-tools` and `office-tools` | -| **`archive-tools`** | Medium-to-high priority; dedicated repository | Inspect, create, compare and extract archives | ZIP, TAR, gzip and selected additional formats; selective extraction; content preview; deterministic archives; timestamp normalization; archive comparison | Expansion-ratio, entry-count and total-size limits; traversal-safe extraction; never execute extracted files | -| **`privacy-tools`** | High priority; dedicated repository | Inspect and remove metadata before sharing | EXIF and GPS; document author/comments; embedded thumbnails; PDF metadata and attachments; hidden package entries; AV tags; personal filenames; structured safe-sharing report | Never promise absolute anonymity; explicitly state inspected, removed, preserved and unsupported structures; integrate with most file-oriented apps | -| **`crypto-tools`** | Planned; dedicated repository | Inspect keys, certificates and signatures; validate chains | X.509 PEM/DER, CSR, CRL, PKCS #8, encrypted PKCS #8, PKCS #12/PFX, JWK/JWKS; key/certificate matching; path construction; hostname, purpose and time checks; CMS/JWS later | Inspection-first; explicit trust anchors; no implication that browser/OS trust stores are used; no private-key persistence; offline revocation first; network checks opt-in; restrictive CSP and worker isolation | -| **`barcode-tools`** | Planned; dedicated repository | Generate, inspect and decode QR and barcodes | QR, common one- and two-dimensional codes; camera/image decoding; GS1 assistance; CSV batch generation; quiet-zone and print-size checks; structured payload builders | Treat decoded payloads as untrusted; never open links automatically; camera permission must be optional; integrate with `label-tools`, `contact-tools` and `crypto-tools` | -| **`label-tools`** | Medium priority; dedicated repository | Generate labels and badges from templates and data | CSV/JSON merge into SVG templates; QR/barcode fields; serial numbers; A4 label sheets; badges; asset tags; cut marks; calibration | Strong suite demonstration linking data, SVG, barcode, random and PDF capabilities; print dimensions must be explicit and testable | -| **`font-tools`** | Medium priority; dedicated repository | Inspect, preview and prepare fonts | Glyph coverage; variable axes; metadata; fallback comparison; subsetting; CSS generation; arbitrary-text previews | Font licensing and embedding restrictions must be visible; use untrusted-font isolation and strict parser limits | -| **`fixture-tools`** | Medium priority | Generate deterministic test data | JSON Schema, XSD, SQL DDL, CSV headings or interactive models to JSON, CSV, XML, SQL and NDJSON; foreign keys; distributions; boundary and invalid cases | Seeded reproducibility; uniqueness constraints; privacy-safe synthetic data; natural extension of `rand-tools` | -| **`minimize-tools`** | Distinctive specialist tool | Reduce a failing input while preserving a failure | Minimize XML triggering an XSLT error; shortest regex pathological input; smallest JSON schema failure; selectable failure predicates | Expensive repeated execution must be bounded and cancellable; record the exact predicate and transformation versions | -| **`format-lab`** | Later, distinctive product | Explore conversion paths and information loss | Format graph; round-trip tests; property preservation; type coercion; metadata loss; recommended path selection across data, image, AV and subtitle formats | No conversion should be described as lossless without testing relevant properties | -| **`repro-tools`** | Medium-to-later | Create manifests and provenance records | File hashes; directory manifests; operation history; tool/version/parameter records; deterministic package creation; verification reports | Useful foundation for reproducible workflows and signed manifests; integrates with crypto, archive and flow tools | -| **`schema-tools`** | Dedicated specialist app | Validate, inspect and generate examples for JSON Schema, XSD, Relax NG, Schematron and OpenAPI; visualize references and incompatibilities | | -| **`log-tools`** | Dedicated app | Stream and filter large logs; parse common formats; correlate records; build timelines; extract fields; anonymize values; avoid loading the complete file into memory | | -| **`network-tools`** | Helper family or small app | IPv4/IPv6 subnetting; CIDR ranges; URL and query parsing; DNS-record construction; HTTP headers; CSP generation; MIME lookup; avoid turning it into an intrusive scanner | | -| **`binary-tools`** | Dedicated specialist app | Base64, hexadecimal, CBOR, MessagePack, ASN.1 and Protocol Buffers; schema-assisted decoding; byte-range highlighting; strict depth and size limits | | -| **`git-tools`** | Small-to-medium app | Patch inspection and editing; `.gitignore` testing; semantic-version comparison; conventional commits; changelog normalization; no repository-hosting dependency | | -| **`api-tools`** | Medium app | OpenAPI validation; request and response examples; curl and client-command generation; saved HTTP-exchange inspection; direct browser requests remain subject to CORS | | -| **`mail-tools`** | Medium app | EML and MIME inspection; header analysis; attachment extraction; body-part comparison; HTML mail must be heavily sandboxed | | -| **`calendar-tools`** | Small-to-medium app | ICS inspection, merging, deduplication, repair, recurrence visualization and timezone diagnostics | | -| **`contact-tools`** | Small-to-medium app | vCard inspection and editing; CSV mapping; deduplication; contact QR generation; treat all contact data as sensitive | | -| **`geo-tools`** | Medium app | GeoJSON, GPX, KML and coordinate CSV; format conversion; track simplification; distance/elevation analysis; coordinate-reference assumptions must be explicit | | -| **`diagram-tools`** | Medium app | Code and visual editing for Mermaid, Graphviz and related representations; renderers require sanitization and sandboxing | | -| **`token-tools`** | Small-to-medium app | Design-token editing and conversion between JSON, CSS custom properties, Sass, Android and iOS forms; integrate with colour and SVG tools | | -| **`device-tools`** | Specialist app | Serial terminal, sensor logger, microcontroller console and controlled firmware installation; explicit permission and browser-capability checks | | - -## Planned helpers - -Helpers export funcionality for other tools to use. They may also present a tool surface to be used directly - -| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | -| ------------------- | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -| **`helpers-tools`** | One shared artifact with deep links | Stateless Base64, URL encoding, case conversion, number bases, Unicode code points, unit conversion, small checksums, subnet and timestamp calculators; avoid a repository per calculator | | -| **`rand-tools`** | Planned; small dedicated repository | Generate random numbers, strings, identifiers and samples | Cryptographically secure generation; deterministic seeded generation; UUIDs, ULIDs, passphrases, dice notation, distributions, weighted selection and shuffling | Clearly separate secure randomness from reproducible pseudorandomness; no misleading “strength” claims; natural foundation for `fixture-tools` | -| **`data-tools`** | High priority; dedicated repository | Inspect, edit, validate, query and convert structured data | JSON, YAML, TOML, XML, CSV and NDJSON; tree/table/source views; schema inference; flattening; filtering; field mapping; JSONPath-style queries; conversion recipes | Every conversion should disclose information loss, coercion and round-trip instability; XML-specialist workflows hand off to `xslt-tools` | -| **`diff-tools`** | High priority; dedicated repository or shared engine plus UI | Compare documents and files semantically | Text; JSON object-aware comparison; XML normalization; CSV keyed comparison; images with overlay/heatmap; archives and directories; PDF pages; optional audio waveform comparison | Normalization and ignored properties must be visible; produce portable reports and standard patch formats where possible | -| **`text-tools`** | Medium priority; one app with deep-linked panels | Transform and normalize plain text | Unicode normalization; line-ending conversion; encoding; sorting; deduplication; case changes; transliteration; escaping; column operations; transformation pipelines | Preserve exact input/output visibility; warn about lossy encodings and Unicode confusables; integrate regex operations | -| **`time-tools`** | Medium priority; small dedicated app or helper family | Work with dates, timestamps, time zones and recurrences | Unix timestamps; date arithmetic; durations; ISO 8601; timezone comparison; cron; RRULE; ICS generation; business days; DST-transition visualization | Visualize actual recurrence instances and ambiguous/skipped local times; do not rely on simplified fixed-offset calculations | +| Tool | State and boundary | Principal workflows | Important concrete scope | Critical considerations and integrations | +| -------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **`flow-tools`** | Later platform layer | Compose local processing operations across tools | Example: CSV → filter → QR generation → SVG template → PDF → ZIP; reusable recipes; typed inputs and outputs; progress and cancellation | Do not load complete React applications into one runtime; expose separate worker-safe operation packages only after several apps have stable operations | +| **`subtitle-tools`** | Medium priority; dedicated repository | Edit, validate and synchronize captions | SRT, WebVTT and ASS; timing shifts; stretching; frame-rate conversion; overlap and reading-speed checks; waveform synchronization; revision comparison | Direct integration with `av-tools`; preserve style information when supported and disclose conversion losses | +| **`midi-tools`** | Medium specialist app | MIDI event inspection and editing; transpose, quantize, tempo maps and controller data; device access should remain optional | | +| **`3d-tools`** | Large specialist app | Inspect STL, OBJ and glTF; dimensions, bounding boxes, mesh simplification and common geometry defects; worker/GPU use and file limits | | +| **`query-tools`** | High-value but large; dedicated repository | Analyse local tabular and relational data with SQL | CSV, JSON, NDJSON, Parquet and SQLite; schema inference; joins; aggregation; pivots; charts; export to common data formats | WASM memory and streaming; distinguish this analytical product from document-oriented `data-tools`; query work must remain local | +| **`scan-tools`** | Large app | Camera/document correction; crop, deskew and threshold; page assembly; local OCR; PDF output; model downloads and memory use must be explicit | | +| **`package-tools`** | Medium priority | Inspect compound and package-based formats | EPUB; DOCX/XLSX/PPTX; ODF; JAR; APK; browser extensions; package trees; manifests; relationships; embedded media; signatures; orphaned parts | Generic container inspector with format adapters; complements rather than replaces `onenote-tools`, `epub-tools` and `office-tools` | +| **`label-tools`** | Medium priority; dedicated repository | Generate labels and badges from templates and data | CSV/JSON merge into SVG templates; QR/barcode fields; serial numbers; A4 label sheets; badges; asset tags; cut marks; calibration | Strong suite demonstration linking data, SVG, barcode, random and PDF capabilities; print dimensions must be explicit and testable | +| **`font-tools`** | Medium priority; dedicated repository | Inspect, preview and prepare fonts | Glyph coverage; variable axes; metadata; fallback comparison; subsetting; CSS generation; arbitrary-text previews | Font licensing and embedding restrictions must be visible; use untrusted-font isolation and strict parser limits | +| **`fixture-tools`** | Medium priority | Generate deterministic test data | JSON Schema, XSD, SQL DDL, CSV headings or interactive models to JSON, CSV, XML, SQL and NDJSON; foreign keys; distributions; boundary and invalid cases | Seeded reproducibility; uniqueness constraints; privacy-safe synthetic data; natural extension of `rand-tools` | +| **`minimize-tools`** | Distinctive specialist tool | Reduce a failing input while preserving a failure | Minimize XML triggering an XSLT error; shortest regex pathological input; smallest JSON schema failure; selectable failure predicates | Expensive repeated execution must be bounded and cancellable; record the exact predicate and transformation versions | +| **`format-lab`** | Later, distinctive product | Explore conversion paths and information loss | Format graph; round-trip tests; property preservation; type coercion; metadata loss; recommended path selection across data, image, AV and subtitle formats | No conversion should be described as lossless without testing relevant properties | +| **`repro-tools`** | Medium-to-later | Create manifests and provenance records | File hashes; directory manifests; operation history; tool/version/parameter records; deterministic package creation; verification reports | Useful foundation for reproducible workflows and signed manifests; integrates with crypto, archive and flow tools | +| **`schema-tools`** | Dedicated specialist app | Validate, inspect and generate examples for JSON Schema, XSD, Relax NG, Schematron and OpenAPI; visualize references and incompatibilities | | +| **`log-tools`** | Dedicated app | Stream and filter large logs; parse common formats; correlate records; build timelines; extract fields; anonymize values; avoid loading the complete file into memory | | +| **`binary-tools`** | Dedicated specialist app | Base64, hexadecimal, CBOR, MessagePack, ASN.1 and Protocol Buffers; schema-assisted decoding; byte-range highlighting; strict depth and size limits | | +| **`git-tools`** | Small-to-medium app | Patch inspection and editing; `.gitignore` testing; semantic-version comparison; conventional commits; changelog normalization; no repository-hosting dependency | | +| **`api-tools`** | Medium app | OpenAPI validation; request and response examples; curl and client-command generation; saved HTTP-exchange inspection; direct browser requests remain subject to CORS | | +| **`mail-tools`** | Medium app | EML and MIME inspection; header analysis; attachment extraction; body-part comparison; HTML mail must be heavily sandboxed | | +| **`calendar-tools`** | Small-to-medium app | ICS inspection, merging, deduplication, repair, recurrence visualization and timezone diagnostics | | +| **`contact-tools`** | Small-to-medium app | vCard inspection and editing; CSV mapping; deduplication; contact QR generation; treat all contact data as sensitive | | +| **`diagram-tools`** | Medium app | Code and visual editing for Mermaid, Graphviz and related representations; renderers require sanitization and sandboxing | | +| **`token-tools`** | Small-to-medium app | Design-token editing and conversion between JSON, CSS custom properties, Sass, Android and iOS forms; integrate with colour and SVG tools | | +| **`device-tools`** | Specialist app | Serial terminal, sensor logger, microcontroller console and controlled firmware installation; explicit permission and browser-capability checks | | ## Licensing diff --git a/compose.example.yaml b/compose.example.yaml index 7ea722d..f3672d7 100644 --- a/compose.example.yaml +++ b/compose.example.yaml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Containerfile - image: git.add-ideas.de/lotobo/toolbox:0.17.0 + image: git.add-ideas.de/lotobo/toolbox:0.18.0 restart: unless-stopped read_only: true ports: diff --git a/compose.yaml b/compose.yaml index bdcadbc..99c398c 100644 --- a/compose.yaml +++ b/compose.yaml @@ -6,9 +6,9 @@ services: context: . dockerfile: Containerfile.release args: - TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.17.0}" - TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-116e0f335e593aef3d4b345dc6b8e37294ba4fb489ee48abdb0b46fa0251b4b9}" - image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.17.0}" + TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.18.0}" + TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-77100c45531cb53cb0638ed9407b9246571308659215f2df457f09613fd5351c}" + image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.18.0}" restart: unless-stopped read_only: true tmpfs: diff --git a/deploy/nginx.conf b/deploy/nginx.conf index c248737..179423d 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -14,9 +14,15 @@ map $uri $toolbox_access_control_allow_origin { "/apps/svg/canvas-frame-controller.js" "*"; } -map $host $toolbox_permissions_policy { +map "$host:$uri" $toolbox_permissions_policy { default "camera=(), microphone=(), geolocation=(), payment=(), usb=()"; - "auth.toolbox.add-ideas.de" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"; + "~^auth\.toolbox\.add-ideas\.de:" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"; + "~^[^:]+:/apps/barcode(?:/|$)" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"; +} + +map $uri $toolbox_connect_sources { + default "'self'"; + "~^/apps/rand(?:/|$)" "'self' https://www.random.org"; } server { @@ -37,7 +43,7 @@ server { add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always; add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always; add_header Permissions-Policy $toolbox_permissions_policy always; - add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always; + add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src $toolbox_connect_sources; worker-src 'self' blob:; manifest-src 'self'" always; add_header Cache-Control $toolbox_cache_control always; gzip on; diff --git a/package-lock.json b/package-lock.json index 27a493f..1d6de38 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.19", + "version": "0.2.20", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@add-ideas/toolbox-portal", - "version": "0.2.19", + "version": "0.2.20", "license": "AGPL-3.0-only", "dependencies": { "@add-ideas/toolbox-contract": "^0.2.3", @@ -2031,9 +2031,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -3432,9 +3432,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { @@ -3609,9 +3609,9 @@ } }, "node_modules/postcss": { - "version": "8.5.20", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.20.tgz", - "integrity": "sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==", + "version": "8.5.26", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", "dev": true, "funding": [ { @@ -3629,7 +3629,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.16", + "nanoid": "^3.3.17", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -4166,9 +4166,9 @@ } }, "node_modules/undici": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", - "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index d7a2e18..2174d80 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.19", + "version": "0.2.20", "license": "AGPL-3.0-only", "private": true, "type": "module", diff --git a/public/SOURCE.md b/public/SOURCE.md index 1cc30c8..ee95b0d 100644 --- a/public/SOURCE.md +++ b/public/SOURCE.md @@ -1,8 +1,8 @@ # Corresponding source -The source code corresponding to add·ideas Toolbox Portal 0.2.19 is available at: +The source code corresponding to add·ideas Toolbox Portal 0.2.20 is available at: -https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.17.0 +https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.18.0 Each bundled application contains its own `SOURCE.md`, license, and third-party license materials. The application sources are also linked from the portal. diff --git a/public/toolbox.catalog.json b/public/toolbox.catalog.json index 6d94135..f700906 100644 --- a/public/toolbox.catalog.json +++ b/public/toolbox.catalog.json @@ -48,6 +48,70 @@ { "manifest": "./apps/office/toolbox-app.json", "enabled": true + }, + { + "manifest": "./apps/image/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/file/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/epub/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/archive/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/privacy/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/crypto/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/barcode/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/network/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/geo/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/helper/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/rand/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/data/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/diff/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/time/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/text/toolbox-app.json", + "enabled": true + }, + { + "manifest": "./apps/unicode/toolbox-app.json", + "enabled": true } ] } diff --git a/release/toolbox.lock.example.json b/release/toolbox.lock.example.json index 2150c37..405c5c5 100644 --- a/release/toolbox.lock.example.json +++ b/release/toolbox.lock.example.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.17.0", - "portalVersion": "0.2.19", + "releaseVersion": "0.18.0", + "portalVersion": "0.2.20", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -82,6 +82,118 @@ "artifact": "https://git.add-ideas.de/lotobo/office-tools/releases/download/v0.1.0/office-tools-0.1.0.zip", "sha256": "3f950a413c74bae3b8f190954272fd91c9b141aab4fa50c936d5ad3741539aaf", "target": "office" + }, + { + "id": "de.add-ideas.image-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/image-tools/releases/download/v0.1.0/image-tools-0.1.0.zip", + "sha256": "8aa67d0c3cfd1060c261e9be108fb443384aaec95f82d3c1b96b63b2d07963e1", + "target": "image" + }, + { + "id": "de.add-ideas.file-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/file-tools/releases/download/v0.1.0/file-tools-0.1.0.zip", + "sha256": "9225ff60c639d563bb514ac390b5b2cbad4b8030a070e6398e7c200763c5f89e", + "target": "file" + }, + { + "id": "de.add-ideas.epub-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/epub-tools/releases/download/v0.1.0/epub-tools-0.1.0.zip", + "sha256": "834512494bbfba9918a9d8131efd512a09619a150823591e2d13ea385ced00e9", + "target": "epub" + }, + { + "id": "de.add-ideas.archive-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/archive-tools/releases/download/v0.1.0/archive-tools-0.1.0.zip", + "sha256": "88a8efb39129bb813c97fb4d80257ee339bbfcec2a73b080a0a89dc76cdd2958", + "target": "archive" + }, + { + "id": "de.add-ideas.privacy-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/privacy-tools/releases/download/v0.1.0/privacy-tools-0.1.0.zip", + "sha256": "0d6c071837b8ce705e456d44888378f3a7f9427a352f0bd4b60512f6c41465d4", + "target": "privacy" + }, + { + "id": "de.add-ideas.crypto-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/crypto-tools/releases/download/v0.1.0/crypto-tools-0.1.0.zip", + "sha256": "bfced32f44918214ffd31c5d4730aee7bffd75e7952e9a6d16b6eb7eb68fed35", + "target": "crypto" + }, + { + "id": "de.add-ideas.barcode-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/barcode-tools/releases/download/v0.1.0/barcode-tools-0.1.0.zip", + "sha256": "22cede58d279f15419b342862bf6545cace831d1e02c0634fbd01aeab3bd3e63", + "target": "barcode" + }, + { + "id": "de.add-ideas.network-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/network-tools/releases/download/v0.1.0/network-tools-0.1.0.zip", + "sha256": "7e493a0aed643c712c38057bcd67c360bc6712d5d31ea82c222bf780464ff4a1", + "target": "network" + }, + { + "id": "de.add-ideas.geo-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/geo-tools/releases/download/v0.1.0/geo-tools-0.1.0.zip", + "sha256": "88a46a56f3d3b5b61dc9bbb8795764b59aae1635da95120a0e499e33ef652e8f", + "target": "geo" + }, + { + "id": "de.add-ideas.helper-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/helper-tools/releases/download/v0.1.0/helper-tools-0.1.0.zip", + "sha256": "bcdbd2ffc721ed1a2e9432eea1f90d7b4526d86934c3b5de6f522fd8bd58fd77", + "target": "helper" + }, + { + "id": "de.add-ideas.rand-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip", + "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25", + "target": "rand" + }, + { + "id": "de.add-ideas.data-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/data-tools/releases/download/v0.1.0/data-tools-0.1.0.zip", + "sha256": "83ab02c9827d122c83b05c230e62c0ee87b330604acfff4990c58310f7956a1f", + "target": "data" + }, + { + "id": "de.add-ideas.diff-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/diff-tools/releases/download/v0.1.0/diff-tools-0.1.0.zip", + "sha256": "023311343152aac11bfc00d58029b24ef0efe5ee4113aeb2a9d000ebe2460d72", + "target": "diff" + }, + { + "id": "de.add-ideas.time-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/time-tools/releases/download/v0.1.0/time-tools-0.1.0.zip", + "sha256": "9a5545a3e684a207d7b2d6663d42a117cb5bb3303f35dc889a2651b67bfcf08f", + "target": "time" + }, + { + "id": "de.add-ideas.text-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/text-tools/releases/download/v0.1.0/text-tools-0.1.0.zip", + "sha256": "242eb15005a18e0f13ba03544c633834416707e2629585868bfcd6f0c1cc5aec", + "target": "text" + }, + { + "id": "de.add-ideas.unicode-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/unicode-tools/releases/download/v0.1.0/unicode-tools-0.1.0.zip", + "sha256": "1cf557d3ace9a41c7fa72cb5c1b149e669203a682174939f2e3aa376e1c6f22a", + "target": "unicode" } ] } diff --git a/release/toolbox.lock.json b/release/toolbox.lock.json index 2150c37..405c5c5 100644 --- a/release/toolbox.lock.json +++ b/release/toolbox.lock.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.17.0", - "portalVersion": "0.2.19", + "releaseVersion": "0.18.0", + "portalVersion": "0.2.20", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -82,6 +82,118 @@ "artifact": "https://git.add-ideas.de/lotobo/office-tools/releases/download/v0.1.0/office-tools-0.1.0.zip", "sha256": "3f950a413c74bae3b8f190954272fd91c9b141aab4fa50c936d5ad3741539aaf", "target": "office" + }, + { + "id": "de.add-ideas.image-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/image-tools/releases/download/v0.1.0/image-tools-0.1.0.zip", + "sha256": "8aa67d0c3cfd1060c261e9be108fb443384aaec95f82d3c1b96b63b2d07963e1", + "target": "image" + }, + { + "id": "de.add-ideas.file-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/file-tools/releases/download/v0.1.0/file-tools-0.1.0.zip", + "sha256": "9225ff60c639d563bb514ac390b5b2cbad4b8030a070e6398e7c200763c5f89e", + "target": "file" + }, + { + "id": "de.add-ideas.epub-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/epub-tools/releases/download/v0.1.0/epub-tools-0.1.0.zip", + "sha256": "834512494bbfba9918a9d8131efd512a09619a150823591e2d13ea385ced00e9", + "target": "epub" + }, + { + "id": "de.add-ideas.archive-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/archive-tools/releases/download/v0.1.0/archive-tools-0.1.0.zip", + "sha256": "88a8efb39129bb813c97fb4d80257ee339bbfcec2a73b080a0a89dc76cdd2958", + "target": "archive" + }, + { + "id": "de.add-ideas.privacy-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/privacy-tools/releases/download/v0.1.0/privacy-tools-0.1.0.zip", + "sha256": "0d6c071837b8ce705e456d44888378f3a7f9427a352f0bd4b60512f6c41465d4", + "target": "privacy" + }, + { + "id": "de.add-ideas.crypto-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/crypto-tools/releases/download/v0.1.0/crypto-tools-0.1.0.zip", + "sha256": "bfced32f44918214ffd31c5d4730aee7bffd75e7952e9a6d16b6eb7eb68fed35", + "target": "crypto" + }, + { + "id": "de.add-ideas.barcode-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/barcode-tools/releases/download/v0.1.0/barcode-tools-0.1.0.zip", + "sha256": "22cede58d279f15419b342862bf6545cace831d1e02c0634fbd01aeab3bd3e63", + "target": "barcode" + }, + { + "id": "de.add-ideas.network-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/network-tools/releases/download/v0.1.0/network-tools-0.1.0.zip", + "sha256": "7e493a0aed643c712c38057bcd67c360bc6712d5d31ea82c222bf780464ff4a1", + "target": "network" + }, + { + "id": "de.add-ideas.geo-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/geo-tools/releases/download/v0.1.0/geo-tools-0.1.0.zip", + "sha256": "88a46a56f3d3b5b61dc9bbb8795764b59aae1635da95120a0e499e33ef652e8f", + "target": "geo" + }, + { + "id": "de.add-ideas.helper-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/helper-tools/releases/download/v0.1.0/helper-tools-0.1.0.zip", + "sha256": "bcdbd2ffc721ed1a2e9432eea1f90d7b4526d86934c3b5de6f522fd8bd58fd77", + "target": "helper" + }, + { + "id": "de.add-ideas.rand-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/rand-tools/releases/download/v0.1.0/rand-tools-0.1.0.zip", + "sha256": "1dff2cf2165b04f171b12cb2303fe6b005eedf59c58ae839b77c40cc46c4bf25", + "target": "rand" + }, + { + "id": "de.add-ideas.data-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/data-tools/releases/download/v0.1.0/data-tools-0.1.0.zip", + "sha256": "83ab02c9827d122c83b05c230e62c0ee87b330604acfff4990c58310f7956a1f", + "target": "data" + }, + { + "id": "de.add-ideas.diff-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/diff-tools/releases/download/v0.1.0/diff-tools-0.1.0.zip", + "sha256": "023311343152aac11bfc00d58029b24ef0efe5ee4113aeb2a9d000ebe2460d72", + "target": "diff" + }, + { + "id": "de.add-ideas.time-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/time-tools/releases/download/v0.1.0/time-tools-0.1.0.zip", + "sha256": "9a5545a3e684a207d7b2d6663d42a117cb5bb3303f35dc889a2651b67bfcf08f", + "target": "time" + }, + { + "id": "de.add-ideas.text-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/text-tools/releases/download/v0.1.0/text-tools-0.1.0.zip", + "sha256": "242eb15005a18e0f13ba03544c633834416707e2629585868bfcd6f0c1cc5aec", + "target": "text" + }, + { + "id": "de.add-ideas.unicode-tools", + "version": "0.1.0", + "artifact": "https://git.add-ideas.de/lotobo/unicode-tools/releases/download/v0.1.0/unicode-tools-0.1.0.zip", + "sha256": "1cf557d3ace9a41c7fa72cb5c1b149e669203a682174939f2e3aa376e1c6f22a", + "target": "unicode" } ] } diff --git a/scripts/assembler.test.ts b/scripts/assembler.test.ts index 4a41651..fe33bba 100644 --- a/scripts/assembler.test.ts +++ b/scripts/assembler.test.ts @@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) { return { schemaVersion: 1, releaseVersion: '0.1.0', - portalVersion: '0.2.19', + portalVersion: '0.2.20', catalogue: { id: 'de.add-ideas.toolbox', name: 'Test Toolbox', diff --git a/scripts/deployment.test.ts b/scripts/deployment.test.ts index caed778..750c9c7 100644 --- a/scripts/deployment.test.ts +++ b/scripts/deployment.test.ts @@ -22,7 +22,39 @@ const nginxConfig = readFileSync( ); const releaseLock = JSON.parse( readFileSync(path.join(projectRoot, 'release', 'toolbox.lock.json'), 'utf8') -) as { releaseVersion: string }; +) as { releaseVersion: string; apps: Array<{ target: string }> }; +const developmentCatalogue = JSON.parse( + readFileSync(path.join(projectRoot, 'public', 'toolbox.catalog.json'), 'utf8') +) as { apps: Array<{ manifest: string; enabled: boolean }> }; + +const expectedAppTargets = [ + 'pdf', + 'xslt', + 'onenote', + 'av', + 'regex', + 'svg', + 'auth', + 'sudoku', + 'colour', + 'office', + 'image', + 'file', + 'epub', + 'archive', + 'privacy', + 'crypto', + 'barcode', + 'network', + 'geo', + 'helper', + 'rand', + 'data', + 'diff', + 'time', + 'text', + 'unicode', +] as const; const immutableCacheControl = 'public, max-age=31536000, immutable'; const immutableUriPatterns = Array.from( @@ -85,18 +117,7 @@ describe('production deployment', () => { expect(containerfile).toContain( 'COPY --from=release --chown=101:101 /tmp/toolbox/' ); - for (const app of [ - 'pdf', - 'xslt', - 'onenote', - 'av', - 'regex', - 'svg', - 'auth', - 'sudoku', - 'colour', - 'office', - ]) { + for (const app of expectedAppTargets) { expect(containerfile).toContain( `test -f /tmp/toolbox/apps/${app}/toolbox-app.json` ); @@ -104,6 +125,18 @@ describe('production deployment', () => { expect(containerfile).toMatch(/\nUSER 101:101\nEXPOSE 8080\n/u); }); + it('keeps the development catalogue aligned with all release targets', () => { + expect(releaseLock.apps.map(({ target }) => target)).toEqual( + expectedAppTargets + ); + expect(developmentCatalogue.apps).toEqual( + expectedAppTargets.map((target) => ({ + manifest: `./apps/${target}/toolbox-app.json`, + enabled: true, + })) + ); + }); + it('uses only the requested external Traefik network and redirects HTTP to HTTPS', () => { expect(compose).toContain('dockerfile: Containerfile.release'); expect(compose).toContain('traefik.enable: "true"'); @@ -169,9 +202,9 @@ describe('production deployment', () => { expect(compose).not.toContain('addideas-auth-stripprefix'); }); - it('grants camera capture only to the isolated authentication hostname', () => { + it('grants camera only to the isolated authentication host and barcode path', () => { expect(nginxConfig).toMatch( - /map \$host \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"auth\.toolbox\.add-ideas\.de" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu + /map "\$host:\$uri" \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^auth\\\.toolbox\\\.add-ideas\\\.de:" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"~\^\[\^:\]\+:\/apps\/barcode\(\?:\/\|\$\)" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu ); expect(nginxConfig).toContain( 'add_header Permissions-Policy $toolbox_permissions_policy always;' @@ -181,6 +214,16 @@ describe('production deployment', () => { ).toHaveLength(1); }); + it('allows RANDOM.ORG only for the explicitly opt-in Random Tools path', () => { + expect(nginxConfig).toMatch( + /map \$uri \$toolbox_connect_sources\s*\{\s*default "'self'";\s*"~\^\/apps\/rand\(\?:\/\|\$\)" "'self' https:\/\/www\.random\.org";\s*\}/mu + ); + expect(nginxConfig).toMatch( + /^\s*add_header Content-Security-Policy "[^"]*connect-src \$toolbox_connect_sources;[^"]*" always;$/mu + ); + expect(nginxConfig.match(/https:\/\/www\.random\.org/gu)).toHaveLength(1); + }); + it('quotes nginx regular expressions that contain brace quantifiers', () => { expect(nginxConfig).toContain( '"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\\.[^/]+$"' diff --git a/src/App.tsx b/src/App.tsx index a6cd396..3ccadff 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -489,9 +489,9 @@ export default function App() {

- Portal v0.2.19 ·{' '} + Portal v0.2.20 ·{' '}