diff --git a/.env.example b/.env.example index 7c135e0..ff71a61 100644 --- a/.env.example +++ b/.env.example @@ -5,5 +5,5 @@ TRAEFIK_NETWORK=internal TRAEFIK_CERT_RESOLVER=netcup # Keep these two values paired when deploying a newer published toolbox release. -TOOLBOX_RELEASE_VERSION=0.12.0 -TOOLBOX_RELEASE_SHA256=70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc +TOOLBOX_RELEASE_VERSION=0.13.0 +TOOLBOX_RELEASE_SHA256=ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891 diff --git a/Containerfile.release b/Containerfile.release index 422f535..9a1e3ee 100644 --- a/Containerfile.release +++ b/Containerfile.release @@ -2,8 +2,8 @@ ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.31.3-alpine@sha256:18d67281256ded3 FROM ${NGINX_IMAGE} AS release -ARG TOOLBOX_RELEASE_VERSION=0.12.0 -ARG TOOLBOX_RELEASE_SHA256=70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc +ARG TOOLBOX_RELEASE_VERSION=0.13.0 +ARG TOOLBOX_RELEASE_SHA256=ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891 ARG TOOLBOX_RELEASE_BASE_URL=https://git.add-ideas.de/lotobo/toolbox-portal/releases/download RUN set -eu; \ diff --git a/README.md b/README.md index 5a96b56..fe808b7 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # add·ideas Toolbox Portal `toolbox-portal` is the static launcher and release assembler for the add·ideas -browser toolbox. Version `0.2.14` reads one same-origin catalogue, shows each app +browser toolbox. Version `0.2.15` reads one same-origin catalogue, shows each app as a compact launch tile, and keeps personal pins, drag-and-drop ordering, visibility, and appearance in the current browser. Pinned tools have their own section; search, category, and clickable tag filters stay close to the tool @@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported ## Production deployment behind Traefik The committed `compose.yaml` is the shortest production path. Its release -container downloads the immutable Toolbox 0.12.0 ZIP during the image build, +container downloads the immutable Toolbox 0.13.0 ZIP during the image build, verifies SHA-256 before extracting it, and then copies only the verified static files into the pinned unprivileged nginx image. Node.js and a local portal assembly are not required on the deployment host. @@ -106,9 +106,11 @@ prefix while the public URL remains `/`, so assets remain relative and the brows binds WebAuthn credentials to the dedicated `auth.toolbox.add-ideas.de` RP ID. The main Toolbox copy at `/apps/auth/` remains useful for offline inspection but disables live ceremonies because all Portal apps share that origin. The router -hostname can be overridden with `AUTH_TOOLS_HOST`, but auth-tools 0.2.0 enables -live ceremonies only on its pinned production host (or localhost); other hosts -remain inspect-only. Never widen the RP ID to `add-ideas.de`. +hostname can be overridden with `AUTH_TOOLS_HOST`, but the bundled Auth Tools +release enables live ceremonies only on its pinned production host (or +localhost); other hosts remain inspect-only. A different production host +therefore also requires rebuilding Auth Tools with the new exact host. Never +widen the RP ID to `add-ideas.de`. The external network is deliberately not created by this project. Creating a private project-local network would prevent an independently managed Traefik @@ -131,10 +133,10 @@ The app release should also publish a matching `.sha256` sidecar. The manifest must declare the pinned reverse-DNS id and version. Application and portal versions are independent. -`release/toolbox.lock.json` is the reviewed v0.12.0 lock. Its URLs and checksums +`release/toolbox.lock.json` is the reviewed v0.13.0 lock. Its URLs and checksums pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, and OTP & Passkey -Tools 0.2.0 release bytes. Use +Tools 0.3.0 release bytes. Use `release/toolbox.lock.example.json` as the template for a future release and verify every downloaded asset before committing updated values. Artifacts may be: @@ -155,7 +157,7 @@ npm run assemble -- \ --lock release/toolbox.lock.json \ --portal-dist dist \ --output build/toolbox \ - --archive build/add-ideas-toolbox-0.12.0.zip + --archive build/add-ideas-toolbox-0.13.0.zip ``` Existing output is refused. Pass `--force` only when replacing those exact @@ -179,8 +181,8 @@ build/toolbox/ ├── svg/ └── auth/ -build/add-ideas-toolbox-0.12.0.zip -build/add-ideas-toolbox-0.12.0.zip.sha256 +build/add-ideas-toolbox-0.13.0.zip +build/add-ideas-toolbox-0.13.0.zip.sha256 ``` The assembler verifies SHA-256 before opening an artifact, validates every app @@ -201,7 +203,7 @@ directory separately: ```sh npm run package:static -- \ --input build/toolbox \ - --output artifacts/add-ideas-toolbox-0.12.0.zip + --output artifacts/add-ideas-toolbox-0.13.0.zip ``` This also emits a `.sha256` sidecar. @@ -214,7 +216,14 @@ immutable caching only for Vite-hashed assets and narrowly matched semver-versioned FFmpeg core files, and revalidation for all other files. The opaque-origin SVG preview iframe loads its packaged controller with a URI-exact CORS and cross-origin resource-policy exception; all other files retain the -same-origin policy and every normal security header. Assemble first, then: +same-origin policy and every normal security header. Camera access is denied on +the shared Toolbox host and granted only to the dedicated +`auth.toolbox.add-ideas.de` origin, where Auth Tools still requests it only +after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the +exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host at +the same time; the default-deny fallback deliberately does not infer camera +grants from request paths. +Assemble first, then: The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's `ixsl:eval()` extension is therefore unsupported in this deployment profile; @@ -222,9 +231,9 @@ normal local XML/XSLT transformations do not require that permission. ```sh podman build -f Containerfile \ - -t git.add-ideas.de/lotobo/toolbox:0.12.0 . + -t git.add-ideas.de/lotobo/toolbox:0.13.0 . podman run --rm -p 8080:8080 \ - git.add-ideas.de/lotobo/toolbox:0.12.0 + git.add-ideas.de/lotobo/toolbox:0.13.0 ``` For a direct-port local deployment after assembly, use the separate example: @@ -241,8 +250,8 @@ docker login git.add-ideas.de docker buildx build \ --platform linux/amd64,linux/arm64 \ --file Containerfile.release \ - --tag git.add-ideas.de/lotobo/toolbox:0.12.0 \ - --tag git.add-ideas.de/lotobo/toolbox:0.11 \ + --tag git.add-ideas.de/lotobo/toolbox:0.13.0 \ + --tag git.add-ideas.de/lotobo/toolbox:0.13 \ --push . ``` @@ -267,8 +276,8 @@ needs permission to push code, releases, and container packages to all seven apps, switch between them, and confirm the encoded `toolbox` context. 5. Verify the distribution with - `(cd build && sha256sum -c add-ideas-toolbox-0.12.0.zip.sha256)`. -6. Commit the reviewed lock, tag the toolbox release (for example `v0.12.0`), and + `(cd build && sha256sum -c add-ideas-toolbox-0.13.0.zip.sha256)`. +6. Commit the reviewed lock, tag the toolbox release (for example `v0.13.0`), and push the branch and tag to Gitea. 7. In Gitea, open **Releases → New release**, select the tag, and upload the static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a @@ -291,7 +300,7 @@ must not re-resolve app versions or substitute a newer release. | **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable | | **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics | | **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository | -| **`auth-tools`** | Current local-first v0.2.0 release; dedicated repository | Generate, inspect and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP, TOTP, OCRA, T0/time travel, drift/timelines/vectors, multi-QR and authenticator-backup migration, QR decode, health reports and encrypted export; bounded CBOR/authenticator-data inspection; assertion and attestation verification; imported FIDO metadata; ephemeral browser ceremony lab | OTP material remains memory-only unless explicitly exported; attestation signature, metadata and trust are reported separately; live ceremonies are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin (or localhost), while the Portal path remains inspect-only; no raw CTAP or token administration | +| **`auth-tools`** | Current local-first v0.3.0 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration | ## Planned tools diff --git a/compose.example.yaml b/compose.example.yaml index 5dec905..e5ebd21 100644 --- a/compose.example.yaml +++ b/compose.example.yaml @@ -3,7 +3,7 @@ services: build: context: . dockerfile: Containerfile - image: git.add-ideas.de/lotobo/toolbox:0.12.0 + image: git.add-ideas.de/lotobo/toolbox:0.13.0 restart: unless-stopped read_only: true ports: diff --git a/compose.yaml b/compose.yaml index 34884ac..7612a1a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -6,9 +6,9 @@ services: context: . dockerfile: Containerfile.release args: - TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.12.0}" - TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-70f374d96a6b7d83bd011a9c7aa3d57edbb3dd46ff284e25c99edf8855ee14dc}" - image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.12.0}" + TOOLBOX_RELEASE_VERSION: "${TOOLBOX_RELEASE_VERSION:-0.13.0}" + TOOLBOX_RELEASE_SHA256: "${TOOLBOX_RELEASE_SHA256:-ae8d96906ad6794c1c387863dbd0d6d31e1c5deeef7640362f8a479dbf3f3891}" + image: "git.add-ideas.de/lotobo/toolbox:${TOOLBOX_RELEASE_VERSION:-0.13.0}" restart: unless-stopped read_only: true tmpfs: diff --git a/deploy/nginx.conf b/deploy/nginx.conf index a9b622d..c248737 100644 --- a/deploy/nginx.conf +++ b/deploy/nginx.conf @@ -14,6 +14,11 @@ map $uri $toolbox_access_control_allow_origin { "/apps/svg/canvas-frame-controller.js" "*"; } +map $host $toolbox_permissions_policy { + default "camera=(), microphone=(), geolocation=(), payment=(), usb=()"; + "auth.toolbox.add-ideas.de" "camera=(self), microphone=(), geolocation=(), payment=(), usb=()"; +} + server { listen 8080; listen [::]:8080; @@ -31,7 +36,7 @@ server { add_header Cross-Origin-Embedder-Policy "require-corp" always; add_header Cross-Origin-Resource-Policy $toolbox_resource_policy always; add_header Access-Control-Allow-Origin $toolbox_access_control_allow_origin always; - add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always; + add_header Permissions-Policy $toolbox_permissions_policy always; add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'" always; add_header Cache-Control $toolbox_cache_control always; diff --git a/package-lock.json b/package-lock.json index e9f913c..c7754a6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.14", + "version": "0.2.15", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@add-ideas/toolbox-portal", - "version": "0.2.14", + "version": "0.2.15", "license": "AGPL-3.0-only", "dependencies": { "@add-ideas/toolbox-contract": "^0.2.3", diff --git a/package.json b/package.json index 59a070e..f8d730c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@add-ideas/toolbox-portal", - "version": "0.2.14", + "version": "0.2.15", "license": "AGPL-3.0-only", "private": true, "type": "module", diff --git a/public/SOURCE.md b/public/SOURCE.md index 3ba7efa..311ce74 100644 --- a/public/SOURCE.md +++ b/public/SOURCE.md @@ -1,8 +1,8 @@ # Corresponding source -The source code corresponding to add·ideas Toolbox Portal 0.2.14 is available at: +The source code corresponding to add·ideas Toolbox Portal 0.2.15 is available at: -https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.12.0 +https://git.add-ideas.de/lotobo/toolbox-portal/src/tag/v0.13.0 Each bundled application contains its own `SOURCE.md`, license, and third-party license materials. The application sources are also linked from the portal. diff --git a/release/toolbox.lock.example.json b/release/toolbox.lock.example.json index 59f7392..bf8f169 100644 --- a/release/toolbox.lock.example.json +++ b/release/toolbox.lock.example.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.12.0", - "portalVersion": "0.2.14", + "releaseVersion": "0.13.0", + "portalVersion": "0.2.15", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -57,9 +57,9 @@ }, { "id": "de.add-ideas.auth-tools", - "version": "0.2.0", - "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.2.0/auth-tools-0.2.0.zip", - "sha256": "fce3fc07095b0460889d2cda4875093233438d7ad924e77464dd1164be089b09", + "version": "0.3.0", + "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.0/auth-tools-0.3.0.zip", + "sha256": "ac80a711a0fc00d554505e6278aa3557eca4248b6da2ac9e2bae74bc0b26e58e", "target": "auth" } ] diff --git a/release/toolbox.lock.json b/release/toolbox.lock.json index 59f7392..bf8f169 100644 --- a/release/toolbox.lock.json +++ b/release/toolbox.lock.json @@ -1,8 +1,8 @@ { "$schema": "./toolbox-release-lock.schema.json", "schemaVersion": 1, - "releaseVersion": "0.12.0", - "portalVersion": "0.2.14", + "releaseVersion": "0.13.0", + "portalVersion": "0.2.15", "catalogue": { "id": "de.add-ideas.toolbox", "name": "add·ideas Toolbox", @@ -57,9 +57,9 @@ }, { "id": "de.add-ideas.auth-tools", - "version": "0.2.0", - "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.2.0/auth-tools-0.2.0.zip", - "sha256": "fce3fc07095b0460889d2cda4875093233438d7ad924e77464dd1164be089b09", + "version": "0.3.0", + "artifact": "https://git.add-ideas.de/lotobo/auth-tools/releases/download/v0.3.0/auth-tools-0.3.0.zip", + "sha256": "ac80a711a0fc00d554505e6278aa3557eca4248b6da2ac9e2bae74bc0b26e58e", "target": "auth" } ] diff --git a/scripts/assembler.test.ts b/scripts/assembler.test.ts index 275ba50..f1ac9dd 100644 --- a/scripts/assembler.test.ts +++ b/scripts/assembler.test.ts @@ -83,7 +83,7 @@ function makeLock(artifact: string, sha256: string) { return { schemaVersion: 1, releaseVersion: '0.1.0', - portalVersion: '0.2.14', + portalVersion: '0.2.15', catalogue: { id: 'de.add-ideas.toolbox', name: 'Test Toolbox', diff --git a/scripts/deployment.test.ts b/scripts/deployment.test.ts index 0cdf47c..cef9d30 100644 --- a/scripts/deployment.test.ts +++ b/scripts/deployment.test.ts @@ -166,6 +166,18 @@ describe('production deployment', () => { expect(compose).not.toContain('addideas-auth-stripprefix'); }); + it('grants camera capture only to the isolated authentication hostname', () => { + expect(nginxConfig).toMatch( + /map \$host \$toolbox_permissions_policy\s*\{\s*default "camera=\(\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*"auth\.toolbox\.add-ideas\.de" "camera=\(self\), microphone=\(\), geolocation=\(\), payment=\(\), usb=\(\)";\s*\}/mu + ); + expect(nginxConfig).toContain( + 'add_header Permissions-Policy $toolbox_permissions_policy always;' + ); + expect( + nginxConfig.match(/^\s*add_header Permissions-Policy /gmu) + ).toHaveLength(1); + }); + it('quotes nginx regular expressions that contain brace quantifiers', () => { expect(nginxConfig).toContain( '"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\\.[^/]+$"' diff --git a/src/App.tsx b/src/App.tsx index a384f82..2521459 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -489,9 +489,9 @@ export default function App() {

- Portal v0.2.14 ·{' '} + Portal v0.2.15 ·{' '}