lotobo/toolbox-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 32 Wiki Activity

feat: publish Toolbox 0.13.0 with Auth Tools 0.3.0

Browse Source
This commit is contained in:
zemion
2026-08-20 00:25:18 +02:00
parent 7ba733d9f2
commit 8d68557d5e
14 changed files with 72 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+28 -19
View File
@@ -1,7 +1,7 @@
# add·ideas Toolbox Portal
`toolbox-portal` is the static launcher and release assembler for the add·ideas
browser toolbox. Version `0.2.14` reads one same-origin catalogue, shows each app
browser toolbox. Version `0.2.15` reads one same-origin catalogue, shows each app
as a compact launch tile, and keeps personal pins, drag-and-drop ordering,
visibility, and appearance in the current browser. Pinned tools have their own
section; search, category, and clickable tag filters stay close to the tool
@@ -69,7 +69,7 @@ privacy and executable-code warning. Light, dark, and system modes are supported
## Production deployment behind Traefik
The committed `compose.yaml` is the shortest production path. Its release
container downloads the immutable Toolbox 0.12.0 ZIP during the image build,
container downloads the immutable Toolbox 0.13.0 ZIP during the image build,
verifies SHA-256 before extracting it, and then copies only the verified static
files into the pinned unprivileged nginx image. Node.js and a local portal
assembly are not required on the deployment host.
@@ -106,9 +106,11 @@ prefix while the public URL remains `/`, so assets remain relative and the brows
binds WebAuthn credentials to the dedicated `auth.toolbox.add-ideas.de` RP ID.
The main Toolbox copy at `/apps/auth/` remains useful for offline inspection but
disables live ceremonies because all Portal apps share that origin. The router
hostname can be overridden with `AUTH_TOOLS_HOST`, but auth-tools 0.2.0 enables
live ceremonies only on its pinned production host (or localhost); other hosts
remain inspect-only. Never widen the RP ID to `add-ideas.de`.
hostname can be overridden with `AUTH_TOOLS_HOST`, but the bundled Auth Tools
release enables live ceremonies only on its pinned production host (or
localhost); other hosts remain inspect-only. A different production host
therefore also requires rebuilding Auth Tools with the new exact host. Never
widen the RP ID to `add-ideas.de`.
The external network is deliberately not created by this project. Creating a
private project-local network would prevent an independently managed Traefik
@@ -131,10 +133,10 @@ The app release should also publish a matching `.sha256` sidecar. The manifest
must declare the pinned reverse-DNS id and version. Application and portal
versions are independent.
`release/toolbox.lock.json` is the reviewed v0.12.0 lock. Its URLs and checksums
`release/toolbox.lock.json` is the reviewed v0.13.0 lock. Its URLs and checksums
pin the published PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4,
Audio & Video Tools 0.3.0, Regex Tools 0.4.2, SVG Tools 0.1.0, and OTP & Passkey
Tools 0.2.0 release bytes. Use
Tools 0.3.0 release bytes. Use
`release/toolbox.lock.example.json` as the template for a future release and
verify every downloaded asset before committing updated values. Artifacts may be:
@@ -155,7 +157,7 @@ npm run assemble -- \
--lock release/toolbox.lock.json \
--portal-dist dist \
--output build/toolbox \
--archive build/add-ideas-toolbox-0.12.0.zip
--archive build/add-ideas-toolbox-0.13.0.zip
```
Existing output is refused. Pass `--force` only when replacing those exact
@@ -179,8 +181,8 @@ build/toolbox/
├── svg/
└── auth/
build/add-ideas-toolbox-0.12.0.zip
build/add-ideas-toolbox-0.12.0.zip.sha256
build/add-ideas-toolbox-0.13.0.zip
build/add-ideas-toolbox-0.13.0.zip.sha256
```
The assembler verifies SHA-256 before opening an artifact, validates every app
@@ -201,7 +203,7 @@ directory separately:
```sh
npm run package:static -- \
--input build/toolbox \
--output artifacts/add-ideas-toolbox-0.12.0.zip
--output artifacts/add-ideas-toolbox-0.13.0.zip
```
This also emits a `.sha256` sidecar.
@@ -214,7 +216,14 @@ immutable caching only for Vite-hashed assets and narrowly matched
semver-versioned FFmpeg core files, and revalidation for all other files. The
opaque-origin SVG preview iframe loads its packaged controller with a URI-exact
CORS and cross-origin resource-policy exception; all other files retain the
same-origin policy and every normal security header. Assemble first, then:
same-origin policy and every normal security header. Camera access is denied on
the shared Toolbox host and granted only to the dedicated
`auth.toolbox.add-ideas.de` origin, where Auth Tools still requests it only
after an explicit user action. If `AUTH_TOOLS_HOST` is customized, update the
exact host entry in `deploy/nginx.conf` and Auth Tools' pinned WebAuthn host at
the same time; the default-deny fallback deliberately does not infer camera
grants from request paths.
Assemble first, then:
The packaged policy intentionally does not grant CSP `unsafe-eval`. SaxonJS's
`ixsl:eval()` extension is therefore unsupported in this deployment profile;
@@ -222,9 +231,9 @@ normal local XML/XSLT transformations do not require that permission.
```sh
podman build -f Containerfile \
-t git.add-ideas.de/lotobo/toolbox:0.12.0 .
-t git.add-ideas.de/lotobo/toolbox:0.13.0 .
podman run --rm -p 8080:8080 \
git.add-ideas.de/lotobo/toolbox:0.12.0
git.add-ideas.de/lotobo/toolbox:0.13.0
```
For a direct-port local deployment after assembly, use the separate example:
@@ -241,8 +250,8 @@ docker login git.add-ideas.de
docker buildx build \
--platform linux/amd64,linux/arm64 \
--file Containerfile.release \
--tag git.add-ideas.de/lotobo/toolbox:0.12.0 \
--tag git.add-ideas.de/lotobo/toolbox:0.11 \
--tag git.add-ideas.de/lotobo/toolbox:0.13.0 \
--tag git.add-ideas.de/lotobo/toolbox:0.13 \
--push .
```
@@ -267,8 +276,8 @@ needs permission to push code, releases, and container packages to
all seven apps, switch between them, and confirm the encoded `toolbox`
context.
5. Verify the distribution with
`(cd build && sha256sum -c add-ideas-toolbox-0.12.0.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.12.0`), and
`(cd build && sha256sum -c add-ideas-toolbox-0.13.0.zip.sha256)`.
6. Commit the reviewed lock, tag the toolbox release (for example `v0.13.0`), and
push the branch and tag to Gitea.
7. In Gitea, open **Releases → New release**, select the tag, and upload the
static ZIP plus its `.sha256` file. Do not use a mutable “latest” URL in a
@@ -291,7 +300,7 @@ must not re-resolve app versions or substitute a newer release.
| **`av-tools`** | Existing local-first v0.3.0 release; dedicated repository | Convert and lightly edit audio and video locally in the browser | Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export | Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable |
| **`regex-tools`** | Current local-first v0.4.2 release; dedicated repository | Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions | Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence | Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics |
| **`svg-tools`** | Initial local-first v0.1.0 release; dedicated repository | Inspect and edit SVG source, structure, geometry, references and accessibility locally | Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; CSS animation preview; exact, sanitized, raster and project export | Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository |
| **`auth-tools`** | Current local-first v0.2.0 release; dedicated repository | Generate, inspect and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP, TOTP, OCRA, T0/time travel, drift/timelines/vectors, multi-QR and authenticator-backup migration, QR decode, health reports and encrypted export; bounded CBOR/authenticator-data inspection; assertion and attestation verification; imported FIDO metadata; ephemeral browser ceremony lab | OTP material remains memory-only unless explicitly exported; attestation signature, metadata and trust are reported separately; live ceremonies are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin (or localhost), while the Portal path remains inspect-only; no raw CTAP or token administration |
| **`auth-tools`** | Current local-first v0.3.0 release; dedicated repository | Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally | HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation | Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated `auth.toolbox.add-ideas.de` origin, while the shared Portal path remains inspect-only; no raw CTAP administration |
## Planned tools