CalvinBackup/anonymous_github
1
0
Fork 0
mirror of https://github.com/tdurieux/anonymous_github.git synced 2026-09-12 21:58:57 +02:00
Code Issues Packages Projects Releases Wiki Activity
704 Commits 5 Branches 5 Tags
4aecc1d92f2ab7cee25e083d045e7862b54b7b2d
Commit Graph
704 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
tdurieux 4aecc1d92f fix: fetch complete content for truncated Gist files 2026-09-06 09:19:23 +02:00
tdurieux b1cb9093bb fix: close streaming responses after upstream errors 2026-09-06 09:19:18 +02:00
tdurieux 38a09188ad fix: expire conference repositories before completing expiration 2026-09-06 09:18:42 +02:00
tdurieux 6777537d44 fix: restrict S3 deletion to exact keys and descendants 2026-09-06 09:18:37 +02:00
tdurieux 5e84bfaa5b fix: surface partial S3 object deletion failures 2026-09-06 09:18:32 +02:00
tdurieux 4643e9f838 fix: preserve and anonymize truncated folder warnings 2026-09-06 09:18:28 +02:00
tdurieux 8d2921b406 fix: respect backpressure when resolving Git LFS pointers 2026-09-06 09:18:24 +02:00
tdurieux 9c18526d52 fix: decode and validate webview file paths 2026-09-06 09:17:56 +02:00
tdurieux 67eb83674c fix: sandbox repository webview documents 2026-09-06 09:17:52 +02:00
tdurieux 3e275311f1 fix: derive file ETags from current source content 2026-09-06 09:17:47 +02:00
tdurieux c14a548cb9 fix: enforce content policies using original file types 2026-09-06 09:17:42 +02:00
tdurieux 7210db2b61 fix: catch authentication failures in async route handlers 2026-09-06 09:17:37 +02:00
tdurieux 11eb160d2b fix: prevent stale downloads from reviving removed repositories 2026-09-06 09:17:33 +02:00
tdurieux 2af66cd1b6 fix: authorize coauthors by stable GitHub identity 2026-09-06 09:17:01 +02:00
tdurieux 8ec656c201 fix: authorize access before returning cached GitHub metadata 2026-09-06 09:16:57 +02:00
tdurieux a401bb21d6 fix: reject OAuth linking across different GitHub identities 2026-09-06 09:16:53 +02:00
tdurieux 50d606d0c1 fix: bound regex execution during anonymization 2026-09-06 09:16:48 +02:00
tdurieux b3f86513dd fix: prevent anonymization leaks across stream boundaries 2026-09-06 09:16:44 +02:00
tdurieux 900516f225 fix: omit source content length for rewritten file responses 2026-09-06 09:16:23 +02:00
tdurieux 12c07641e0 fix: persist and recover repository removals for banned owners 2026-09-06 09:16:20 +02:00
tdurieux f5f44c2511 fix: preserve removal intent when Redis enqueue fails 2026-09-06 09:16:17 +02:00
tdurieux 12b0bb52c0 fix: ignore stale removal jobs after repository restoration 2026-09-06 09:16:13 +02:00
dependabot[bot] f18d2de93c chore(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 (#795) 
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-03 05:00:33 +02:00
dependabot[bot] 75ce46b70e chore(deps): bump serialize-javascript and mocha (#794) 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.1 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.1.1
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](https://github.com/yahoo/serialize-javascript/compare/v6.0.2...v7.1.1)

Updates `mocha` from 10.8.2 to 12.0.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mochajs/mocha/compare/v10.8.2...v12.0.0)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.1.1
  dependency-type: indirect
- dependency-name: mocha
  dependency-version: 12.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:30:19 +02:00
dependabot[bot] 6b27578006 chore(deps): bump sanitize-html from 2.17.5 to 2.17.7 (#793) 
Bumps [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) from 2.17.5 to 2.17.7.
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

---
updated-dependencies:
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 07:15:41 +02:00
Archit Rastogi 420fa9e450 fix: clip overflowing conference link in dashboard table (#790) 
The Conference cell is a grid item with the default min-width:auto,
so a long unbroken URL forces the grid track wider than its
minmax(140px, 1fr) size and bleeds visually into the Status column.
Clip it with overflow:hidden/ellipsis and expose the full value via
a title attribute.
 2026-08-26 21:47:23 +02:00
dependabot[bot] 7298f5cd76 chore(deps): bump brace-expansion (#786) 
Bumps  and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together.

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.18)

Updates `brace-expansion` from 2.1.0 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.18)

Updates `brace-expansion` from 5.0.5 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.18)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-21 09:41:03 +02:00
Thomas Durieux 74ed0c6d51 fix: keep route overflow out of the page body (#785) 2026-08-20 14:52:45 +02:00
Thomas Durieux adb0dcaec2 fix: reactivate removed repositories after edits (#784) 2026-08-20 14:33:09 +02:00
Thomas Durieux 7b585fdefd Fix BullMQ removal processor arguments (#783) 2026-08-20 14:23:21 +02:00
Thomas Durieux 35c3b1804b Fix repository cleanup after removal and expiration (#782) 2026-08-20 12:52:19 +02:00
Thomas Durieux 46e956a779 fix: reactivate repositories with future expiration (#781) 2026-08-20 12:29:52 +02:00
Thomas Durieux 7aa9557905 perf: cut MongoDB scans in repository workflows (#780) 
* Add repository name index

* Optimize repository file counts

* Optimize MongoDB query workloads
 2026-08-20 12:29:26 +02:00
dependabot[bot] a30457993d chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.1 (#772) 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 00:03:20 +02:00
dependabot[bot] d53aba129e chore(deps): bump sanitize-html from 2.17.4 to 2.17.5 (#767) 
Bumps [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) from 2.17.4 to 2.17.5.
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.5/packages/sanitize-html)

---
updated-dependencies:
- dependency-name: sanitize-html
  dependency-version: 2.17.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 00:08:30 +02:00
dependabot[bot] 53a8c4d8b3 chore(deps): bump ip-address from 10.2.0 to 10.4.0 (#769) 
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.4.0.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.4.0)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 00:08:19 +02:00
tdurieux 44842d4e77 fix: handle navigation inside the app 2026-08-06 15:02:40 -07:00
tdurieux f0fdd9250b fix: improve pdf rendering and html 2026-08-06 14:35:21 -07:00
Thomas Durieux e54b78c7e6 Add a reliable MongoDB replica setup runbook (#766) 
* docs: clarify MongoDB Tailscale bind addresses

* fix: make MongoDB replica host mapping deterministic

* docs: add complete MongoDB replica runbook

* docs: support different replica server paths
 2026-07-30 03:10:13 +02:00
Thomas Durieux debd83c079 feat: add optional MongoDB replica deployment (#765) 2026-07-30 02:28:19 +02:00
dependabot[bot] a8733af4f4 chore(deps): bump mongoose from 7.8.9 to 7.8.10 (#761) 
Bumps [mongoose](https://github.com/Automattic/mongoose) from 7.8.9 to 7.8.10.
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/7.8.10/CHANGELOG.md)
- [Commits](https://github.com/Automattic/mongoose/commits/7.8.10)

---
updated-dependencies:
- dependency-name: mongoose
  dependency-version: 7.8.10
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 19:38:27 +02:00
dependabot[bot] 188712c5eb chore(deps): bump body-parser from 1.20.5 to 1.20.6 (#762) 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 19:38:16 +02:00
dependabot[bot] d21b84b1b4 chore(deps): bump postcss from 8.5.13 to 8.5.24 (#763) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.13 to 8.5.24.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.13...8.5.24)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.24
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 19:38:08 +02:00
tdurieuxandClaude Opus 4.8 2af4637cc7 docs: polish README (clearer intro, badges, structure) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-23 08:07:55 -07:00
Thomas Durieux f040557ae8 fix: preserve state across backend updates (#756) 2026-07-22 04:29:58 +02:00
Thomas Durieux beef8387ae fix: close account authorization gaps (#755) 2026-07-22 04:29:04 +02:00
Thomas Durieux aab6ccf7fc fix: harden anonymization privacy paths (#754) 2026-07-22 04:28:01 +02:00
Thomas DurieuxandClaude Opus 4.8 5ef10dee9e fix: dashboard menu clickability + expiration date UX (#753) 
* fix: dashboard menu clickability + expiration date UX

Dashboard actions menu:
- Inactive (expired/removed) rows dimmed via their cells instead of the
  row, so `opacity` no longer creates a stacking context that trapped the
  actions dropdown beneath later rows and made its items unclickable.
- Add an "Extend 6 months" menu item for expired repos/PRs/gists.

Expiration form (anonymize):
- Fix the "After , the content will be removed." blank date: guard the
  helper text and add min/max validation feedback so an invalid pick no
  longer nulls the model into a broken sentence.
- Add a `min` (today) so past dates can no longer be selected, and
  compute min/max from local date parts (not UTC) to avoid a timezone
  off-by-one in the native picker.
- Default expiration is now 6 months (single source of truth, removing a
  latent double-offset bug); max stays at 1 year.
- Block submitting a missing/out-of-range expiration date.

Backend:
- New POST /:id/extend endpoint for repos, PRs and gists that pushes the
  expiration +6 months and re-anonymizes so expired items come back
  online, mirroring the refresh flow. Shared extendExpirationDate helper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: add frontend translation for invalid_status error code

The new /extend endpoints throw an "invalid_status" AnonymousError, which
the error-code coverage test requires to have a locale entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-20 14:10:38 +02:00
Thomas DurieuxandClaude Fable 5 6a820408a1 fix: rate-limit visitors by real IP regardless of Cloudflare proxy hops (#750) 
Since the night of 2026-07-16 production keyed the rate limiter on
Cloudflare edge IPs instead of visitor IPs: every visitor routed through
the same edge shared one 175-req/15min bucket, causing widespread 429s
(confirmed by probing: sequential requests alternated 200/429 across
fresh and exhausted buckets).

Root cause: 'trust proxy' used a fixed hop count (TRUST_PROXY=1), which
silently breaks whenever the proxy chain gains or loses an
X-Forwarded-For entry (e.g. a Cloudflare-side change).

- TRUST_PROXY now accepts a comma-separated subnet list; the new default
  'loopback,uniquelocal,cloudflare' expands Cloudflare's published IP
  ranges so Express skips trusted proxies no matter how many entries
  they add. Plain numbers keep the legacy hop-count behavior.
- If resolution still stops at a Cloudflare address (visitor missing
  from X-Forwarded-For entirely), the limiter key falls back to
  cf-connecting-ip — safe because request.ip can only be a Cloudflare
  address when the whole chain to it is trusted.
- CIDR matching uses Node's built-in net.BlockList (no new dependency).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-07-17 06:44:21 +02:00
Thomas DurieuxandClaude 3f2d6d1a64 Add issue template asking for scope, anonymous repo ID, and description (#744) 
Claude-Session: https://claude.ai/code/session_01XxLUHaHJmvzCevFgxBX38Y

Co-authored-by: Claude <noreply@anthropic.com>
 2026-07-05 06:19:35 +02:00