auth/env hardening and reliability updates

.github/workflows/ci.yml

@@ -17,14 +17,17 @@ jobs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: latest
+        bun-version: 1.3.3
 
     - name: Install dependencies
       run: bun install --frozen-lockfile
 
     - name: Type check
       run: bun run tsc --noEmit
 
+    - name: Run unit tests
+      run: bun run test:unit
+
     - name: Build frontend
       run: bun run build
 
@@ -54,7 +57,7 @@ jobs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: latest
+        bun-version: 1.3.3
 
     - name: Install dependencies
       run: bun install --frozen-lockfile
@@ -71,16 +74,51 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: 1.3.3
+
+    - name: Install dependencies
+      run: bun install --frozen-lockfile
+
     - name: Run security audit
       run: |
-        bun audit || true  # Don't fail on audit issues for now
+        audit_log="$(mktemp)"
+        last_exit=0
+        for attempt in 1 2 3; do
+          if bun audit >"$audit_log" 2>&1; then
+            cat "$audit_log"
+            rm -f "$audit_log"
+            exit 0
+          else
+            audit_exit=$?
+            last_exit=$audit_exit
+            last_attempt=$attempt
+            if [ "$attempt" -lt 3 ]; then
+              echo "bun audit failed (attempt $attempt), retrying..."
+              sleep 5
+            fi
+          fi
+        done
+
+        audit_output="$(cat "$audit_log")"
+        echo "bun audit failed after ${last_attempt:-3} attempts with exit code ${last_exit}"
+        if grep -Eiq 'network|registry|ENOTFOUND|ECONNREFUSED|EAI_AGAIN|ETIMEDOUT' <<< "$audit_output"; then
+          echo "bun audit failed after retries due to network/registry error: $audit_output"
+        else
+          echo "bun audit failed after retries - vulnerabilities detected: $audit_output"
+        fi
+        rm -f "$audit_log"
+        exit 1
 
     - name: Check for secrets
-      uses: trufflesecurity/trufflehog@main
+      # Pinned to immutable commit (v3.93.4) for supply-chain safety.
+      # Maintenance: periodically verify this SHA still corresponds to the intended upstream release.
+      uses: trufflesecurity/trufflehog@7c0734f987ad0bb30ee8da210773b800ee2016d3
       with:
         path: ./
         extra_args: --debug --only-verified
-      continue-on-error: true
 
   docker:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -1,8 +1,6 @@
 name: Release
 
 on:
-  push:
-    branches: [ master ]
   workflow_dispatch:
     inputs:
       version:
@@ -31,7 +29,7 @@ jobs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: latest
+        bun-version: 1.3.3
 
     - name: Install dependencies
       run: bun install --frozen-lockfile
@@ -73,6 +71,12 @@ jobs:
         echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
         echo "version_number=${NEW_VERSION#v}" >> $GITHUB_OUTPUT
 
+    - name: Type check
+      run: bun run tsc --noEmit
+
+    - name: Run backend tests
+      run: bun run test:unit
+
     - name: Build application
       run: bun run build
 
@@ -191,7 +195,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
       with:
-        ref: master
+        ref: refs/tags/${{ needs.release.outputs.new_version }}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3

.gitignore

@@ -64,7 +64,8 @@ data/.session-secret
 test-*.sh
 debug-*.js
 verify-*.md
-.DS_Store
+test-results/
+playwright-report/
 
 # LLM files
 .claude

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build for smaller production image
-FROM oven/bun:latest AS build
+FROM oven/bun:1.3.3 AS build
 
 WORKDIR /app
 
@@ -21,7 +21,7 @@ COPY tsconfig.json ./
 RUN bun run build
 
 # --- Production stage ---
-FROM oven/bun:latest AS production
+FROM oven/bun:1.3.3 AS production
 
 WORKDIR /app
 

docs/openapi/README.md

@@ -4,8 +4,8 @@ This directory contains the comprehensive OpenAPI 3.1 specification for the Iglo
 
 ## Files
 
-- **`openapi/openapi.yaml`** - Complete OpenAPI 3.1 specification in YAML format
-- **`openapi/openapi.json`** - Bundled JSON representation generated from the YAML spec
+- **`docs/openapi/openapi.yaml`** - Complete OpenAPI 3.1 specification in YAML format
+- **`docs/openapi/openapi.json`** - Bundled JSON representation generated from the YAML spec
 - **`README.md`** - This documentation file
 
 ## Accessing the Documentation
@@ -102,7 +102,7 @@ This ensures the YAML syntax is correct and the specification is well-formed.
 
 When adding or modifying API endpoints:
 
-1. Update the corresponding section in `openapi/openapi.yaml`
+1. Update the corresponding section in `docs/openapi/openapi.yaml`
 2. Add/update request and response schemas
 3. Include relevant examples
 4. Validate the specification: `bun run docs:validate`

docs/openapi/openapi.json

@@ -419,22 +419,14 @@
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest",
+            "description": "Bad request",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AuthStatus"
+                  "$ref": "#/components/schemas/ErrorResponse"
                 },
                 "example": {
-                  "enabled": true,
-                  "methods": [
-                    "api-key",
-                    "bearer",
-                    "basic-auth",
-                    "session"
-                  ],
-                  "rateLimiting": true,
-                  "sessionTimeout": 3600
+                  "error": "Invalid authentication status request"
                 }
               }
             }
@@ -3008,14 +3000,13 @@
           "methods": {
             "type": "array",
             "items": {
-              "type": "string",
-              "enum": [
-                "api-key",
-                "bearer",
-                "basic-auth",
-                "session"
-              ]
-            },
+                "type": "string",
+                "enum": [
+                  "api-key",
+                  "basic-auth",
+                  "session"
+                ]
+              },
             "description": "Available authentication methods"
           },
           "rateLimiting": {
@@ -3526,7 +3517,7 @@
         "type": "object",
         "description": "Client-supplied fields when creating or updating a NIP‑46 session",
         "properties": {
-          "client_pubkey": {
+          "pubkey": {
             "type": "string",
             "description": "Client public key (hex encoded)"
           },
@@ -3554,7 +3545,7 @@
           }
         },
         "required": [
-          "client_pubkey"
+          "pubkey"
         ]
       },
       "Nip46Session": {
@@ -4073,13 +4064,12 @@
               ]
             },
             "example": {
-              "error": "Authentication required",
-              "authMethods": [
-                "api-key",
-                "bearer",
-                "basic-auth",
-                "session"
-              ]
+            "error": "Authentication required",
+            "authMethods": [
+              "api-key",
+              "basic-auth",
+              "session"
+            ]
             }
           }
         }
@@ -4189,4 +4179,4 @@
       }
     }
   }
-}
+}

docs/openapi/openapi.yaml

@@ -327,16 +327,13 @@ paths:
               schema:
                 $ref: '#/components/schemas/AuthStatus'
         '400':
-          $ref: '#/components/responses/BadRequest'
+          description: Bad request
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/AuthStatus'
+                $ref: '#/components/schemas/ErrorResponse'
               example:
-                enabled: true
-                methods: ["api-key", "bearer", "basic-auth", "session"]
-                rateLimiting: true
-                sessionTimeout: 3600
+                error: "Invalid authentication status request"
 
   /api/auth/login:
     post:
@@ -1960,7 +1957,7 @@ components:
           type: array
           items:
             type: string
-            enum: ["api-key", "bearer", "basic-auth", "session"]
+            enum: ["api-key", "basic-auth", "session"]
           description: Available authentication methods
         rateLimiting:
           type: boolean
@@ -2323,7 +2320,7 @@ components:
       type: object
       description: Client-supplied fields when creating or updating a NIP‑46 session
       properties:
-        client_pubkey:
+        pubkey:
           type: string
           description: Client public key (hex encoded)
         status:
@@ -2338,7 +2335,7 @@ components:
           description: Preferred relays for the session
         policy:
           $ref: '#/components/schemas/Nip46Policy'
-      required: [client_pubkey]
+      required: [pubkey]
 
     Nip46Session:
       type: object
@@ -2631,7 +2628,7 @@ components:
                       type: string
           example:
             error: "Authentication required"
-            authMethods: ["api-key", "bearer", "basic-auth", "session"]
+            authMethods: ["api-key", "basic-auth", "session"]
 
     InternalServerError:
       description: Internal server error
@@ -2720,4 +2717,4 @@ tags:
   - name: Onboarding
     description: First-run onboarding and admin validation (database mode)
   - name: Event Log
-    description: Persisted UI event log endpoints (database mode only)
+    description: Persisted UI event log endpoints (database mode only)