-
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
fix: resolve collection of CLI and UI bugs (#3168, #3105, #3139) #3195
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
73eea12
996dabf
88f1eda
4536dfe
6ffe00b
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,18 @@ | ||
| FROM golang | ||
|
|
||
|
|
||
| RUN go install github.com/pressly/goose/v3/cmd/goose@latest | ||
|
|
||
|
|
||
| WORKDIR /app | ||
| COPY ./schema ./schema | ||
| COPY ./cmd ./cmd | ||
| COPY ./migrate.sh ./migrate.sh | ||
|
|
||
| RUN go build -o /usr/local/bin/transform ./cmd/transform/main.go | ||
| RUN chmod +x ./migrate.sh | ||
|
|
||
| ENV GOOSE_DRIVER=clickhouse | ||
| ENV GOOSE_DBSTRING="tcp://default:password@clickhouse:9000" | ||
| ENV GOOSE_MIGRATION_DIR=./schema | ||
| CMD ["goose", "up"] | ||
|
|
||
| ENTRYPOINT ["./migrate.sh"] | ||
| CMD ["up"] |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -486,47 +486,57 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu | |
| }; | ||
| } | ||
|
|
||
| const [credentialsError, credentials] = await tryCatch( | ||
| getDockerUsernameAndPassword(apiClient, deploymentId) | ||
| ); | ||
| let credentials; | ||
| if (cloudRegistryHost.endsWith("amazonaws.com")) { | ||
| const [credentialsError, result] = await tryCatch( | ||
| getDockerUsernameAndPassword(apiClient, deploymentId) | ||
| ); | ||
|
|
||
| if (credentialsError) { | ||
| return { | ||
| ok: false as const, | ||
| error: `Failed to get docker credentials: ${credentialsError.message}`, | ||
| logs: "", | ||
| }; | ||
| if (credentialsError) { | ||
| return { | ||
| ok: false as const, | ||
| error: `Failed to get docker credentials: ${credentialsError.message}`, | ||
| logs: "", | ||
| }; | ||
| } | ||
| credentials = result; | ||
| } | ||
|
|
||
| logger.debug(`Logging in to docker registry: ${cloudRegistryHost}`); | ||
| if (credentials) { | ||
| logger.debug(`Logging in to docker registry: ${cloudRegistryHost}`); | ||
|
|
||
| const loginProcess = x( | ||
| "docker", | ||
| ["login", "--username", credentials.username, "--password-stdin", cloudRegistryHost], | ||
| { | ||
| nodeOptions: { | ||
| cwd: options.cwd, | ||
| }, | ||
| } | ||
| ); | ||
| const loginProcess = x( | ||
| "docker", | ||
| ["login", "--username", credentials.username, "--password-stdin", cloudRegistryHost], | ||
| { | ||
| nodeOptions: { | ||
| cwd: options.cwd, | ||
| }, | ||
| } | ||
| ); | ||
|
|
||
| loginProcess.process?.stdin?.write(credentials.password); | ||
| loginProcess.process?.stdin?.end(); | ||
| loginProcess.process?.stdin?.write(credentials.password); | ||
| loginProcess.process?.stdin?.end(); | ||
|
|
||
| for await (const line of loginProcess) { | ||
| errors.push(line); | ||
| logger.debug(line); | ||
| } | ||
| for await (const line of loginProcess) { | ||
| errors.push(line); | ||
| logger.debug(line); | ||
| } | ||
|
|
||
| if (loginProcess.exitCode !== 0) { | ||
| return { | ||
| ok: false as const, | ||
| error: `Failed to login to registry: ${cloudRegistryHost}`, | ||
| logs: extractLogs(errors), | ||
| }; | ||
| } | ||
| if (loginProcess.exitCode !== 0) { | ||
| return { | ||
| ok: false as const, | ||
| error: `Failed to login to registry: ${cloudRegistryHost}`, | ||
| logs: extractLogs(errors), | ||
| }; | ||
| } | ||
|
|
||
| options.onLog?.(`Successfully logged in to the remote registry`); | ||
| options.onLog?.(`Successfully logged in to the remote registry`); | ||
| } else { | ||
| logger.debug( | ||
| `Skipping automatic registry login for ${cloudRegistryHost}. Please ensure you are logged in locally.` | ||
| ); | ||
| } | ||
|
Comment on lines
+489
to
+539
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🚩 Non-AWS registries now skip server-side authentication entirely The Was this helpful? React with 👍 or 👎 to provide feedback. |
||
| } | ||
|
|
||
| const projectCacheRef = getProjectCacheRefFromImageTag(imageTag); | ||
|
|
@@ -550,13 +560,12 @@ async function localBuildImage(options: SelfHostedBuildImageOptions): Promise<Bu | |
| options.noCache ? "--no-cache" : undefined, | ||
| ...(useRegistryCache | ||
| ? [ | ||
| "--cache-to", | ||
| `type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ref=${projectCacheRef}${ | ||
| cacheCompression === "zstd" ? ",compression=zstd" : "" | ||
| }`, | ||
| "--cache-from", | ||
| `type=registry,ref=${projectCacheRef}`, | ||
| ] | ||
| "--cache-to", | ||
| `type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ref=${projectCacheRef}${cacheCompression === "zstd" ? ",compression=zstd" : "" | ||
| }`, | ||
| "--cache-from", | ||
| `type=registry,ref=${projectCacheRef}`, | ||
| ] | ||
| : []), | ||
| "--output", | ||
| outputOptions.join(","), | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚩 validateSession: false reduces magic link security
Adding
validateSession: falseatapps/webapp/app/services/emailAuth.server.tsx:20disables the check that the browser session requesting the magic link is the same one verifying it. This means magic links can be used from any browser/device, which is convenient but also means intercepted links (e.g., by email proxies, link preview bots, or attackers) can be used to authenticate. This is a common trade-off in magic link implementations and is likely intentional to fix cross-device/browser issues, but it does reduce the security posture of the auth flow.Was this helpful? React with 👍 or 👎 to provide feedback.