Commit Graph

118 Commits

Author SHA1 Message Date
Apple
d77a4769c6 🔒 security(daarion-web): Hardening after crypto-mining incidents
## Root Cause Analysis
- Found CRITICAL RCE vulnerability in Next.js 15.0.3 (GHSA-9qr9-h5gf-34mp)
- 10 vulnerabilities total including SSRF, DoS, Auth Bypass
- Attack vector: exposed port 3000 + vulnerable Next.js → remote code execution

## Security Fixes
- Upgraded Next.js: 15.0.3 → 15.5.9 (0 vulnerabilities)
- Upgraded eslint-config-next: 15.0.3 → 15.5.9

## Hardening (New Files)
- apps/web/Dockerfile.secure: Multi-stage build, read-only FS, no shell
- docker-compose.web.secure.yml: Resource limits, cap_drop ALL, localhost bind
- scripts/rebuild-daarion-web-secure.sh: Local secure rebuild with Trivy scan
- scripts/deploy-daarion-web-node1.sh: Production deployment to NODE1
- SECURITY-REBUILD-REPORT.md: Full incident analysis and remediation report

## Key Security Measures
- restart: "no" (until verified)
- ports: 127.0.0.1:3000 (localhost only, use Nginx reverse proxy)
- read_only: true
- cap_drop: ALL
- resources.limits: 1 CPU, 512M RAM
- no-new-privileges: true

## Related Incidents
- Incident #1 (Jan 8): catcal, G4NQXBp miners
- Incident #2 (Jan 9): softirq, vrarhpb miners
- Hetzner AbuseID: 10F3971:2A

Co-authored-by: Cursor Agent <agent@cursor.sh>
2026-01-09 02:08:13 -08:00
Apple
254267afa3 fix: Add timeout to agents API fetch to prevent hanging 2025-12-05 03:25:30 -08:00
Apple
770c6a0dfe feat: Add banner display to MicroDAO list cards
- Add banner background to MicroDAO cards in list view
- Use normalizeAssetUrl for banner URLs
- Add fallback green gradient when banner_url is null
- Banner displays as background with overlay for readability
2025-12-02 09:38:58 -08:00
Apple
fd710da55d fix: Fix TypeScript errors in assets route and add banner_url to MicrodaoSummary 2025-12-02 09:03:35 -08:00
Apple
cf0b3feee0 fix: Add missing fetchMicrodaoDashboard export 2025-12-02 09:01:10 -08:00
Apple
d659f8fd32 fix: Fix Dockerfile COPY command for correct build context 2025-12-02 08:58:48 -08:00
Apple
bc4338f2c0 fix: Fix Dockerfile build context and ensure normalizeAssetUrl is used everywhere
- Fix Dockerfile to use correct paths (context is already apps/web)
- Ensure normalizeAssetUrl is used when setting preview URLs after upload
- This ensures all asset URLs go through the proxy
2025-12-02 08:58:34 -08:00
Apple
f19d5de52b fix: Add HEAD method support and fix proxy URL in Next.js assets route
- Add HEAD method handler in Next.js route
- Fix proxy URL to use correct city-service endpoint
- Handle HEAD requests properly (return headers only)
- This should fix 405 errors when browser checks image availability
2025-12-02 08:50:13 -08:00
Apple
1ca6a4f55a feat: Complete assets proxy implementation with documentation
- Add comprehensive documentation in docs/ASSETS_PROXY.md
- Add contract comments in normalizeAssetUrl and proxy_asset
- Verify all components use normalizeAssetUrl
- Verify ENV variables are correctly set
- Add troubleshooting guide
2025-12-02 08:36:55 -08:00
Apple
b49d7489ea fix: Use /api/city/assets/proxy/ for asset URLs instead of /api/assets/
- Change normalizeAssetUrl to use working city-service proxy endpoint
- This ensures assets work without assets.daarion.space DNS
2025-12-02 07:46:30 -08:00
Apple
517efc6a16 fix: Add API proxy for MinIO assets to work without assets.daarion.space DNS
- Add /api/assets/[...path] proxy route in Next.js
- Add /assets/proxy/{path} endpoint in city-service
- Update normalizeAssetUrl to convert assets.daarion.space URLs to /api/assets/...
- This allows assets to work even if DNS for assets.daarion.space is not configured
2025-12-02 07:43:36 -08:00
Apple
ace183e136 feat: Add MicroDAO Dashboard with activity feed and statistics
- Add microdao_activity table for news/updates/events
- Add statistics columns to microdaos table
- Implement dashboard API endpoints
- Create UI components (HeaderCard, ActivitySection, TeamSection)
- Add seed data for DAARION DAO
- Update backend models and repositories
- Add frontend types and API client
2025-12-02 06:37:16 -08:00
Apple
8e8f95e9ef feat(db-hardening): Add database persistence, backups, and MinIO assets storage
Database Hardening:
- Add docker-compose.db.yml with persistent PostgreSQL volume
- Add automatic DB backups every 12h (7 days, 4 weeks, 6 months retention)
- Add MinIO S3-compatible storage for assets

Assets Migration:
- Add MinIO client (lib/assets_client.py) for upload/delete
- Update upload endpoint to use MinIO (with local fallback)
- Add migration 043_asset_urls_to_text.sql for full HTTPS URLs
- Simplify normalizeAssetUrl for S3 URLs

Recovery:
- Add seed_full_city_reset.py for emergency city recovery
- Add DB_RESTORE.md with backup restore instructions
- Add SEED_RECOVERY.md with recovery procedures
- Add INFRA_ASSETS_MINIO.md with MinIO setup guide

Task: TASK_PHASE_DATABASE_HARDENING_AND_ASSETS_MIGRATION_v1
2025-12-02 01:56:39 -08:00
Apple
0e743e5629 fix: restore microdao/agent logos and banner asset urls
- Enhanced normalizeAssetUrl to handle all edge cases
- Added normalizeAssetUrl to all avatar/logo/banner usages:
  - agents/page.tsx
  - agents/[agentId]/page.tsx
  - citizens/page.tsx
  - citizens/[slug]/page.tsx
  - MicrodaoAgentsSection.tsx
  - MicrodaoBrandingCard.tsx
  - AgentSummaryCard.tsx
  - AgentChatWidget.tsx

Task: TASK_PHASE_ASSET_BRANDING_HOTFIX_v1
2025-12-01 11:40:03 -08:00
Apple
dddf51affe feat(microdao-rooms): Add MicroDAO rooms creation/deletion and agent chat
Backend:
- POST /city/microdao/{slug}/rooms - create new room for MicroDAO
- DELETE /city/microdao/{slug}/rooms/{room_id} - soft-delete room
- POST /city/agents/{agent_id}/ensure-room - create personal agent room

Frontend:
- MicrodaoRoomsSection: Added create room modal with name, description, type
- MicrodaoRoomsSection: Added delete room functionality for managers
- Agent page: Added 'Поговорити' button to open chat in City Room

Models:
- Added CreateMicrodaoRoomRequest model

Task: TASK_PHASE_MICRODAO_ROOMS_AND_PUBLIC_CHAT_v3
2025-12-01 10:09:28 -08:00
Apple
cc1704b70c fix(agents): Wrap NewAgentPage in Suspense for useSearchParams 2025-12-01 09:32:16 -08:00
Apple
6cd8148872 feat(agents): Add Create/Delete Agent functionality
Backend:
- Added POST /city/agents endpoint for creating agents
- Added DELETE /city/agents/{id} endpoint for soft-deleting agents
- Added CreateAgentRequest, CreateAgentResponse, DeleteAgentResponse models

Frontend:
- Added '+ Новий агент' button on /agents page
- Created /agents/new page with full agent creation form
- Added 'Видалити агента' button in agent Identity tab (Danger Zone)

Features:
- Auto-generate slug from display_name
- Support for all agent fields: kind, role, model, node, district, microdao
- Color picker for agent color
- Visibility toggles (is_public, is_orchestrator)
- Soft delete with confirmation dialog
2025-12-01 09:29:42 -08:00
Apple
649d07ee29 feat(rooms): Fix NaN online stats + Add DAARWIZZ CTA on homepage
- Fixed NaN in online stats by using nullish coalescing (?? 0)
- Added members_online, zone, room_type to /api/v1/city/rooms response
- Added DAARWIZZ chat CTA section on homepage with link to city-lobby
- Created task files for next phases:
  - TASK_PHASE_CITY_ROOMS_FINISH_v2.md
  - TASK_PHASE_AGENT_MANAGEMENT_v1.md
  - TASK_PHASE_CITIZENS_DIRECTORY_v1.md
2025-12-01 09:19:07 -08:00
Apple
a563ec86a0 fix(rooms): Use rewrite for /api/city/rooms instead of API route
- Removed API route that was conflicting with rewrite
- Added explicit rewrite for /api/city/rooms -> /api/v1/city/rooms
- Rewrite order matters: specific routes before wildcard
2025-12-01 08:52:59 -08:00
Apple
0039be5dc0 feat(rooms): Add city-lobby with DAARWIZZ + fix API proxy
- Created city-lobby room as main public chat with DAARWIZZ
- Fixed /api/city/rooms proxy to use correct backend path (/api/v1/city/rooms)
- Updated district rooms with zone keys (leadership, system, engineering, etc.)
- Set MicroDAO lobbies as primary rooms
- Created seed_city_rooms.py script
- Created TASK_PHASE_CITY_ROOMS_AND_PUBLIC_CHAT_v1.md

Total: 35 rooms, 31 public, 10 districts
2025-12-01 08:47:37 -08:00
Apple
092346f057 fix: use normalizeAssetUrl for banner 2025-12-01 07:09:55 -08:00
Apple
9e7b1f25ef fix: add node button visibility, fix node-guardian swapper health check, fix banner URL transform 2025-12-01 07:08:36 -08:00
Apple
f5c58358a0 feat: add 'Додати ноду' button to Node Directory, create /nodes/register page, add node discovery script 2025-12-01 06:47:27 -08:00
Apple
d5aae67b50 fix: remove duplicate API route, add dynamic export to swapper route 2025-12-01 06:26:57 -08:00
Apple
fbf17be668 fix: normalize MicroDAO logo URLs using helper function 2025-12-01 06:23:54 -08:00
Apple
909258fdcb fix: DAGI Router agents logic, MicroDAO logo URL handling 2025-12-01 06:03:08 -08:00
Apple
e3accd4df0 feat: DAGI Router v2 - new endpoints, hooks, and UI card 2025-12-01 05:21:43 -08:00
Apple
53f31adbf0 feat: add logo display in MicroDAO cards and hero section, add banner background support 2025-12-01 04:34:26 -08:00
Apple
d8ab32b59f fix: add beforeFiles to rewrites config 2025-12-01 04:07:59 -08:00
Apple
6ebdaac25d fix: use afterFiles/fallback rewrites to allow Next.js API routes to work 2025-12-01 04:06:51 -08:00
Apple
2589f2d99d fix: rename /api/internal/ to /api/node-internal/ to avoid routing issues 2025-12-01 04:00:38 -08:00
Apple
b55c59b9d1 fix: rename _debug to debug (Next.js ignores underscore prefixes) 2025-12-01 03:45:30 -08:00
Apple
1a81cf75f1 feat: add unified API proxy layer, debug endpoint, and systemd service for node-guardian 2025-12-01 03:43:06 -08:00
Apple
b3e3c6417d fix: update Swapper endpoints (/health, /models), remove upload size limits, auto-convert images 2025-12-01 03:03:27 -08:00
Apple
9c79b6e526 fix: add static files proxy and improve upload URL handling 2025-12-01 02:45:07 -08:00
Apple
7843ff3d86 fix: improve error handling for swapper and upload APIs 2025-12-01 02:41:35 -08:00
Apple
d4e20ea513 feat: add MicroDAO branding and Agent avatar upload UI 2025-12-01 02:26:02 -08:00
Apple
95b75d5897 fix: export StatusBadge from node-dashboard 2025-12-01 02:21:07 -08:00
Apple
dcc9ec0b39 fix: next15 api route params must be Promise 2025-12-01 02:19:57 -08:00
Apple
394dd62980 feat: add swapper api proxy and improved card 2025-12-01 02:18:14 -08:00
Apple
281c79f916 feat: implement swapper metrics and node cabinet ui 2025-11-30 15:40:41 -08:00
Apple
fd814b2059 feat: implement Swapper metrics collection and UI 2025-11-30 15:12:49 -08:00
Apple
1830109a95 feat: Agent System Prompts MVP (B) - database, backend API, and frontend integration 2025-11-30 14:04:48 -08:00
Apple
bca81dc719 feat: Node Self-Healing, DAGI Audit, Agent Prompts, Infra Invariants
### Backend (city-service)
- Node Registry + Self-Healing API (migration 039)
- Improved get_all_nodes() with robust fallback for node_registry/node_cache
- Agent Prompts Runtime API for DAGI Router integration
- DAGI Router Audit endpoints (phantom/stale detection)
- Node Agents API (Guardian/Steward)
- Node metrics extended (CPU/GPU/RAM/Disk)

### Frontend (apps/web)
- Node Directory with improved error handling
- Node Cabinet with metrics cards
- DAGI Router Card component
- Node Metrics Card component
- useDAGIAudit hook

### Scripts
- check-invariants.py - deploy verification
- node-bootstrap.sh - node self-registration
- node-guardian-loop.py - continuous self-healing
- dagi_agent_audit.py - DAGI audit utility

### Migrations
- 034: Agent prompts seed
- 035: Agent DAGI audit
- 036: Node metrics extended
- 037: Node agents complete
- 038: Agent prompts full coverage
- 039: Node registry self-healing

### Tests
- test_infra_smoke.py
- test_agent_prompts_runtime.py
- test_dagi_router_api.py

### Documentation
- DEPLOY_CHECKLIST_2024_11_30.md
- Multiple TASK_PHASE docs
2025-11-30 13:52:01 -08:00
Apple
1ca4800202 fix: Dockerfile copies only apps/web, not root Vite project 2025-11-30 11:59:58 -08:00
Apple
7b61786c96 feat: MicroDAO Agents Section + Room roles
Frontend:
- MicrodaoAgentsSection component with role badges
- useMicrodaoAgents hook
- Extended room_role mapping (operations, knowledge, treasury, ai-core, etc.)
- API route for /api/microdao/[slug]/agents

Matrix: All 13 new rooms synced with Matrix
2025-11-30 11:57:24 -08:00
Apple
c9d7681627 feat: District Portals Frontend
Pages:
- /districts - list of all districts with cards
- /districts/[slug] - district detail page
- /soul, /greenfood, /energy-union - shortcut redirects

UI Features:
- District-specific colors and icons
- Lead agent + core team display
- District rooms list with Matrix status
- District nodes list
- Chat widget for lobby room
- Stats (agents, rooms, nodes count)
2025-11-30 11:40:30 -08:00
Apple
85fdcdf0be feat: City Rooms routing implementation
Backend:
- GET /api/v1/city/rooms - list all city rooms
- GET /api/v1/city/rooms/{slug} - get room by slug with host agents

Frontend:
- Updated /city/[slug] page with host agents section
- Added breadcrumb navigation
- Updated API client to fetch room by slug
- Added rewrite for /api/city/rooms/:slug

Task doc: TASK_PHASE_CITY_ROOMS_ROUTING_v1.md
2025-11-30 10:54:39 -08:00
Apple
fcdac0f33c feat: implement Agent Presence Indicators (MVP)
Backend:
- Add /api/v1/agents/presence endpoint
- Integrate with matrix-presence-aggregator
- Add DAGI router health checks

Frontend:
- Create useAgentPresence hook
- Create AgentPresenceBadge component
- Integrate into /agents list page
- Integrate into /agents/:agentId cabinet

Shows real-time online/offline status for all agents.
2025-11-30 09:41:57 -08:00
Apple
c4d7eb4493 fix: correct JSX structure in node page for chat widget 2025-11-30 09:15:17 -08:00