Matt
ad74e4a174
Tier 1.4: error_events.request_body_excerpt sanitizer now redacts GDPR-relevant fields (email, phone, dob, address, fullName, firstName, lastName, postcode, nationalId, etc.) on top of the existing credential list. A 5xx in /api/v1/clients no longer lands full client PII in the super-admin inspector. Tier 3.10: ScanShell <main> now adds pb-[max(1.5rem, env(safe-area- inset-bottom))]. Mobile-pwa audit caught the Save expense button sitting flush against the iPhone 14/15 home indicator in standalone PWA mode. Tier 6.2: dashboard widget-registry now dynamic-imports every recharts-backed chart widget (berth status, lead source, occupancy timeline, pipeline funnel, revenue breakdown, source conversion). ~80-150KB initial-bundle savings when reps have charts disabled. ssr:false because recharts needs window. Tier 6.3: DataTable wraps the assembled columns in useMemo keyed on (columns, hasBulkActions). TanStack docs explicitly warn that rebuilding columns every render resets the table's internal state. Tier 7.1: Added .dockerignore (was missing — 7.6 GB context with .env reachable via COPY . .). Excludes git, env files, node_modules, build artefacts, IDE config, test artefacts, audit docs. Tier 7.4: Dockerfile.dev now runs as the node user (uid 1000) — was root. Working dir moves to /home/node/app. Tier 7.5: docker-compose.prod.yml adds memory limits (2g postgres, 512m redis, 1g crm-app, 1g crm-worker) and json-file log rotation (max-size, max-file) to every service. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
13 lines
497 B
Docker
13 lines
497 B
Docker
FROM node:20-alpine
|
|
RUN corepack enable && corepack prepare pnpm@10.33.2 --activate
|
|
# Drop root for the dev runtime — node:alpine ships a `node` user (uid
|
|
# 1000) for exactly this purpose. Audit caught that running as root in
|
|
# dev is an unnecessary risk when the bind-mounted source lets a
|
|
# compromised process write anywhere in the repo.
|
|
USER node
|
|
WORKDIR /home/node/app
|
|
COPY --chown=node:node package.json pnpm-lock.yaml ./
|
|
RUN pnpm install --frozen-lockfile
|
|
EXPOSE 3000
|
|
CMD ["pnpm", "dev"]
|