fix/quality-security-audit-2026-07 #1

Merged

rkxh merged 6 commits from fix/quality-security-audit-2026-07 into main 2026-07-05 23:51:37 +02:00

Conversation 0 Commits 6 Files changed 73 +1771 -454

rkxh commented 2026-07-05 23:51:31 +02:00

Owner

Copy link

No description provided.

rkxh added 6 commits 2026-07-05 23:51:31 +02:00

Audit: packages fixes (tax deadlines, crypto, evidence chain, indexes) ... 5d98b4f524

- tax (H-1): GewSt-VZ auf 15.02./05./08./11. (§19 GewStG); LSTA_JAEHRLICH
  10.01. Folgejahr (§41a EStG); Tests korrigiert/ergaenzt.
- crypto (N-1/N-2): decryptSecret erzwingt IV=12/Tag=16; optionaler
  SECRET_BOX_KEY (Fallback AUTH_SECRET) fuer Rotation.
- evidence (M-2/N-3): verifyChain fuehrt lastAuditId als Monotonie-Anker;
  CLI meldet leere Kette nicht mehr als "intakt".
- db (M-3): 24 fehlende FK-Indizes + Migration iter93.
- storage (H-5/N-6/7/8): Unit-Tests fuer §147-Fristberechnung; Lock-Modus
  per Tier; ClamAV-Backpressure; StreamMaxLength dokumentiert.
- elster (N-4/N-5): Kontoabfrage-Validierung; kein Fehler-Body-Leak.
- http-utils (N-9/N-10): vollstaendige IPv6-Blockliste; Agent-Leak.
- config: optionales SECRET_BOX_KEY-Feld.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Audit: web app fixes (M-1 confidentiality gate, audit render, tz, theme) ... 1611b46e45

- M-1 (Security): assertClientAccessTx erzwingt das Vertraulich-/RESTRICTED-
  Ventil in allen 14 mutierenden clients/[id]-Action-Modulen (bisher nur im
  Seiten-Layout, das Server-Actions nicht abdeckt).
- H-3: verifyChain aus dem Render-Pfad von /staff/admin entfernt (liest
  persistiertes Worker-Ergebnis).
- M-5/M-6: Audit-Verify-Polling ueber queuedAt-Zeitstempel (ueberlebt
  Ueberschreiben), sichtbares Timeout; Recovery-Segment-Verifikation aus dem
  Render-Pfad entfernt.
- H-4/M-7/N-14: Zeitzonen ueber lib/fmt (Europe/Berlin) in Mails/Notifications,
  SSR-Client-Komponenten und Exporten; DST-korrekte Berlin-Tagesgrenzen im
  Audit-Datumsfilter.
- M-8: Theme-Logik in lib/theme + ThemeSync zentralisiert (drei Kopien
  entfernt).
- N-15/N-18: Dashboard-.catch; Portal-Commit-Route ohne Roh-Message-Leak.
- Test-Fixture-Fixes (poa, verfahrensdoku, contacts) fuer die neuen Vertraege.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Audit: worker fixes (M-4 async failed-handler, N-16 retries, M-2 anchor) ... a464a733df

- M-4: n8n-deliver failed-Handler in try/catch (DB-Ausfall reisst nicht mehr
  den Worker-Prozess um).
- N-16: gemeinsame Retry-Policy fuer alle taeglichen Wartungs-Jobs
  (audit-verify-check, dsgvo-retention, reminders u.a.).
- M-2: audit-verify-check erkennt Tail-Truncation ueber den lastAuditId-
  Monotonie-Anker und alarmiert.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Audit H-6/N-21: E2E flakiness — feste Sleeps durch deterministische Waits ... 7ed5b73888

- 04-rate-limit: Sleep -> waitForResponse (POST-Roundtrip).
- 05-user-walkthrough: Sleeps -> waitFor / redundant entfernt.
- 06-actions: 35 -> 1 Sleeps (goto/URL/Assertion-Waits); Telefonzettel-Flow
  auf Sektions-Anker gestuetzt. 16/16 gruen, ~6x schneller.
- 07-compliance: 16 waitForTimeout;expect(page.url()) -> expect(page)
  .toHaveURL + 1 redundanter entfernt (59 -> 42). Rest sind tragende
  Redirect-/Async-Waits; Retries bewusst bei 2 belassen.

Validiert gegen Production-Build (CI-Paritaet).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Audit: guards, CI, docs ... aab56527a5

- M-9: check-no-focused-tests erkennt .only/.todo/fdescribe; CI-Zwang im
  rfc3161-differential-Test.
- N-22: `pnpm rebuild ... || true`-Maskierung in CI entfernt.
- Docs: Gesamt-Auditbericht (docs/security) und Workspace-Injektions-Falle
  (docs/development).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chore: lockfile update (storage vitest devDependencies) ... d5bb0f9ce4

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

rkxh merged commit 5415c4ae0a into main 2026-07-05 23:51:37 +02:00

rkxh referenced this pull request from a commit 2026-07-05 23:51:38 +02:00

Merge pull request 'fix/quality-security-audit-2026-07' (#1) from fix/quality-security-audit-2026-07 into main

rkxh deleted branch fix/quality-security-audit-2026-07 2026-07-05 23:58:40 +02:00

rkxh referenced this pull request from a commit 2026-07-11 16:01:19 +02:00

feat(poa): Unterzeichner sieht das zu signierende PDF (eIDAS Art. 26, #1)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

TaxTronik/kanzleikonsole!1

No description provided.