WIP: fix: add corepack cache dir to Dockerfile (GRO-655) #286

Closed

the-dogfather-cto[bot] wants to merge 2 commits from fix/gro-655-corepack-enoent into main

Author SHA1 Message Date

Author	SHA1	Message	Date
Flea Flicker	4594bd2307	fix(GRO-655): create corepack cache dir in builder stage Prevents ENOENT crash in migrate and seed jobs. Root cause: corepack tries to mkdir /home/node/.cache/node/corepack/v1 but the directory does not exist in the builder stage. This was a regression in `c438f57` where the cache directory was not pre-created. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-14 21:58:44 +00:00
Flea Flicker	d8c0052b54	fix(GRO-634): implement auth & authorization security hardening (8 findings) - Remove placeholder secret fallback, require BETTER_AUTH_SECRET when AUTH_DISABLED=true - Fix TOCTOU race in setup: use INSERT...RETURNING for atomic confirmation token creation - Fix confirmation token replay: atomic UPDATE with WHERE clause prevents double-use - Add CSRF origin-check middleware for non-safe HTTP methods - Validate OIDC discovery URL hostname matches configured issuer - Use timing-safe comparison for iCal authentication tokens - Add rate limiting (10 req/min per IP) on setup endpoints - Fix RBAC error messages: correct inversion of privilege check	2026-04-14 17:08:02 +00:00

Flea Flicker

4594bd2307

fix(GRO-655): create corepack cache dir in builder stage

Prevents ENOENT crash in migrate and seed jobs.

Root cause: corepack tries to mkdir /home/node/.cache/node/corepack/v1
but the directory does not exist in the builder stage. This was a
regression in c438f57 where the cache directory was not pre-created.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-04-14 21:58:44 +00:00

Flea Flicker

d8c0052b54

fix(GRO-634): implement auth & authorization security hardening (8 findings)

- Remove placeholder secret fallback, require BETTER_AUTH_SECRET when AUTH_DISABLED=true
- Fix TOCTOU race in setup: use INSERT...RETURNING for atomic confirmation token creation
- Fix confirmation token replay: atomic UPDATE with WHERE clause prevents double-use
- Add CSRF origin-check middleware for non-safe HTTP methods
- Validate OIDC discovery URL hostname matches configured issuer
- Use timing-safe comparison for iCal authentication tokens
- Add rate limiting (10 req/min per IP) on setup endpoints
- Fix RBAC error messages: correct inversion of privilege check

2026-04-14 17:08:02 +00:00

WIP: fix: add corepack cache dir to Dockerfile (GRO-655) #286

2 Commits