Moheeb Zara
59e9fcbd4f
Migration 035 adds door_connections (per-space controller integration: secret_ref -> AES-256-GCM secrets vault, never a plaintext password; pinned_host SSRF pin; native_heatsync|generic_http adapter; allow_member_self_entry opt-in for phase 3) and door_access_log (append-only, secrets redacted, service-client-only writes; immutable). RLS additive/default-deny: connections CRUD = door.manage; log SELECT = door.manage/operate. Safety core is pure and heavily unit-tested (door-logic, suite 409): validateDoorTarget (request host must equal the pinned host; metadata/link-local always blocked; http(s) only), the firmware-verified HeatSync encoders with fixed-width zero-padding (slot 3 / perm 3 / tag 8 / 4-char password), generic template substitution, and redactDoorSecrets. lib/door/executor.ts is the single hardened egress: re-validates the pin, refuses redirects, caps time and body, redacts before any audit write. The door password is read from the secrets vault and decrypted server-side only, never returned or logged. /door/manage (door.manage) configures connections, picks a vault secret, and runs a safe status-only test. Sidebar Admin link added; "Learn" moved before "People" per request. Docs updated.
65 lines
1.6 KiB
TypeScript
65 lines
1.6 KiB
TypeScript
/**
|
|
* Barrel re-export for server actions.
|
|
*
|
|
* Client components and pages import action functions via `@/lib/actions`.
|
|
* Each domain lives in its own file in this directory; this barrel keeps
|
|
* the import path stable as the directory grows.
|
|
*
|
|
* Do NOT add `'use server'` here. The directive lives on the domain files
|
|
* themselves; re-exports preserve the marking.
|
|
*/
|
|
|
|
export * from './tasks'
|
|
export * from './projects'
|
|
export * from './members'
|
|
export * from './contacts'
|
|
export * from './payments'
|
|
export * from './knowledge-base'
|
|
export * from './secrets'
|
|
export * from './area-leads'
|
|
export * from './settings'
|
|
export * from './imports'
|
|
|
|
// Governance kernel (Tier 1)
|
|
export * from './proposals'
|
|
export * from './incidents'
|
|
export * from './policies'
|
|
|
|
// Per-space configurable taxonomies
|
|
export * from './areas'
|
|
|
|
// Forum and polymorphic comments
|
|
export * from './forum'
|
|
|
|
// User-creatable chat channels
|
|
export * from './comms'
|
|
|
|
// Custom tiers, custom roles, multi-code invites
|
|
export * from './tiers'
|
|
export * from './roles'
|
|
export * from './invites'
|
|
|
|
// Configurable member onboarding
|
|
export * from './onboarding'
|
|
|
|
// Customizable permissions, per-item Ops ACLs, area-lead roles
|
|
export * from './permissions'
|
|
|
|
// Custom forms and waivers
|
|
export * from './forms'
|
|
|
|
// Certifications + Instructor capability
|
|
export * from './certifications'
|
|
|
|
// Classes (offerings, sessions, signups)
|
|
export * from './classes'
|
|
|
|
// Equipment registry + reservations
|
|
export * from './equipment'
|
|
|
|
// Member access cards (Door epic)
|
|
export * from './member-cards'
|
|
|
|
// Door connections + executor (Door epic)
|
|
export * from './door'
|