mai
/
posimai-root
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
213 Commits 1 Branch 0 Tags 3.9 GiB
Commit Graph

213 Commits

Author SHA1 Message Date
posimai a38447a061 fix(posimai-sc): 試験モードのAlpine null参照エラーを解消 
Made-with: Cursor
 2026-04-20 20:37:44 +09:00
posimai 81095b891f fix(pc-audit): .gitattributes で BOM を保証、runner のエラーハンドリング改善 2026-04-20 20:15:55 +09:00
posimai 8f4294fe09 fix(posimai-sc): ステップ3完了時の自動ジャンプを廃止 
Made-with: Cursor
 2026-04-20 20:13:49 +09:00
posimai f33854b8a0 fix(posimai-sc): モバイルの理解度ジャンプ精度と設問折り返しを改善 
Made-with: Cursor
 2026-04-20 20:07:06 +09:00
posimai 220c7c2449 fix(posimai-sc): 3ステップ後の理解度ジャンプでフォーカス起因のズレを抑止 
Made-with: Cursor
 2026-04-20 20:02:27 +09:00
posimai 44c4ffe3c2 fix(posimai-sc): 理解度チェックへのジャンプ位置ズレを修正 
Made-with: Cursor
 2026-04-20 18:43:38 +09:00
posimai ce3754f030 chore: update STATUS.md with security audit results 2026-04-20 17:11:25 +09:00
posimai 610207d570 security: CSP/HSTS headers (posimai-sc), update STATUS.md 2026-04-20 17:10:55 +09:00
posimai ad6e124322 chore: update posimai-guard submodule pointer 2026-04-20 17:08:49 +09:00
posimai 1e9e19b4b6 feat(posimai-sc): 端末間再開同期を追加 
Made-with: Cursor
 2026-04-20 16:46:18 +09:00
posimai 492da3f2d9 feat(posimai-sc): 用語インデックスと試験モード、SW v4 
Made-with: Cursor
 2026-04-20 13:49:03 +09:00
posimai e6bb59df86 feat(posimai-sc): 全単元に初学者向けブロック、ホーム案内、検索ショートカット、SW v3 
Made-with: Cursor
 2026-04-20 13:39:31 +09:00
posimai ec51c2ed6b fix: trust proxy を設定して req.ip を正しくクライアントIPに解決 
nginx リバースプロキシ背後では req.ip がプロキシの内部 IP になる問題を修正。
app.set('trust proxy', 1) で X-Forwarded-For を信頼し、IP ベースの
レート制限（together/ponshu）が実際のクライアント IP で動作するようにする。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-20 13:34:22 +09:00
posimai 548c4fcca2 security: 認証・レート制限の5箇所を修正 
- /journal/posts/public: 任意ユーザー列挙を廃止、SITE_PUBLIC_USER 固定
- /site/config/public: IDOR 修正 + 公開キーをホワイトリスト制限
- POST /together/groups: IP 単位 5回/時間 のレート制限を追加
- POST /together/join: IP 単位 10回/時間 のレート制限を追加
- POST /together/share: Gemini archive を shared_by 単位 20回/時間 に制限
- POST /ponshu/license/validate: IP 単位 10回/分 のブルートフォース防止

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-20 13:30:10 +09:00
posimai 10071901e1 feat(posimai-sc): S31 compliance intro, beginner glossaries, S16 Q4, SW v2; dashboard timeline and projects 
Made-with: Cursor
 2026-04-20 13:08:49 +09:00
posimai c7a1567dea feat(posimai-sc): add S25-S30 units and drills, fix drills.js EOF and Vishing term 
Made-with: Cursor
 2026-04-20 12:49:27 +09:00
posimai b4b88d02e4 docs: Together together_members user_id 本番確認結果を STATUS に追記 
Made-with: Cursor
 2026-04-20 12:18:06 +09:00
posimai 17353f824b feat(posimai-sc): S23/S24追加・ドリル88問・コードバグ修正 
- S23「サプライチェーン・DevSecOps」S24「AIセキュリティ」を追加
- drills.js: 全22単元×2問→4問に拡充（合計88問）。正解を answer:0/1 交互配置（48:48）に修正（従来95/96がanswer:1という偏りを解消）
- app.js: openUnit()でconceptExpandedをfalseにリセットしていたバグを修正（デフォルト展開の意図通りtrueに）
- app.js: toggleTheme()/markDone()のlocalStorage呼び出しにtry/catchを追加
- app.js: 全問正解時に学習済みフラグを自動セット
- ホームのクイズ正解をsaveSocre永続化ベースで集計するよう変更

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-20 11:02:24 +09:00
mai f3a53babdb fix: NIST CSF 2.0 (6機能/Govern) 修正、PQC追記、s21/s22ドリル追加 2026-04-20 08:59:53 +09:00
posimai 89a0fef301 chore: Vercel posimai-sc Root Directory 設定完了を STATUS に記録 2026-04-20 08:31:16 +09:00
posimai b7e40ace8e chore: STATUS に Together セキュリティ強化の完了記録を追記（2026-04-19〜20） 2026-04-20 08:03:11 +09:00
posimai 3440bc7a35 chore: STATUS に sc 404 原因と対処を追記、atlas サブモジュールを更新 
Made-with: Cursor
 2026-04-20 01:48:37 +09:00
posimai d257bd75ac chore: atlas・roadmap サブモジュールを posimai-sc 登録後のコミットに更新 
Made-with: Cursor
 2026-04-20 01:41:36 +09:00
posimai 36293e5ec7 feat: posimai-sc 支援士学習PWAを同梱し本番用設定を追加 
Made-with: Cursor
 2026-04-20 01:40:48 +09:00
posimai 222238f2b9 fix(together): require member auth on GET /together/groups/:groupId 
invite_code was accessible without authentication to anyone who knew
the groupId (sequential integer). Now requires ?u= + member check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-20 01:04:24 +09:00
posimai 6cae7daa87 fix(together): revert broken userCheck that caused 403 for all JWT users 
userCheck required username to match users.user_id/name, but Together
usernames (mai, EIJI) never matched users table entries (maita, partner).
All JWT-bearing clients were getting 403. Reverts to member-row-only
check until user_id backfill is complete (Phase 1).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-19 19:08:36 +09:00
posimai a1483ed00b docs: refresh STATUS for posimai-boki and remove stale deploy note 
Made-with: Cursor
 2026-04-19 16:49:21 +09:00
posimai 925638250b fix(together): include invite_code in GET /together/groups/:id response 
Was accidentally excluded from SELECT, causing invite code to disappear
in the settings panel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-19 13:37:24 +09:00
posimai 96f22b6a82 fix(together): close JWT legacy-fallback impersonation hole 
When JWT is present but strict member check fails, verify the body
username belongs to the JWT user before allowing legacy access.
JWT-less clients (no Authorization header) are unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-19 13:06:14 +09:00
posimai c1173e5625 chore: enforce vercel alias set on new app creation — add to CLAUDE.md/AGENTS.md/create-app.sh/new-app-guide.md 2026-04-18 23:15:33 +09:00
posimai 276ae2dc9d chore(status): add mai pending tasks section (Firebase key, Stripe, etc.) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-18 09:55:54 +09:00
posimai 1eb94565d5 fix(together): add member auth to GET endpoints, remove comment_count JOIN 2026-04-18 08:51:16 +09:00
posimai 8f41c4736f feat(together): add 'read' to reaction type allowlist 2026-04-17 23:37:22 +09:00
posimai 59b8ff76ea chore: update posimai-guard submodule pointer 2026-04-17 19:01:44 +09:00
posimai b5b721cd60 fix(security): add SRI to xterm CDN, add manifest id, noreferrer to target=_blank 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-17 18:42:38 +09:00
posimai 147d85abf6 feat(together): cursor-based pagination API — limit/cursor クエリパラメーター追加 2026-04-17 18:34:06 +09:00
posimai f3cc672051 fix(security): add SRI integrity hashes to lucide CDN scripts in posimai-dev 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-17 08:12:36 +09:00
posimai 4b3b778f85 chore: update posimai-guard submodule pointer 2026-04-16 18:04:23 +09:00
posimai cedc4e0951 chore: update posimai-guard submodule pointer 2026-04-15 13:28:15 +09:00
posimai d1e254215b chore: update posimai-guard submodule pointer 2026-04-15 12:43:59 +09:00
posimai e960b9e2ac fix(brain): comprehensive review fixes — placeholder persistence, count accuracy, dead code 
- Gemini null 時: ⏳プレースホルダーを NULL で上書き（永続化バグ解消）
- /articles カウント: LIMIT後rows.filter()→専用COUNTクエリで正確化
- genAITogether 削除（genAI の alias で不要）
- quick-save: e.message のクライアント露出を固定メッセージに置換

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-15 09:11:27 +09:00
posimai 65ec560ebe chore: update posimai-guard submodule pointer 2026-04-15 09:08:41 +09:00
posimai bbb66a7ce8 chore: update posimai-guard submodule pointer 2026-04-15 08:31:20 +09:00
posimai e20296d297 chore: update posimai-guard submodule pointer (deploy script fix) 2026-04-15 08:19:35 +09:00
posimai 31a6243ae4 chore: update posimai-guard submodule pointer (dart/scan ext fixes) 2026-04-15 08:18:50 +09:00
posimai 47f82586d2 fix(brain): retry 503 once, don't persist failure message to DB 
- analyzeWithGemini: 503（一時高負荷）は4秒後に1回リトライ
- 失敗時は null を返し、呼び出し側で DB を更新しない
  → 「AI分析に失敗しました」がsummaryとして永続化されなくなる

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 23:39:46 +09:00
posimai b0e77839c2 chore: add src-tauri/target to .gitignore (prevent large build artifacts) 2026-04-14 23:30:31 +09:00
posimai 5bcd60eefd chore: update STATUS.md — ponshu APK + guard-ext + VS Code fix done 2026-04-14 23:22:25 +09:00
posimai b25b3f640e fix(brain): switch analyzeWithGemini from gemini-2.0-flash-lite to gemini-2.5-flash 
gemini-2.0-flash-lite のフリー枠日次クォータが枯渇し AI 分析が全件失敗していた。
gemini-2.5-flash に統一してクォータ問題を解消する。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 23:12:50 +09:00
posimai e7594370e7 feat(ext): integrate rule engine — scan works without API key 
- runRuleEngine() now runs first on every scan (133 rules, instant)
- Gemini/Claude become optional enhancement layers (deeper semantic scan)
- Removed hard requirement for API key to run scanWorkspace/scanFile
- tsconfig: remove rootDir restriction to allow relative import from guard app
- Status bar tooltip updated to reflect API-key-free scanning
- Bundle: 120kb minified (ruleEngine + RULE_FIXES included via esbuild)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-14 23:05:19 +09:00