@usequark/quark-create-app 1.25.14 → 1.25.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.14",
+  "version": "1.25.16",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",
@@ -59,9 +59,8 @@
     "sync-templates:check": "node scripts/sync-templates.js --check",
     "regen-migration": "node scripts/regenerate-template-migration.js",
     "smoke:published": "node scripts/smoke-published.js",
-    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-warning.test.js && node --test src/scaffold-output.test.js && node --test src/scaffold-drift.test.js && node --test src/mobile-template.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/template-config.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js'",
+    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-warning.test.js && node --test src/scaffold-output.test.js && node --test src/scaffold-drift.test.js && node --test src/mobile-template.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/template-config.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js' && node --test test-flags.js",
     "test:build": "node test-build.js",
-    "test:e2e": "node test-e2e.js",
     "test:e2e:full": "node test-e2e-full.js",
     "test:integration": "node test-integration.js",
     "test:flags": "node --test test-flags.js",

package/src/index.js

@@ -705,8 +705,11 @@ program
 						`          as its own repository, or\n` +
 						`        • scaffold into a temporary folder and move the files to\n` +
 						`          the repository root before the first commit.\n\n` +
-						`      Git initialization will be skipped to avoid creating a\n` +
-						`      nested repository.\n\n` +
+						`      Git initialization ${
+							process.env.QUARK_FORCE_GIT_INIT === "true"
+								? "will run anyway (QUARK_FORCE_GIT_INIT=true)."
+								: "will be skipped to avoid creating a\n      nested repository."
+						}\n\n` +
 						`      GitHub only runs workflows stored at the repository root, so\n` +
 						`      <project>/.github/workflows/*.yml will be ignored by GitHub\n` +
 						`      Actions.\n`,
@@ -1577,7 +1580,11 @@ STORAGE_PROVIDER=local
 			// Step 11: Initialize git repository
 			if (process.env.QUARK_SKIP_GIT_INIT === "true") {
 				console.log(chalk.dim("\n  · Skipping git initialization"));
-			} else if (enclosingRepo) {
+			} else if (enclosingRepo && process.env.QUARK_FORCE_GIT_INIT !== "true") {
+				// `initializeGit()` also checks QUARK_FORCE_GIT_INIT internally,
+				// but it is only reached in the else branch below — short-
+				// circuiting here on `enclosingRepo` alone made the documented
+				// force flag a no-op.
 				console.log(
 					chalk.dim(
 						"\n  · Skipping git initialization (inside an existing repository)",

package/templates/base-project/apps/web/src/app/api/files/[id]/route.js

@@ -59,17 +59,43 @@ export async function GET(_request, { params }) {
 		// max-age bounds that window instead.
 		headers.set("Cache-Control", "public, max-age=3600");
 
-		// Inline display for images; attachment download for everything else
-		const isImage = record.mimeType.startsWith("image/");
+		// Inline display is limited to raster formats. SVG is deliberately not
+		// among them: an SVG is an XML document that can carry <script>, this
+		// endpoint is public and same-origin, and CSP `default-src 'self'`
+		// permits those scripts to run — so a stored SVG served inline executes
+		// in the app's own origin (stored XSS; audit item 8). SVG therefore
+		// downloads as an attachment, and its response additionally carries a
+		// sandbox CSP so a browser that ignores the disposition still cannot
+		// run scripts, fetch, or embed the document.
+		const INLINE_SAFE_TYPES = new Set([
+			"image/jpeg",
+			"image/png",
+			"image/gif",
+			"image/webp",
+			"image/avif",
+		]);
+		const isInlineSafe = INLINE_SAFE_TYPES.has(record.mimeType);
+		const isSvg = record.mimeType === "image/svg+xml";
 		const safeName = record.originalName.replace(/[\\"\r\n]/g, "_");
 		const encodedName = encodeURIComponent(record.originalName);
 		headers.set(
 			"Content-Disposition",
-			isImage
+			isInlineSafe
 				? `inline; filename="${safeName}"; filename*=UTF-8''${encodedName}`
 				: `attachment; filename="${safeName}"; filename*=UTF-8''${encodedName}`,
 		);
 
+		if (isSvg) {
+			// `sandbox` with no allow-list: no scripts, no same-origin framing,
+			// no form submission. `style-src 'unsafe-inline'` keeps simple
+			// presentational SVGs viewable; nothing in this policy can execute
+			// code.
+			headers.set(
+				"Content-Security-Policy",
+				"default-src 'none'; style-src 'unsafe-inline'; sandbox",
+			);
+		}
+
 		return new Response(body, { status: 200, headers });
 	} catch (error) {
 		return handleError(error);

package/templates/base-project/apps/web/src/proxy.js

@@ -10,11 +10,14 @@
  */
 
 import { getAllowedOrigins } from "@usequark/quark-config/app-url";
+import { createLogger, createRateLimiter } from "@usequark/quark-core/core";
 import { NextResponse } from "next/server";
 
 import { buildContentSecurityPolicy } from "./lib/analytics/umami-csp.js";
 import { getRateLimitBucket, isRateLimitExempt } from "./lib/proxy-auth";
 
+const logger = createLogger("proxy");
+
 // ─── 1. Metrics guard ────────────────────────────────────────────────────────
 
 function metricsGuard(request) {
@@ -38,8 +41,57 @@ function metricsGuard(request) {
 	return null; // authorised - continue
 }
 
-// Simple in-memory rate limiter (use Redis for production)
-const rateLimit = new Map();
+// Rate limiter: Redis-backed when REDIS_URL is set (multi-instance), otherwise
+// in-memory (single instance). Fails CLOSED by default (see createRateLimiter).
+// The Redis client is created once and reused; ioredis reconnects on its own.
+let rateLimiterPromise = null;
+
+// Exported for tests: the Redis-vs-memory backend selection is otherwise only
+// observable through a live Redis connection, which the unit suite doesn't have.
+// The reset clears the memoised instance so a test can flip REDIS_URL and
+// re-select a backend; production code never calls it.
+export function __resetRateLimiterForTests() {
+	rateLimiterPromise = null;
+}
+
+export async function getRateLimiter() {
+	if (rateLimiterPromise) return rateLimiterPromise;
+
+	rateLimiterPromise = (async () => {
+		if (!process.env.REDIS_URL) {
+			return createRateLimiter({ type: "memory" });
+		}
+
+		try {
+			const { default: Redis } = await import("ioredis");
+			const redisClient = new Redis(process.env.REDIS_URL, {
+				maxRetriesPerRequest: 1,
+				enableReadyCheck: true,
+				retryStrategy(times) {
+					return Math.min(times * 50, 2000);
+				},
+			});
+			// ioredis emits an 'error' event on connection trouble; without a
+			// listener Node treats it as unhandled and kills the process.
+			redisClient.on("error", (err) => {
+				logger.error("Redis rate-limiter client error", {
+					message: err?.message ?? String(err),
+				});
+			});
+			return createRateLimiter({ type: "redis", redisClient });
+		} catch (error) {
+			logger.error("Redis rate limiter unavailable; using in-memory", {
+				message: error?.message ?? String(error),
+			});
+			// Losing Redis must not lose rate limiting entirely: a per-instance
+			// in-memory limiter is still a limiter. It just no longer spans
+			// instances, so a distributed attacker gets one budget per instance.
+			return createRateLimiter({ type: "memory" });
+		}
+	})();
+
+	return rateLimiterPromise;
+}
 
 /**
  * Resolve the client IP for rate-limit keying.
@@ -83,61 +135,25 @@ const RATE_LIMIT_CONFIG = {
 };
 
 /**
- * Rate limiting implementation
+ * Rate limiting implementation.
+ *
+ * Delegates to the core limiter (`createRateLimiter`): Redis-backed when
+ * REDIS_URL is set, in-memory otherwise. Its `checkLimit(key, max, window)`
+ * returns `{ limited, remaining, resetTime }` — the same shape this proxy
+ * already returned, so the response headers below are unchanged.
  */
-function checkRateLimit(ip, path, method) {
-	const now = Date.now();
-	const key = `${ip}:${path}`;
-
+async function checkRateLimit(ip, path, method) {
+	const limiter = await getRateLimiter();
 	const maxRequests =
 		RATE_LIMIT_CONFIG.maxRequests[getRateLimitBucket(path, method)];
 
-	// Get or create rate limit record
-	const record = rateLimit.get(key) || {
-		count: 0,
-		resetTime: now + RATE_LIMIT_CONFIG.windowMs,
-	};
-
-	// Reset if window has passed
-	if (now > record.resetTime) {
-		record.count = 0;
-		record.resetTime = now + RATE_LIMIT_CONFIG.windowMs;
-	}
-
-	// Check if limit exceeded
-	if (record.count >= maxRequests) {
-		return {
-			limited: true,
-			resetTime: record.resetTime,
-			remaining: 0,
-		};
-	}
-
-	// Increment counter
-	record.count++;
-	rateLimit.set(key, record);
-
-	return {
-		limited: false,
-		resetTime: record.resetTime,
-		remaining: maxRequests - record.count,
-	};
+	return limiter.checkLimit(
+		`${ip}:${path}`,
+		maxRequests,
+		RATE_LIMIT_CONFIG.windowMs,
+	);
 }
 
-/**
- * Clean up old rate limit records periodically.
- * `unref()` so the timer never holds the Node process open on shutdown.
- */
-const rateLimitCleanup = setInterval(() => {
-	const now = Date.now();
-	for (const [key, record] of rateLimit.entries()) {
-		if (now > record.resetTime) {
-			rateLimit.delete(key);
-		}
-	}
-}, 60 * 1000); // Clean up every minute
-if (typeof rateLimitCleanup.unref === "function") rateLimitCleanup.unref();
-
 /**
  * CORS configuration
  */
@@ -225,7 +241,7 @@ export async function proxy(request) {
 		const ip = getClientIp(request);
 		const rateLimitBucket = getRateLimitBucket(pathname, request.method);
 		const maxRequests = RATE_LIMIT_CONFIG.maxRequests[rateLimitBucket];
-		const rateLimitResult = checkRateLimit(ip, pathname, request.method);
+		const rateLimitResult = await checkRateLimit(ip, pathname, request.method);
 
 		if (rateLimitResult.limited) {
 			const retryAfter = Math.ceil(