careermate 0.1.1 → 0.1.2

package/apps/web/src/http.ts

@@ -107,8 +107,13 @@ export async function readJsonBody<T>(req: IncomingMessage, schema?: ZodType<T>)
     return schema.parse(parsed);
   } catch (e) {
     if (e instanceof ZodError) {
-      const msg = e.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ');
-      throw new HttpError(400, `입력값 검증 실패 — ${msg}`, 'validation');
+      // Messages already written as full Korean guidance are shown as-is (the zod
+      // path like "links.0.url" is developer jargon). Generic/English messages keep
+      // a field hint so the user knows which input to fix.
+      const msg = e.issues
+        .map((i) => (/[가-힣]/.test(i.message) ? i.message : `${i.path.join('.') || '입력값'}: ${i.message}`))
+        .join('\n');
+      throw new HttpError(400, msg, 'validation');
     }
     throw e;
   }
@@ -170,11 +175,33 @@ export function serveStatic(
   const mime = MIME[ext] ?? 'application/octet-stream';
   let payload: Buffer | string = fs.readFileSync(resolved);
   if (transform && (ext === '.html')) payload = transform(payload.toString('utf8'));
-  res.writeHead(200, {
+  const headers: Record<string, string> = {
     'Content-Type': mime,
     'X-Content-Type-Options': 'nosniff',
     'Cache-Control': ext === '.html' ? 'no-store' : 'no-cache',
-  });
+  };
+  if (ext === '.html') {
+    // Content-Security-Policy: with no inline scripts and only same-origin
+    // assets, any XSS that slips past escaping can't load external code or
+    // exfiltrate (connect-src 'self'). Dashboard pages (served with the token
+    // transform) hold the CSRF token and render user-controlled career data, so
+    // they get a strict no-inline-script policy. The install page (no transform)
+    // is static marketing with inline bootstrap scripts (theme/carousel), so it
+    // permits inline script but keeps every other hardening directive.
+    const scriptSrc = transform ? "script-src 'self'" : "script-src 'self' 'unsafe-inline'";
+    headers['Content-Security-Policy'] = [
+      "default-src 'none'",
+      scriptSrc,
+      "style-src 'self' 'unsafe-inline'", // inline style="" attrs + JS-set element styles
+      "img-src 'self' data:", // data: favicon + local screenshots/icons
+      "font-src 'self'",
+      "connect-src 'self'",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'", // clickjacking guard
+    ].join('; ');
+  }
+  res.writeHead(200, headers);
   res.end(payload);
   return true;
 }

package/apps/web/src/info.ts

@@ -10,11 +10,11 @@ import {
   getBackupsDir,
   getEntityCounts,
 } from '@careermate/db';
+import { APP_VERSION } from '@careermate/shared';
 
 export const APP_NAME = 'CareerMate';
-// 번들 빌드(esbuild)에서 package.json 버전으로 치환된다. tsx 개발 실행에서는 정의되지 않아 typeof로 안전 분기.
-declare const __APP_VERSION__: string | undefined;
-export const APP_VERSION = typeof __APP_VERSION__ !== 'undefined' ? __APP_VERSION__ : '0.0.0-dev';
+// 버전은 @careermate/shared 단일 출처에서. (번들에서 package.json 버전으로 치환)
+export { APP_VERSION };
 
 let _port = 0;
 export function setServerPort(port: number): void {

package/apps/web/src/routes.ts

@@ -22,6 +22,7 @@ import {
   APPLICATION_STATUS_LABELS,
   DOCUMENT_KIND_LABELS,
   APPLICATION_BOARD_ORDER,
+  INTERVIEW_UNLOCK_STATUSES,
   type DocumentKind,
   type JobInput,
 } from '@careermate/shared';
@@ -263,7 +264,7 @@ export function registerApiRoutes(router: Router): void {
     const preps = interviewRepo.list().map((p) => ({ ...p, job: jobRepo.get(p.job_id) }));
     const eligible = applicationRepo
       .list()
-      .filter((a) => ['document_passed', 'interview', 'final_passed'].includes(a.status))
+      .filter((a) => INTERVIEW_UNLOCK_STATUSES.includes(a.status))
       .map((a) => ({
         job: jobRepo.get(a.job_id),
         status: a.status,

package/apps/web/src/server.ts

@@ -6,15 +6,12 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getDb, writeRuntimeInfo, clearRuntimeInfo } from '@careermate/db';
+import { BUNDLED } from '@careermate/shared';
 import { checkRequest, injectToken } from './security.ts';
 import { Router, sendJson, sendDownload, serveStatic, HttpError } from './http.ts';
 import { registerApiRoutes, isDownload } from './routes.ts';
 import { setServerPort } from './info.ts';
 
-// 번들 빌드(esbuild)에서 true로 치환된다. tsx 개발 실행에서는 정의되지 않아 typeof로 안전 분기.
-declare const __BUNDLED__: boolean | undefined;
-const BUNDLED = typeof __BUNDLED__ !== 'undefined' && __BUNDLED__;
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dev(tsx): apps/web/src 기준 상대경로 · prod(dist/web.mjs): dist 기준.
 const WEB_ROOT = BUNDLED ? path.resolve(__dirname, 'public') : path.resolve(__dirname, '..', 'public');