Mirrors/super-productivity
1
0
Fork 0
mirror of https://github.com/johannesjo/super-productivity.git synced 2026-07-17 16:37:43 +00:00
Code Issues Projects Releases Wiki Activity
super-productivity/packages
History
Johannes Millan 6f88775ea2
fix(sync): authenticate LWW project-move footprint (#9053) (#9054) 
SuperSync E2EE (AES-256-GCM) authenticates only op.payload; envelope
fields including op.entityIds travel as plaintext. The two [TASK] LWW
Update meta-reducers trusted meta.entityIds (copied from that envelope)
to decide which tasks to relocate, so a compromised sync server could
inject victim ids and relocate arbitrary tasks. GHSA-8pxh-mgc7-gp3g.

Carry the deterministic move footprint (#9001) inside the encrypted,
authenticated payload as LwwUpdatePayload.projectMoveFootprint:

- createLWWUpdateOp writes the footprint to both op.entityIds (the
  server still needs plaintext ids for its indexed conflict detection
  and cannot read the ciphertext) and payload.projectMoveFootprint.
- convertOpToAction surfaces the authenticated copy onto
  meta.moveFootprint (mirrors the recreatesEntityAfterDelete pattern).
- Both LWW-TASK reducers (project repair + section membership) read
  meta.moveFootprint via a shared parseMoveFootprint helper and no
  longer trust meta.entityIds. Legacy ops without the field fall back
  to receiving-state repair.
- getTaskProjectMoveEntityIds (footprint re-derivation during conflict
  resolution, fed remote ops) reads the authenticated payload instead
  of op.entityIds, so a tampered remote envelope cannot be laundered
  into a freshly-authenticated merged op. Covers the disjoint-merge,
  local-win, and superseded-op callers via one choke point.

Additive optional field: forward/backward compatible, no crypto or
envelope-version change. The DELETE/archive (bulk-archive-filter) and
conflict-detection (get-op-entity-ids) envelope reads are suppression-
only, not relocation, and remain for the durable AAD hardening.
2026-07-15 21:52:06 +02:00
..
plugin-api feat(plugin): add PluginAPI.request with manifest allowedHosts allowlist (#8721) 2026-07-07 11:50:17 +02:00
plugin-dev fix(plugins): prevent automation rule data loss (#8972) 2026-07-13 19:12:13 +02:00
shared-schema fix(sync): make marked project deletions win LWW conflicts (#9009) 2026-07-14 19:58:33 +02:00
super-sync-server fix(sync): retention pruning, misc→tasks alias boundary & WS local-win re-upload (#9028) 2026-07-15 13:12:04 +02:00
sync-core fix(sync): authenticate LWW project-move footprint (#9053) (#9054) 2026-07-15 21:52:06 +02:00
sync-providers fix(sync): write split-compaction snapshots to immutable files (#9040) (#9047) 2026-07-15 16:57:11 +02:00
vite-plugin chore(deps): bump esbuild in the npm_and_yarn group across 0 directory (#8451) 2026-06-17 14:41:32 +02:00
build-packages.js fix(plugin): refresh procrastination buster i18n #5102 (#8145) 2026-06-08 20:44:43 +02:00
README.md feat: cleanup and update plugins 2 2025-06-29 06:36:02 +02:00

README.md

Super Productivity Packages

This directory contains plugin packages and the plugin API for Super Productivity.

Structure

  • plugin-api/ - TypeScript definitions for the plugin API
  • plugin-dev/ - Plugin development examples and tools
    • api-test-plugin/ - Basic API test plugin
    • procrastination-buster/ - Example SolidJS-based plugin
    • yesterday-tasks-plugin/ - Simple plugin showing yesterday's tasks
    • boilerplate-solid-js/ - Template for creating new SolidJS plugins (not built)
    • sync-md/ - Markdown sync plugin (not built)

Building Packages

All packages are built automatically when running the main build process:

npm run build:packages

This command:

  1. Builds the plugin-api TypeScript definitions
  2. Builds plugins that require compilation (e.g., procrastination-buster)
  3. Copies plugin files to src/assets/ for inclusion in the app

Development

To work on a specific plugin:

cd plugin-dev/[plugin-name]
npm install
npm run dev

Adding a New Plugin

  1. Create a new directory in plugin-dev/
  2. Add the plugin configuration to /packages/build-packages.js
  3. Run npm run build:packages to test the build

Notes

  • The boilerplate-solid-js and sync-md plugins are development templates and are not included in production builds
  • Plugin files are automatically copied to src/assets/ during the build process
  • The build script handles dependency installation automatically