Pre-live technical hardening

Author: joeblack2k

.github/workflows/ci.yml

@@ -65,3 +65,23 @@ jobs:
 
       - name: Security gate
         run: ./scripts/security-gate.sh
+
+  architecture:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install ripgrep
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+
+      - name: Architecture guard
+        run: ./scripts/architecture-guard.sh
+
+      - name: Go formatting guard
+        run: |
+          unformatted="$(gofmt -l backend/cmd/server/*.go)"
+          if [ -n "$unformatted" ]; then
+            echo "$unformatted"
+            exit 1
+          fi

backend/Dockerfile

@@ -24,6 +24,9 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags='-s -w' -o
 FROM gcr.io/distroless/static-debian12
 WORKDIR /app
 
+ARG RSM_VERSION=dev
+ARG RSM_COMMIT=
+
 COPY --from=backend-build /out/retrosave-api /usr/local/bin/retrosave-api
 COPY --from=backend-build /out/retrosave-healthcheck /usr/local/bin/retrosave-healthcheck
 COPY --from=frontend-build /src/frontend/dist /app/frontend-dist
@@ -35,6 +38,8 @@ ENV SAVE_ROOT=/saves
 ENV STATE_ROOT=/config
 ENV FRONTEND_DIST_DIR=/app/frontend-dist
 ENV CHEAT_PACK_ROOT=/app/contracts/cheats/packs
+ENV RSM_VERSION=${RSM_VERSION}
+ENV RSM_COMMIT=${RSM_COMMIT}
 
 EXPOSE 80
 

backend/cmd/server/agent_api_handlers.go

@@ -23,6 +23,7 @@ func registerAgentRoutes(r chi.Router, app *app, prefix string) {
 }
 
 func mountAgentRoutes(r chi.Router, app *app) {
+	r.Get("/runtime-config", app.handleRuntimeConfig)
 	r.Get("/overview", app.handleAgentOverview)
 	r.Get("/sync/status", app.handleAgentSyncStatus)
 	r.Get("/systems", app.handleAgentSystems)

backend/cmd/server/app_state.go

@@ -58,6 +58,7 @@ type app struct {
 	playStationStore            *playStationStore
 	n64ControllerPakStoreRef    *n64ControllerPakStore
 	saveRecords                 []saveRecord
+	saveIndex                   saveRecordIndex
 	enricher                    *gameEnricher
 	conflicts                   map[string]conflictRecord
 	syncLogs                    []syncLogRecord
@@ -315,6 +316,7 @@ func (a *app) createSave(input saveCreateInput) (saveRecord, error) {
 	a.mu.Lock()
 	a.saveRecords = append([]saveRecord{record}, a.saveRecords...)
 	a.saves = append([]saveSummary{record.Summary}, a.saves...)
+	a.saveIndex = buildSaveRecordIndex(a.saveRecords)
 	a.mu.Unlock()
 	return record, nil
 }
@@ -342,6 +344,7 @@ func (a *app) reloadSavesFromDisk() error {
 	a.mu.Lock()
 	a.saveRecords = records
 	a.saves = summaries
+	a.saveIndex = buildSaveRecordIndex(records)
 	a.mu.Unlock()
 	return nil
 }
@@ -361,6 +364,9 @@ func conflictKey(romSHA1, slotName string) string {
 func (a *app) latestSaveRecord(romSHA1, slotName string) (saveRecord, bool) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
+	if record, ok := a.saveIndex.latestByROMSlot(romSHA1, slotName); ok {
+		return record, true
+	}
 	return latestSaveRecordLocked(a.saveRecords, romSHA1, slotName)
 }
 

backend/cmd/server/contract_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"strings"
 	"testing"
@@ -113,6 +114,106 @@ func TestContractSaveLatestMissingAndSuccessShape(t *testing.T) {
 	}
 }
 
+func TestContractSaveLatestFallsBackToCanonicalTrackContext(t *testing.T) {
+	h := newContractHarness(t)
+
+	upload := uploadSave(t, h, "/saves", map[string]string{
+		"rom_sha1": "pokemon-cloud-rom",
+		"slotName": "default",
+		"system":   "gameboy",
+	}, "Pokemon Noise Loop.srm", buildNonBlankPayload(8192, 0x23))
+	saveObj := mustObject(t, upload["save"], "save")
+	wantID := mustString(t, saveObj["id"], "save.id")
+	wantSHA := mustString(t, saveObj["sha256"], "save.sha256")
+
+	withoutContext := h.request(http.MethodGet, "/save/latest?romSha1=pokemon-local-rom&slotName=default", nil)
+	assertStatus(t, withoutContext, http.StatusOK)
+	withoutBody := decodeJSONMap(t, withoutContext.Body)
+	if mustBool(t, withoutBody["exists"], "exists") {
+		t.Fatalf("expected exact latest miss without track context: %s", prettyJSON(withoutBody))
+	}
+
+	query := url.Values{}
+	query.Set("romSha1", "pokemon-local-rom")
+	query.Set("slotName", "default")
+	query.Set("filename", "Pokemon Noise Loop.srm")
+	query.Set("system", "gameboy")
+	withContext := h.request(http.MethodGet, "/save/latest?"+query.Encode(), nil)
+	assertStatus(t, withContext, http.StatusOK)
+	withBody := decodeJSONMap(t, withContext.Body)
+	if !mustBool(t, withBody["exists"], "exists") {
+		t.Fatalf("expected latest fallback hit with track context: %s", prettyJSON(withBody))
+	}
+	if got := mustString(t, withBody["id"], "id"); got != wantID {
+		t.Fatalf("expected fallback id %q, got %q", wantID, got)
+	}
+	if got := mustString(t, withBody["sha256"], "sha256"); got != wantSHA {
+		t.Fatalf("expected fallback sha %q, got %q", wantSHA, got)
+	}
+	if indexed, ok := h.app.findSaveRecordByID(wantID); !ok || indexed.Summary.SHA256 != wantSHA {
+		t.Fatalf("expected indexed lookup to match uploaded save, got ok=%v record=%+v", ok, indexed.Summary)
+	}
+}
+
+func TestContractRuntimeConfigShapeAndAuthMode(t *testing.T) {
+	t.Setenv("AUTH_MODE", "disabled")
+	t.Setenv("RSM_VERSION", "test-version")
+	t.Setenv("RSM_COMMIT", "test-commit")
+	h := newContractHarness(t)
+
+	rr := h.request(http.MethodGet, "/api/runtime-config", nil)
+	assertStatus(t, rr, http.StatusOK)
+	assertJSONContentType(t, rr)
+
+	body := decodeJSONMap(t, rr.Body)
+	if !mustBool(t, body["success"], "success") {
+		t.Fatalf("expected success=true")
+	}
+	runtime := mustObject(t, body["runtime"], "runtime")
+	if mustString(t, runtime["appName"], "runtime.appName") != "RetroSaveManager" {
+		t.Fatalf("unexpected app name: %s", prettyJSON(runtime))
+	}
+	if got := mustString(t, runtime["authMode"], "runtime.authMode"); got != "disabled" {
+		t.Fatalf("unexpected auth mode %q", got)
+	}
+	if mustBool(t, runtime["authEnabled"], "runtime.authEnabled") {
+		t.Fatalf("expected authEnabled=false when AUTH_MODE=disabled")
+	}
+	if got := mustString(t, runtime["version"], "runtime.version"); got != "test-version" {
+		t.Fatalf("unexpected version %q", got)
+	}
+	if got := mustString(t, runtime["commit"], "runtime.commit"); got != "test-commit" {
+		t.Fatalf("unexpected commit %q", got)
+	}
+	features := mustObject(t, runtime["features"], "runtime.features")
+	if !mustBool(t, features["selfHosted"], "features.selfHosted") {
+		t.Fatalf("expected selfHosted feature")
+	}
+	if mustBool(t, features["publicSignup"], "features.publicSignup") {
+		t.Fatalf("public signup should be disabled for self-host release")
+	}
+	warnings := mustArray(t, runtime["warnings"], "runtime.warnings")
+	if len(warnings) == 0 {
+		t.Fatalf("expected LAN-only warning when auth is disabled")
+	}
+}
+
+func TestContractRuntimeConfigAuthEnabled(t *testing.T) {
+	t.Setenv("AUTH_MODE", "enabled")
+	h := newContractHarness(t)
+
+	rr := h.request(http.MethodGet, "/runtime-config", nil)
+	assertStatus(t, rr, http.StatusOK)
+	body := decodeJSONMap(t, rr.Body)
+	runtime := mustObject(t, body["runtime"], "runtime")
+	if got := mustString(t, runtime["authMode"], "runtime.authMode"); got != "enabled" {
+		t.Fatalf("unexpected auth mode %q", got)
+	}
+	if !mustBool(t, runtime["authEnabled"], "runtime.authEnabled") {
+		t.Fatalf("expected authEnabled=true when AUTH_MODE=enabled")
+	}
+}
+
 func TestContractSaveLatestSkipsBrokenPayloadRecords(t *testing.T) {
 	h := newContractHarness(t)
 

backend/cmd/server/dreamcast_vmu_test.go

@@ -172,12 +172,12 @@ func TestContractSavesMultipartAcceptsDreamcastVMUImage(t *testing.T) {
 	helperKey := createHelperAppPassword(t, h, "", "dreamcast-helper")
 
 	uploadSave(t, h, "/saves", map[string]string{
-		"app_password": helperKey,
-		"rom_sha1":     "dc-line:dreamcast:mister:a1",
-		"slotName":     "A1",
-		"system":       "dreamcast",
-		"device_type":  "mister",
-		"fingerprint":  "dreamcast-device",
+		"app_password":   helperKey,
+		"rom_sha1":       "dc-line:dreamcast:mister:a1",
+		"slotName":       "A1",
+		"system":         "dreamcast",
+		"device_type":    "mister",
+		"fingerprint":    "dreamcast-device",
 		"runtimeProfile": "dreamcast/mister",
 	}, "Sonic Adventure 2.A1.bin", buildDreamcastVMUWithSingleSave())
 
@@ -210,12 +210,12 @@ func TestContractSavesMultipartRejectsEmptyDreamcastVMUImage(t *testing.T) {
 	helperKey := createHelperAppPassword(t, h, "", "dreamcast-helper")
 
 	rr := h.multipart("/saves", map[string]string{
-		"app_password": helperKey,
-		"rom_sha1":     "dc-line:dreamcast:mister:a1",
-		"slotName":     "A1",
-		"system":       "dreamcast",
-		"device_type":  "mister",
-		"fingerprint":  "dreamcast-device",
+		"app_password":   helperKey,
+		"rom_sha1":       "dc-line:dreamcast:mister:a1",
+		"slotName":       "A1",
+		"system":         "dreamcast",
+		"device_type":    "mister",
+		"fingerprint":    "dreamcast-device",
 		"runtimeProfile": "dreamcast/mister",
 	}, "file", "Sonic Adventure 2.A1.bin", buildDreamcastEmptyVMU())
 	assertStatus(t, rr, http.StatusUnprocessableEntity)

backend/cmd/server/dto.go

@@ -25,6 +25,39 @@ type apiError struct {
 	StatusCode int    `json:"statusCode"`
 }
 
+type runtimeConfigResponse struct {
+	Success bool          `json:"success"`
+	Runtime runtimeConfig `json:"runtime"`
+}
+
+type runtimeConfig struct {
+	AppName     string                `json:"appName"`
+	AuthMode    string                `json:"authMode"`
+	AuthEnabled bool                  `json:"authEnabled"`
+	BaseURL     string                `json:"baseUrl"`
+	Version     string                `json:"version"`
+	Commit      string                `json:"commit"`
+	Features    runtimeConfigFeatures `json:"features"`
+	Warnings    []string              `json:"warnings"`
+}
+
+type runtimeConfigFeatures struct {
+	SelfHosted       bool `json:"selfHosted"`
+	PublicSignup     bool `json:"publicSignup"`
+	HelperPairing    bool `json:"helperPairing"`
+	SaveValidation   bool `json:"saveValidation"`
+	RuntimeModules   bool `json:"runtimeModules"`
+	CloudMultiTenant bool `json:"cloudMultiTenant"`
+}
+
+type saveListResponse struct {
+	Success bool          `json:"success"`
+	Saves   []saveSummary `json:"saves"`
+	Total   int           `json:"total"`
+	Limit   int           `json:"limit"`
+	Offset  int           `json:"offset"`
+}
+
 type lookupQuery struct {
 	Type  string          `json:"type"`
 	Value json.RawMessage `json:"value"`

backend/cmd/server/routes.go

@@ -59,6 +59,7 @@ func registerCompatRoutes(r chi.Router, app *app, prefix string) {
 
 func mountCompatRoutes(r chi.Router, app *app) {
 	r.Get("/stripe/status", handleUnsupportedBillingAlias)
+	r.Get("/runtime-config", app.handleRuntimeConfig)
 
 	r.Post("/auth/login", app.handleAuthLogin)
 	r.Post("/auth/signup", app.handleAuthSignup)

backend/cmd/server/runtime_config_handlers.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"net/http"
+	"os"
+	"strings"
+)
+
+func (a *app) handleRuntimeConfig(w http.ResponseWriter, r *http.Request) {
+	_ = requestPrincipal(r)
+	mode := authMode()
+	writeJSON(w, http.StatusOK, runtimeConfigResponse{
+		Success: true,
+		Runtime: runtimeConfig{
+			AppName:     "RetroSaveManager",
+			AuthMode:    mode,
+			AuthEnabled: mode != "disabled",
+			BaseURL:     baseURLForRequest(r),
+			Version:     runtimeConfigValue("RSM_VERSION", "dev"),
+			Commit:      runtimeConfigValue("RSM_COMMIT", ""),
+			Features: runtimeConfigFeatures{
+				SelfHosted:       true,
+				PublicSignup:     false,
+				HelperPairing:    true,
+				SaveValidation:   true,
+				RuntimeModules:   true,
+				CloudMultiTenant: false,
+			},
+			Warnings: runtimeConfigWarnings(mode),
+		},
+	})
+}
+
+func runtimeConfigValue(key, fallback string) string {
+	value := strings.TrimSpace(os.Getenv(key))
+	if value == "" {
+		return fallback
+	}
+	return value
+}
+
+func runtimeConfigWarnings(mode string) []string {
+	if mode == "disabled" {
+		return []string{"Authentication is disabled. Keep this instance on a trusted LAN or protect it behind your own reverse proxy."}
+	}
+	return []string{}
+}