buildmymcpserver/apps/web/app/globals.css

171 lines
4.4 KiB
CSS
Raw Normal View History

@import 'tailwindcss';
@theme {
--color-bg: #0a0a0b;
--color-bg-elevated: #111114;
--color-bg-subtle: #16161a;
--color-fg: #fafafa;
--color-fg-muted: #a1a1aa;
--color-fg-subtle: #71717a;
--color-border: #1f1f22;
--color-border-strong: #2a2a2e;
--color-accent: #6366f1;
--color-accent-fg: #ffffff;
--color-success: #22c55e;
--color-warn: #f59e0b;
--color-danger: #ef4444;
--font-sans: var(--font-geist-sans), ui-sans-serif, system-ui, -apple-system, sans-serif;
--font-mono: var(--font-geist-mono), ui-monospace, SFMono-Regular, Menlo, monospace;
--radius-sm: 4px;
--radius-md: 6px;
--radius-lg: 8px;
}
@layer base {
* {
border-color: var(--color-border);
}
html {
color-scheme: dark;
background: var(--color-bg);
-webkit-font-smoothing: antialiased;
text-rendering: optimizeLegibility;
/* Safety net against a stray wide element causing horizontal scroll on
mobile. `clip` (not `hidden`) does not create a scroll container, so it
leaves position: sticky intact. */
overflow-x: clip;
}
body {
background: var(--color-bg);
color: var(--color-fg);
font-family: var(--font-sans);
font-feature-settings: 'cv11', 'ss01';
}
::selection {
background: rgba(99, 102, 241, 0.3);
color: var(--color-fg);
}
/* Focus rings */
:focus-visible {
outline: 2px solid var(--color-accent);
outline-offset: 2px;
}
fix(security): template integration sovereign audit + critical fixes P0 — three critical issues found by tracing every attack vector on the template publish + fork + render path. All three fixed and verified with attack tests. FIX A — Takedown actually stops malicious containers PATCH /v1/admin/templates with status=takedown previously only updated mcp_servers.status to 'paused' in the DB. The Docker container kept running and serving traffic on its allocated port — takedown was cosmetic. Now the endpoint enumerates every fork's container, calls 'docker rm -f' on each, clears container_id/public_url/host_port in the DB, and returns the stoppedContainers count. New apps/api/src/lib/docker.ts owns the stop logic. Verified: takedown stopped container f5632962, port 4109 connection refused. FIX B — Reject specEdit on fork A hand-crafted POST /v1/servers with {templateId, previewId, specEdit} would enter the spec-edit branch, merge edits into the cached spec, but the worker reads the pre-built template code (separate cache key), ignoring the merged spec entirely. User thinks they changed something; deployed container behaves as the original. Now returns 400 spec_edit_forbidden_on_fork with an explainer pointing to the Iterate flow. FIX C — templateId validation via Redis fork-ref templateId on POST /v1/servers was user-controlled and unvalidated: fork_count of any template could be pumped, mcp_servers got garbage template_id rows, takedown cascade would miss the bogus rows. Fork endpoint now writes a Redis key fork-ref:<previewId> -> templateId (5min TTL). Server-create requires the ref to exist AND match the submitted templateId. Verified attack: fake templateId without fork-ref returns 410 fork_ref_expired. DEFENSE-IN-DEPTH — Hardened static checks Banned patterns (added): Function\s*\(['"`] — Function('code')() form, no 'new' needed \bimport\s*\( — dynamic import escapes bundle scope \bsetTimeout\s*\(['"`] — setTimeout('code', ms) eval form \bsetInterval\s*\(['"`] \bfs\s*\.\s*(unlink|rmdir|rm)\b \bprocess\s*\.\s*kill\b you are now in (developer|jailbreak|dan) mode — extra jailbreak markers Hardcoded-credential patterns (new — scanForLeakedSecrets): sk-ant-(api|sid)… — Anthropic sk-… — OpenAI sk_(live|test)_… — Stripe ghp_… — GitHub PAT github_pat_… — GitHub fine-grained xox[bpoasr]-… — Slack AKIA[0-9A-Z]{16} — AWS -----BEGIN…PRIVATE KEY----- — RSA / SSH / GPG Triggered when a publisher pasted their key into the prompt and Claude embedded it literally in the generated code. Publish-blocking. Verified attack: smuggled 'Function("return 1")' into a build's generated_code, attempted publish → 422 publish_blocked. Slug regex tightened — fork + detail routes now require ^[a-z0-9][a-z0-9-]{0,63}$ (was loose min(1).max(64) — letting through '../admin', long strings, mixed case). UI warning — Publish-as-template form now shows an amber callout listing what's scanned and explicitly stating egress allowlisting is roadmap, not enforced today (was misleading: the field was collected, never enforced). TEMPLATE_SECURITY_AUDIT.md added — documents all 20 audited vectors with severity, status, and rationale for what's deferred. UI polish globals.css — select/input/textarea/button get color-scheme: dark + custom chevron + option styling so Chrome's native popdown stops rendering as a white OS-themed widget on dark pages. The /templates category dropdown was the immediate trigger; same rule applies system-wide.
2026-05-19 23:35:45 +02:00
/* Force dark native UI for form controls — Chrome popdown otherwise reverts to OS light theme */
select,
input,
textarea,
button {
color-scheme: dark;
}
/* Style native select arrow + ensure the dropdown popdown uses our dark token */
select {
background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%23a1a1aa' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'><polyline points='6 9 12 15 18 9'/></svg>");
background-repeat: no-repeat;
background-position: right 8px center;
background-size: 12px;
-webkit-appearance: none;
-moz-appearance: none;
appearance: none;
padding-right: 26px !important;
}
select option {
background: var(--color-bg-elevated);
color: var(--color-fg);
}
/* Scrollbars */
::-webkit-scrollbar {
width: 10px;
height: 10px;
}
::-webkit-scrollbar-track {
background: transparent;
}
::-webkit-scrollbar-thumb {
background: var(--color-border-strong);
border-radius: 5px;
}
::-webkit-scrollbar-thumb:hover {
background: var(--color-fg-subtle);
}
/* Textarea resize grip light hatching on a dark square so it matches the
theme instead of the OS default (light square with dark hatching). */
textarea::-webkit-resizer {
background-color: var(--color-bg);
background-image: repeating-linear-gradient(
-45deg,
var(--color-fg-muted) 0 1px,
transparent 1px 4px
);
border-bottom-right-radius: var(--radius-md);
}
}
@layer components {
.panel {
background: var(--color-bg-elevated);
border: 1px solid var(--color-border);
border-radius: var(--radius-md);
}
.panel-subtle {
background: var(--color-bg-subtle);
border: 1px solid var(--color-border);
border-radius: var(--radius-md);
}
.mono {
font-family: var(--font-mono);
font-size: 0.8125rem;
letter-spacing: -0.01em;
}
/* Reduced motion */
@media (prefers-reduced-motion: reduce) {
*,
*::before,
*::after {
animation-duration: 0.001ms !important;
animation-iteration-count: 1 !important;
transition-duration: 0.001ms !important;
}
}
/* A loading spinner reports system status WCAG treats status indicators as
an exception to reduced-motion, so keep it spinning after the rule above
has damped every decorative animation. Same layer + higher specificity
than the universal selector, so this !important wins. */
@media (prefers-reduced-motion: reduce) {
.animate-spin {
animation-duration: 1s !important;
animation-iteration-count: infinite !important;
}
}
}
@keyframes pulse-dot {
0%, 100% {
opacity: 1;
transform: scale(1);
}
50% {
opacity: 0.5;
transform: scale(0.9);
}
}
@keyframes shimmer {
0% {
background-position: -1000px 0;
}
100% {
background-position: 1000px 0;
}
}
@keyframes fade-in {
from {
opacity: 0;
transform: translateY(2px);
}
to {
opacity: 1;
transform: translateY(0);
}
}