diff --git a/.gitignore b/.gitignore index 311291e..540e0e1 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ Thumbs.db # Build / Release dist/ +relay diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..8e73c76 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,42 @@ +# AGENTS.md + +Instructions for AI coding agents working in this repository. + +## Project Overview + +ThruBox Server is a self-hostable relay server acting as a "dumb encrypted mailbox": it stores and forwards opaque encrypted payloads via a REST API. It never sees plaintext — all encryption/decryption happens client-side in the [ThruBox Client SDK](https://github.com/AOSSIE-Org/ThruBox-Client) or other consumers. + +## Repository Layout + +- `cmd/relay/` — server entrypoint +- Storage: embedded SQLite (WAL mode) via `mattn/go-sqlite3` +- `public/` — logo assets referenced by README +- `brand/` — logo, favicons, and brand guidelines (see `brand/Brand.md`) + +## Build, Test & Lint + +```bash +go mod download +go build -o relay-server ./cmd/relay +go vet ./... +go test ./... +./relay-server # run in a separate terminal — this blocks +``` + +Docker: + +```bash +docker compose up -d +``` + +**Note:** there are no `_test.go` files in the repository yet. If you add functionality, add tests alongside it — don't rely on this note as an excuse to skip tests. + +## Hard Constraints + +- Keep runtime dependencies minimal: standard library `net/http` plus `mattn/go-sqlite3`, `google/uuid`, and `yaml.v3` (see `go.mod`) — don't add a web framework, ORM, or other new dependency without discussing it in an issue first. +- All SQL must be parameterized (no string-concatenated queries) — this is a relay storing arbitrary payloads, so injection surface must stay closed. +- The server must never decrypt or inspect message payloads; it only stores/forwards opaque blobs. + +## Conventions + +- Configuration is read from `config.yaml` or environment variables (see the table in `README.md` "Configuration") — don't hardcode values that are already configurable. diff --git a/BestPracticesChecklist.md b/BestPracticesChecklist.md index ed8ba50..4344632 100644 --- a/BestPracticesChecklist.md +++ b/BestPracticesChecklist.md @@ -25,44 +25,44 @@ | Category | Met | Total | Status | |--------------------|-----|-------|--------| -| Basics | 0 | 8 | 🔴 | -| Change Control | 0 | 6 | 🔴 | -| Reporting | 0 | 8 | 🔴 | -| Quality | 0 | 11 | 🔴 | -| Security | 0 | 9 | 🔴 | -| Analysis | 0 | 7 | 🔴 | -| **Total** | **0** | **49** | **0%** | +| Basics | 8 | 8 | ✅ | +| Change Control | 5 | 6 | 🟡 | +| Reporting | 3 | 8 | 🔴 | +| Quality | 4 | 11 | 🔴 | +| Security | 4 | 9 | 🔴 | +| Analysis | 2 | 7 | 🔴 | +| **Total** | **26** | **49** | **53%** | --- ## 🏗️ Basics ### Project Website & Documentation -- [ ] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves. - - *Evidence URL:* +- [x] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves. + - *Evidence URL:* `README.md` — "ThruBox Server" intro ("dumb encrypted mailbox") -- [ ] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute. - - *Evidence URL:* +- [x] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute. + - *Evidence URL:* `README.md` "Getting Started"/"Contributing", GitHub Issues, `CONTRIBUTING.md` -- [ ] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one). - - *Evidence URL:* +- [x] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one). + - *Evidence URL:* `CONTRIBUTING.md` "Development Workflow" / "Pull Request Guidelines" -- [ ] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.). - - *Evidence URL:* +- [x] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.). + - *Evidence URL:* `CONTRIBUTING.md` "Code Style Guidelines", "Test Your Changes" -- [ ] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder). - - *Evidence URL:* `[ ]` N/A — *Justification:* +- [x] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder). + - *Evidence URL:* `README.md`, `AGENTS.md`, `brand/Brand.md` -- [ ] 🔴 **documentation_interface** — Reference documentation describes the external interface (API inputs/outputs, CLI flags, config schema, etc.). - - *Evidence URL:* `[ ]` N/A — *Justification:* +- [x] 🔴 **documentation_interface** — Reference documentation describes the external interface (API inputs/outputs, CLI flags, config schema, etc.). + - *Evidence URL:* `README.md` "API Endpoints" (send/fetch/delete) and "Configuration" table (YAML keys / env vars) ### Other Basics -- [ ] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software. - - *Evidence URL:* +- [x] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software. + - *Evidence URL:* GitHub Issues; [#thrubox Discord channel](https://discord.com/channels/995968619034984528/1525382676964446258) -- [ ] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted. - - *Note:* +- [x] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted. + - *Note:* All docs and issues are in English. --- @@ -70,27 +70,27 @@ ### Version Control -- [ ] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)* + - *Evidence URL:* GitHub repo, git history ### Version Numbering -- [ ] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0). - - *Evidence URL:* +- [x] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0). + - *Evidence URL:* Git tag `v1.0.0`; GitHub Release `v0.0.1` -- [ ] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)* - - *Note:* +- [x] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)* + - *Note:* Tags follow SemVer (`v1.0.0`, `v0.0.1`). -- [ ] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)* + - *Evidence URL:* `git tag` output ### Release Notes -- [ ] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. - - *Evidence URL:* `[ ]` N/A — *Justification (continuous delivery / no external reuse):* +- [x] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. + - *Evidence URL:* `.github/workflows/release-drafter.yml` auto-generates categorized release notes from PR titles/labels. - [ ] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release. - - *Evidence URL:* `[ ]` N/A — *Justification (no publicly known vulns / users can't self-update):* + - *Evidence URL:* `[~]` N/A — Justification: no publicly known/disclosed vulnerabilities to date. --- @@ -98,31 +98,31 @@ ### Bug Reporting -- [ ] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README). - - *Evidence URL:* +- [x] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README). + - *Evidence URL:* GitHub Issues; `.github/workflows/create-initial-issues.yml` -- [ ] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs. - - *Evidence URL:* +- [x] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs. + - *Evidence URL:* GitHub Issues - [ ] 🔴 **report_responses** — A majority of bug reports submitted in the last 2–12 months have been acknowledged (response ≠ fix). - - *Self-certification note:* + - *Self-certification note:* Not yet assessed — needs maintainer review of issue history. - [ ] 🟡 **enhancement_responses** — More than 50% of enhancement requests in the last 2–12 months have received a response. - - *Self-certification note:* + - *Self-certification note:* Not yet assessed. -- [ ] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this). - - *Evidence URL:* +- [x] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this). + - *Evidence URL:* GitHub Issues ### Vulnerability Reporting - [ ] 🔴 **vulnerability_report_process** — A vulnerability reporting process is documented (e.g., `SECURITY.md`). - - *Evidence URL:* + - *Evidence URL:* Not present — no `SECURITY.md` in repo. - [ ] 🟡 **vulnerability_report_private** — If private vulnerability reporting is supported, the method for private submission is documented. - - *Evidence URL:* `[ ]` N/A — *Justification:* + - *Evidence URL:* `[~]` N/A — Justification: no `SECURITY.md`/private channel documented yet. - [ ] 🔴 **vulnerability_report_response** — Initial response to any vulnerability report received in the last 6 months was within 14 days. - - *Self-certification note:* `[ ]` N/A — *Justification (no reports received):* + - *Self-certification note:* `[~]` N/A — Justification: no reports received (no vulnerability reporting process exists yet). --- @@ -130,44 +130,44 @@ ### Build System -- [ ] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source. - - *Evidence URL:* `[ ]` N/A — *Justification (interpreted language / no build step):* +- [x] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source. + - *Evidence URL:* `go build -o relay-server ./cmd/relay` (documented in README/CONTRIBUTING); `.github/workflows/release-goreleaser.yml` -- [ ] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A +- [x] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)* + - *Evidence URL:* Standard `go build`/`go mod`; GoReleaser for release artifacts. -- [ ] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools. - - *Note:* `[ ]` N/A +- [x] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools. + - *Note:* Go toolchain, GCC, and Docker are all FLOSS. ### Automated Testing - [ ] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)* - - *Evidence URL:* + - *Evidence URL:* `go test ./...` is the standard command, but no `_test.go` files exist in the repo yet — nothing to invoke. - [ ] 🔵 **test_most** — The test suite covers most code branches, input fields, and functionality. *(SUGGESTED)* - - *Estimated coverage %:* + - *Estimated coverage %:* 0% — no tests exist yet. ### New Functionality Testing Policy - [ ] 🔴 **test_policy** — The project has a general policy that new functionality must include tests in the automated test suite. - - *Evidence (CONTRIBUTING reference or informal policy):* + - *Evidence (CONTRIBUTING reference or informal policy):* `CONTRIBUTING.md` now asks contributors to add `_test.go` coverage for new functionality, but this isn't yet an enforced/CI-gated policy. - [ ] 🔴 **tests_are_added** — Evidence exists that the test policy has been followed in recent major changes (e.g., PRs include tests). - - *Evidence URL (recent PR with tests):* + - *Evidence URL (recent PR with tests):* Not applicable yet — no tests exist in the repo. -- [ ] 🔵 **tests_documented_added** — The test policy is documented in contribution instructions. *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **tests_documented_added** — The test policy is documented in contribution instructions. *(SUGGESTED)* + - *Evidence URL:* `CONTRIBUTING.md` "Test Your Changes" ### Linting / Warning Flags - [ ] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.). - - *Tool used:* + - *Tool used:* None currently configured — no `.golangci.yml` and no CI step runs `golangci-lint` or `go vet`. (`.coderabbit.yaml` references golangci-lint only as an AI-review suggestion, not an enforced tool.) - [ ] 🔴 **warnings_fixed** — Warnings from the linter are addressed (not suppressed without reason). - - *Note:* + - *Note:* `[~]` N/A — Justification: no linter currently configured (see `warnings` above). - [ ] 🔵 **warnings_strict** — Project uses maximum strictness in linter config where practical. *(SUGGESTED)* - - *Note:* + - *Note:* Not applicable yet — no linter configured. --- @@ -176,33 +176,33 @@ ### Secure Development Knowledge - [ ] 🔴 **know_secure_design** — At least one primary developer knows how to design secure software (familiar with OWASP, threat modeling, secure-by-default principles). - - *Self-certification note:* + - *Self-certification note:* To be self-certified by a maintainer. - [ ] 🔴 **know_common_errors** — At least one primary developer knows common vulnerability types for this software's category and how to mitigate them (e.g., injection, XSS, reentrancy for Solidity, prompt injection for AI). - - *Self-certification note:* + - *Self-certification note:* To be self-certified by a maintainer — particularly SQL injection and rate-limit bypass given this is a public relay API. ### Cryptography (mark N/A if project does not handle cryptography) -- [ ] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default. - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default. + - *Note:* N/A — The server stores/relays opaque encrypted blobs; it never performs encryption/decryption itself (README: "server never sees plaintext"). -- [ ] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions. - - *Library used:* `[ ]` N/A +- [~] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions. + - *Library used:* N/A — No cryptography implemented server-side. -- [ ] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented). - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented). + - *Note:* N/A — No cryptography implemented server-side. -- [ ] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default. - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default. + - *Note:* N/A — No cryptography implemented server-side. - [ ] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2). - - *Note:* `[ ]` N/A — *Justification (project doesn't store passwords):* + - *Note:* Server supports optional API key authentication (`security.api_key`) — not yet verified whether the key is stored/compared as a hash or in plaintext. Needs a maintainer/code review; not marking N/A since an API key is a credential. - [ ] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes. - - *Note:* `[ ]` N/A + - *Note:* Not yet verified — requires a code review of the API key generation path, if any. - [ ] 🟡 **delivery_unsigned** — Cryptographic hashes are NOT retrieved over plain HTTP without a signature check. - - *Note:* + - *Note:* Not assessed. --- @@ -211,27 +211,27 @@ ### Static Code Analysis - [ ] 🔴 **static_analysis_fixed** — All medium+ severity vulnerabilities found by static analysis are fixed in a timely manner after confirmation. - - *Note:* `[ ]` N/A + - *Note:* Not yet assessed — needs maintainer review of CodeQL alert history. -- [ ] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)* - - *Tool + ruleset:* `[ ]` N/A +- [x] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)* + - *Tool + ruleset:* CodeQL (`.github/workflows/codeql.yml`, Go support), Gitleaks secret scanning (`.github/workflows/gitleaks-scanning.yml`), OSV-Scanner for dependency vulnerabilities (`osv-scanner-pr.yml`, `osv-scanner-scheduled.yml`). -- [ ] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A +- [x] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)* + - *Evidence URL:* `codeql.yml` (push/PR + weekly), `gitleaks-scanning.yml` (push + daily 4 AM cron). ### Dynamic Code Analysis - [ ] 🔵 **dynamic_analysis** — At least one dynamic analysis tool is applied before major releases (fuzzer, web app scanner like OWASP ZAP, etc.). *(SUGGESTED)* - - *Tool used:* `[ ]` N/A — *Justification:* + - *Tool used:* Not currently used. - [ ] 🔵 **dynamic_analysis_enable_assertions** — Dynamic analysis / testing runs with assertions enabled (not just production mode). *(SUGGESTED)* - - *Note:* + - *Note:* Not assessed. - [ ] 🔴 **dynamic_analysis_fixed** — Medium+ severity vulnerabilities found by dynamic analysis are fixed in a timely manner. - - *Note:* `[ ]` N/A + - *Note:* Not applicable yet — no dynamic analysis tool configured. - [ ] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)* - - *Note:* `[ ]` N/A — *Justification (project uses memory-safe languages):* + - *Note:* The application code is Go (memory-safe), but `github.com/mattn/go-sqlite3` links C code via CGo, which Go's memory safety doesn't cover. No Valgrind/AddressSanitizer is currently used against that path — marking unmet rather than N/A. --- @@ -239,20 +239,14 @@ > Add domain-specific notes here for Web3, Full-Stack, or AI projects. -### Web3 / Solidity Notes -- Scorecard does not audit Solidity-specific security. Use [Slither](https://github.com/crytic/slither) for `static_analysis` and `warnings` criteria. -- For `crypto_*` criteria, document which cryptographic primitives your contracts rely on (e.g., ECDSA in EVM is standard). -- Smart contract audit reports count as evidence for `know_secure_design`. +### Backend / API Notes -### Full-Stack / Next.js Notes -- For `crypto_password_storage`: document which auth library handles hashing (e.g., NextAuth + bcrypt). -- For `dynamic_analysis`: [OWASP ZAP](https://www.zaproxy.org/) can be run as a GitHub Action. - -### AI / LLM Notes -- For `know_common_errors`: include awareness of prompt injection, data leakage, and model output validation. -- For `dynamic_analysis`: consider adversarial input testing as a form of dynamic analysis. +- This server never decrypts or inspects message payloads — all `crypto_*` criteria are N/A for the payload path itself. +- The optional `security.api_key` feature is a credential the server *does* handle — `crypto_password_storage`/`crypto_random` are left unmet pending a maintainer code review of how the key is generated/compared, rather than assumed N/A. +- No `_test.go` files exist yet — the biggest Quality gap. Recommend prioritizing tests for the message CRUD handlers and rate limiter before the next release. +- No linter (`golangci-lint`/`go vet`) is wired into CI yet, despite being referenced in `.coderabbit.yaml`'s review instructions. --- *This checklist complements [OpenSSF Scorecard](https://scorecard.dev/) (auto-detected checks) and is -inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.* \ No newline at end of file +inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.* diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8b5300b..73f6060 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,4 @@ -# Contributing to TODO: Project Name +# Contributing to ThruBox Server ⭐ First off, thank you for considering contributing to this project! ⭐ @@ -9,7 +9,7 @@ We welcome contributions from everyone. By participating in this project, you ag **All project communication MUST happen on Discord. We do not pay attention to GitHub notifications.** - Join our [Discord server](https://discord.gg/hjUhu33uAn) before starting any work -- Post your PR/issue updates in the relevant Discord channel (**MANDATORY**) +- Post your PR/issue updates in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) (**MANDATORY**) - All discussions, questions, and updates should be on Discord - GitHub is for code only - Discord is for communication @@ -68,36 +68,42 @@ What we expect: ### Prerequisites -TODO: List prerequisites specific to your project +- Go 1.23+ with CGo enabled (required for SQLite) +- GCC (for compiling `go-sqlite3`) +- Docker (optional, for containerized deployment) ### Setup 1. **Fork the Repository** + ```bash # Click the 'Fork' button at the top right of this page ``` 2. **Clone Your Fork** + ```bash - git clone https://github.com/YOUR_USERNAME/TODO.git - cd TODO + git clone https://github.com/YOUR_USERNAME/ThruBox-Server.git + cd ThruBox-Server ``` 3. **Add Upstream Remote** + ```bash - git remote add upstream https://github.com/AOSSIE-Org/TODO.git + git remote add upstream https://github.com/AOSSIE-Org/ThruBox-Server.git ``` 4. **Install Dependencies** + ```bash - npm install - # or yarn install - # or pnpm install + go mod download ``` 5. **Run the Project** + ```bash - npm run dev + go build -o relay-server ./cmd/relay + ./relay-server ``` ## 🔄 Development Workflow @@ -121,14 +127,14 @@ git checkout -b fix/your-bug-fix ### 3. Test Your Changes -TODO: Add project-specific testing instructions - ```bash -npm test -# or -npm run lint +go build ./... # make sure it compiles +go vet ./... # static checks +go test ./... # run the test suite ``` +The repository doesn't have test files yet — if you're adding new functionality, please add `_test.go` coverage for it alongside your change. + ### 4. Commit Your Changes Write clear, concise commit messages: @@ -210,7 +216,7 @@ Steps to test the changes ### After Submission -- Post your PR in the project's Discord channel for visibility(**IMPORTANT**) +- Post your PR in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) for visibility(**IMPORTANT**) - Respond to review comments promptly - Make requested changes in new commits - Be patient - maintainers will review when available @@ -223,7 +229,7 @@ Steps to test the changes ## 📝 Code Style Guidelines -TODO: Add project-specific code style guidelines +This is a Go project that keeps runtime dependencies minimal: `net/http` from the standard library plus `github.com/mattn/go-sqlite3`, `github.com/google/uuid`, and `gopkg.in/yaml.v3` (see `go.mod`). Discuss any new runtime dependency in an issue first. Run `gofmt`/`go vet` before committing, and keep the storage layer parameterized (no string-concatenated SQL) to avoid injection issues. ### General Guidelines @@ -538,4 +544,4 @@ If you encounter issues not covered here: - Check for existing PRs before starting to avoid duplication, as there might PRs that didn't mention the related issue -Thank you for contributing to TODO! Your efforts help make this project better for everyone. 🚀 +Thank you for contributing to ThruBox Server! Your efforts help make this project better for everyone. 🚀 diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..6b287cb --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,25 @@ +# Maintainers, Mentors and Ideators + +This document lists the individuals fulfilling the key roles of [Maintainer](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Maintainer.md), [Mentor](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Mentors.md) and [Ideator](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Ideator.md) for this repository, in accordance with [AOSSIE's Role Definitions](https://github.com/AOSSIE-Org/Info/tree/main/Roles). + +--- + +> **Note:** If multiple contributors are fulfilling a role in a single repository, please include and fill out the extra columns to clarify responsibilities (e.g., `Project / Feature Idea`, `Area / Focus`, and `Proposal / Discussion Link` for Ideators; `Area / Focus` for Mentors and Maintainers). If there is only one person for a role, do not add these columns. + +## Mentors + +| Name | GitHub Username | Discord Username | +| ----- | ---------------- | ------------------ | +| Bruno | @Zahnentferner | @b.wp | + +## Maintainers + +| Name | GitHub Username | Discord Username | Area / Focus | +| ------- | ------------------- | ------------------ | ----------------------------------- | +| Atharva | @Atharva0506 | @atharva0506 | Repository Maintenance & Merging | +| Karan | @kumawatkaran523 | @karankk9616 | Repository Maintenance & Merging | +| Aditya | @adityabhattad2021 | @adityabhattad | Repository Maintenance & Merging | + +## Ideators + +_No Ideators are currently assigned to this repository._ diff --git a/README.md b/README.md index f0f3c12..a263a55 100644 --- a/README.md +++ b/README.md @@ -182,6 +182,14 @@ The server starts on `http://localhost:3000` with a SQLite database that auto-cr docker compose up -d ``` +#### 5. Run Tests + +```bash +go test ./... +``` + +> No test files exist in the repository yet — this is the standard command to run once tests are added. See `CONTRIBUTING.md` before submitting a PR that adds functionality without tests. + ### Configuration Edit `config.yaml` or use environment variables: @@ -208,8 +216,7 @@ Thank you for considering contributing to this project! Contributions are highly ## ✨ Maintainers -- [Bruno](https://github.com/Zahnentferner) -- [Atharva](https://github.com/Atharva0506) +See [MAINTAINERS.md](./MAINTAINERS.md) for the full list of Mentors and Maintainers for this repository. --- diff --git a/brand/Brand.md b/brand/Brand.md new file mode 100644 index 0000000..2642b3a --- /dev/null +++ b/brand/Brand.md @@ -0,0 +1,43 @@ +# ThruBox Brand Kit + +This folder is the canonical source for ThruBox's visual identity: logos, favicons/icons, and color palette. All assets referenced below live in this `brand/` folder. `README.md` embeds its own copies of the two logo SVGs under `public/` — keep those in sync with the originals here if the brand mark changes. + +## Logo + +| Asset | File | +| --- | --- | +| ThruBox logo (SVG, with wordmark) | [`thrubox-logo.svg`](./thrubox-logo.svg) | +| AOSSIE org logo (SVG) | [`aossie-logo.svg`](./aossie-logo.svg) | + +The ThruBox mark is a Menger-sponge-style cube made of green tessellated tiles wrapped around a padlock, representing an encrypted "box" relaying data between clients. + +## Favicons & Icons + +Generated from `thrubox-logo.svg` at the standard sizes used across browsers, bookmarks, and mobile home screens: + +| File | Size | Use | +| --- | --- | --- | +| [`favicon.ico`](./favicon.ico) | 16/32/48 (multi-res) | Classic browser favicon | +| [`favicon-16x16.png`](./favicon-16x16.png) | 16×16 | Browser tab | +| [`favicon-32x32.png`](./favicon-32x32.png) | 32×32 | Browser tab (HiDPI) | +| [`favicon-48x48.png`](./favicon-48x48.png) | 48×48 | Windows taskbar | +| [`apple-touch-icon.png`](./apple-touch-icon.png) | 180×180 | iOS home screen | +| [`icon-512.png`](./icon-512.png) | 512×512 | PWA manifest / app icon | + +This server itself has no bundled web UI (it's a headless REST API) — the favicons/icons here aren't consumed by any application HTML, only by the repo's own README and any external dashboards, status pages, or documentation sites built around this server. + +## Color Palette + +Sourced directly from `thrubox-logo.svg` (shared with [ThruBox-Client](https://github.com/AOSSIE-Org/ThruBox-Client)): + +| Swatch | Name | Hex | Usage in logo | +| --- | --- | --- | --- | +| 🟩 | ThruBox Green (light) | `#3eb03e` | Sponge tile — top face | +| 🟩 | ThruBox Green (mid) | `#228B22` | Sponge tile — front face, wordmark | +| 🟩 | ThruBox Green (dark) | `#145A14` | Sponge tile — side face | +| ⬛ | Outline | `#0f420f` | Tile stroke | +| 🟨 | Lock Gold | `#FFC517` | Padlock accent, sourced from `thrubox-logo.svg` | + +## Typography + +This is a non-UI project (headless Go relay server) — there is no application typography to document. The wordmark in `thrubox-logo.svg` uses `'Arial Black', system-ui, sans-serif` at weight 900 as a logotype only. diff --git a/brand/aossie-logo.svg b/brand/aossie-logo.svg new file mode 100644 index 0000000..10cc0a8 --- /dev/null +++ b/brand/aossie-logo.svg @@ -0,0 +1,24 @@ + + + + + + + + + diff --git a/brand/apple-touch-icon.png b/brand/apple-touch-icon.png new file mode 100644 index 0000000..e505b1f Binary files /dev/null and b/brand/apple-touch-icon.png differ diff --git a/brand/favicon-16x16.png b/brand/favicon-16x16.png new file mode 100644 index 0000000..56fde4a Binary files /dev/null and b/brand/favicon-16x16.png differ diff --git a/brand/favicon-32x32.png b/brand/favicon-32x32.png new file mode 100644 index 0000000..9f3e350 Binary files /dev/null and b/brand/favicon-32x32.png differ diff --git a/brand/favicon-48x48.png b/brand/favicon-48x48.png new file mode 100644 index 0000000..ca45d57 Binary files /dev/null and b/brand/favicon-48x48.png differ diff --git a/brand/favicon.ico b/brand/favicon.ico new file mode 100644 index 0000000..1081ed4 Binary files /dev/null and b/brand/favicon.ico differ diff --git a/brand/icon-512.png b/brand/icon-512.png new file mode 100644 index 0000000..1464e7a Binary files /dev/null and b/brand/icon-512.png differ diff --git a/brand/thrubox-logo.svg b/brand/thrubox-logo.svg new file mode 100644 index 0000000..089f2db --- /dev/null +++ b/brand/thrubox-logo.svg @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ThruBox + diff --git a/checklist-status.json b/checklist-status.json index eb0242b..de48f0b 100644 --- a/checklist-status.json +++ b/checklist-status.json @@ -1,36 +1,36 @@ { "schemaVersion": 1, "label": "Best Practices", - "message": "0%", + "message": "53%", "schema": "aossie-best-practices-v1", - "updated": "2026-07-11", - "met": 0, + "updated": "2026-08-11", + "met": 26, "total": 49, - "percent": 0, - "color": "red", + "percent": 53, + "color": "orange", "categories": { "basics": { - "met": 0, + "met": 8, "total": 8 }, "change_control": { - "met": 0, + "met": 5, "total": 6 }, "reporting": { - "met": 0, + "met": 3, "total": 8 }, "quality": { - "met": 0, + "met": 4, "total": 11 }, "security": { - "met": 0, + "met": 4, "total": 9 }, "analysis": { - "met": 0, + "met": 2, "total": 7 } }