fix(webui,infra): drop private npm registry, httpOnly tokens, Helm secrets, proxy hardening (FC/FH/FM)

.github/workflows/build.yml

@@ -109,10 +109,40 @@ jobs:
       - name: Run flake8
         run: flake8 services/flask-backend/app/ tests/smoke/ --count --select=E9,F63,F7,F82 --show-source
 
+  test-webui:
+    name: Test WebUI (Lint, TypeCheck, Build)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: services/webui/package-lock.json
+
+      - name: Install dependencies
+        working-directory: services/webui
+        run: npm ci
+
+      - name: Run ESLint
+        working-directory: services/webui
+        run: npm run lint
+
+      - name: Run TypeCheck
+        working-directory: services/webui
+        run: npm run typecheck
+
+      - name: Build WebUI
+        working-directory: services/webui
+        run: npm run build
+
   test:
     name: Run Tests
     runs-on: ubuntu-latest
-    needs: lint
+    needs: [lint, test-webui]
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
@@ -296,7 +326,6 @@ jobs:
           docker build \
             -f services/webui/Dockerfile \
             -t current-webui:ci \
-            --build-arg NODE_AUTH_TOKEN="${{ secrets.NODE_AUTH_TOKEN }}" \
             .
 
       - name: Load images into kind

.gitignore

@@ -209,3 +209,10 @@ cython_debug/
 marimo/_static/
 marimo/_lsp/
 __marimo__/
+
+# Node.js / npm
+node_modules/
+*.tgz
+# Vendored until @penguintechinc/react-libs is published to public npm (TODO: FC2)
+!services/webui/penguintechinc-react-libs-1.1.5.tgz
+.npmrc

k8s/helm/flask-backend/templates/_helpers.tpl

@@ -25,7 +25,7 @@ Create a default fully qualified app name.
 Create chart name and version as used by the chart label.
 */}}
 {{- define "flask-backend.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- printf "%s-%s" .Chart.Name .Chart.AppVersion | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
@@ -58,3 +58,14 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Return the secret name for credentials (either existing or chart-rendered)
+*/}}
+{{- define "flask-backend.secretName" -}}
+{{- if .Values.existingSecret }}
+{{- .Values.existingSecret }}
+{{- else }}
+{{- printf "%s-secret" (include "flask-backend.fullname" .) }}
+{{- end }}
+{{- end }}

k8s/helm/flask-backend/templates/deployment.yaml

@@ -34,7 +34,13 @@ spec:
       - name: flask-backend
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
+        {{- if .Values.image.digest }}
+        # Pull by digest when specified (production)
+        image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
+        {{- else }}
+        # Pull by tag (development)
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         ports:
         - name: http
@@ -53,7 +59,24 @@ spec:
           {{- toYaml . | nindent 12 }}
         {{- end }}
         env:
-        {{- toYaml .Values.env | nindent 12 }}
+        {{- range .Values.env }}
+        - name: {{ .name }}
+          {{- if .value }}
+          value: {{ .value | quote }}
+          {{- else if .valueFrom }}
+          valueFrom:
+            {{- if .valueFrom.secretKeyRef }}
+            secretKeyRef:
+              # Use existingSecret if provided; otherwise use chart-rendered secret
+              name: {{ include "flask-backend.secretName" $ }}
+              key: {{ .valueFrom.secretKeyRef.key }}
+            {{- else if .valueFrom.configMapKeyRef }}
+            configMapKeyRef:
+              name: {{ .valueFrom.configMapKeyRef.name }}
+              key: {{ .valueFrom.configMapKeyRef.key }}
+            {{- end }}
+          {{- end }}
+        {{- end }}
         {{- with .Values.volumeMounts }}
         volumeMounts:
           {{- toYaml . | nindent 12 }}

k8s/helm/flask-backend/templates/secret.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,3 +11,4 @@ data:
   {{- range $key, $value := .Values.secretData }}
   {{ $key }}: {{ $value | b64enc | quote }}
   {{- end }}
+{{- end }}

k8s/helm/flask-backend/values-prod.yaml

@@ -2,7 +2,12 @@ replicaCount: 3
 
 image:
   repository: current/flask-backend
-  tag: latest
+  tag: ""  # Must be set by CI/Renovate
+  digest: "sha256:PIN_ME"  # TODO(pin): CI to replace with actual digest
+
+# Use external secret in production (secrets managed separately from Helm)
+# Set to the name of a pre-existing secret with keys: secret-key, password-salt, db-user, db-pass, license-key
+existingSecret: "current-backend-secrets"
 
 resources:
   limits:

k8s/helm/flask-backend/values.yaml

@@ -4,6 +4,11 @@ image:
   repository: current/flask-backend
   pullPolicy: IfNotPresent
   tag: latest
+  digest: ""  # Set by CI/Renovate for prod; when set, image is pulled by digest instead of tag
+
+# Use external secret for sensitive credentials in prod
+# Set to the name of an existing secret; if empty, chart renders secretData inline
+existingSecret: ""
 
 imagePullSecrets: []
 nameOverride: ""
@@ -81,12 +86,12 @@ env:
   - name: SECRET_KEY
     valueFrom:
       secretKeyRef:
-        name: flask-backend-secret
+        name: flask-backend-secret  # Updated by deployment template to use existingSecret if set
         key: secret-key
   - name: SECURITY_PASSWORD_SALT
     valueFrom:
       secretKeyRef:
-        name: flask-backend-secret
+        name: flask-backend-secret  # Updated by deployment template to use existingSecret if set
         key: password-salt
   - name: DB_TYPE
     valueFrom:

k8s/helm/go-backend/templates/_helpers.tpl

@@ -25,7 +25,7 @@ Create a default fully qualified app name.
 Create chart name and version as used by the chart label.
 */}}
 {{- define "go-backend.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- printf "%s-%s" .Chart.Name .Chart.AppVersion | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
@@ -58,3 +58,14 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Return the secret name for credentials (either existing or chart-rendered)
+*/}}
+{{- define "go-backend.secretName" -}}
+{{- if .Values.existingSecret }}
+{{- .Values.existingSecret }}
+{{- else }}
+{{- printf "%s-secret" (include "go-backend.fullname" .) }}
+{{- end }}
+{{- end }}

k8s/helm/go-backend/templates/deployment.yaml

@@ -34,7 +34,13 @@ spec:
       - name: go-backend
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
+        {{- if .Values.image.digest }}
+        # Pull by digest when specified (production)
+        image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
+        {{- else }}
+        # Pull by tag (development)
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         ports:
         - name: http
@@ -53,7 +59,24 @@ spec:
           {{- toYaml . | nindent 12 }}
         {{- end }}
         env:
-        {{- toYaml .Values.env | nindent 12 }}
+        {{- range .Values.env }}
+        - name: {{ .name }}
+          {{- if .value }}
+          value: {{ .value | quote }}
+          {{- else if .valueFrom }}
+          valueFrom:
+            {{- if .valueFrom.secretKeyRef }}
+            secretKeyRef:
+              # Use existingSecret if provided; otherwise use chart-rendered secret
+              name: {{ include "go-backend.secretName" $ }}
+              key: {{ .valueFrom.secretKeyRef.key }}
+            {{- else if .valueFrom.configMapKeyRef }}
+            configMapKeyRef:
+              name: {{ .valueFrom.configMapKeyRef.name }}
+              key: {{ .valueFrom.configMapKeyRef.key }}
+            {{- end }}
+          {{- end }}
+        {{- end }}
         {{- with .Values.volumeMounts }}
         volumeMounts:
           {{- toYaml . | nindent 12 }}

k8s/helm/go-backend/templates/secret.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.existingSecret }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,3 +11,4 @@ data:
   {{- range $key, $value := .Values.secretData }}
   {{ $key }}: {{ $value | b64enc | quote }}
   {{- end }}
+{{- end }}

k8s/helm/go-backend/values-prod.yaml

@@ -2,7 +2,12 @@ replicaCount: 3
 
 image:
   repository: current/go-backend
-  tag: latest
+  tag: ""  # Must be set by CI/Renovate
+  digest: "sha256:PIN_ME"  # TODO(pin): CI to replace with actual digest
+
+# Use external secret in production (secrets managed separately from Helm)
+# Set to the name of a pre-existing secret with keys: db-user, db-pass, license-key
+existingSecret: "current-backend-secrets"
 
 resources:
   limits:

k8s/helm/go-backend/values.yaml

@@ -4,6 +4,11 @@ image:
   repository: current/go-backend
   pullPolicy: IfNotPresent
   tag: latest
+  digest: ""  # Set by CI/Renovate for prod; when set, image is pulled by digest instead of tag
+
+# Use external secret for sensitive credentials in prod
+# Set to the name of an existing secret with keys: db-user, db-pass, license-key
+existingSecret: ""
 
 imagePullSecrets: []
 nameOverride: ""

k8s/helm/webui/templates/deployment.yaml

@@ -33,7 +33,13 @@ spec:
       - name: webui
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
+        {{- if .Values.image.digest }}
+        # Pull by digest when specified (production)
+        image: "{{ .Values.image.repository }}@{{ .Values.image.digest }}"
+        {{- else }}
+        # Pull by tag (development)
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        {{- end }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         ports:
         - name: http

k8s/helm/webui/values-prod.yaml

@@ -2,7 +2,8 @@ replicaCount: 3
 
 image:
   repository: current/webui
-  tag: latest
+  tag: ""  # Must be set by CI/Renovate
+  digest: "sha256:PIN_ME"  # TODO(pin): CI to replace with actual digest
 
 resources:
   limits:

k8s/helm/webui/values.yaml

@@ -4,6 +4,7 @@ image:
   repository: current/webui
   pullPolicy: IfNotPresent
   tag: latest
+  digest: ""  # Set by CI/Renovate for prod; when set, image is pulled by digest instead of tag
 
 imagePullSecrets: []
 nameOverride: ""