fix: batch remediation - resolve 12 open issues

[BillyOutlast]

Summary

Batch remediation PR that resolves 12 open issues from the Hyperplan adversarial review and SonarCloud audit.

Changes

CI/Tooling

• fix: Phase 1 — SonarQube exclusion and CodeQL autobuild (P0) #57: Updated CodeQL workflow to use autobuild for JS/TS and Rust (enables taint-tracking queries)
• fix: OSV-Scanner CI startup failure #55: Replaced OSV-Scanner reusable workflow with direct CLI usage (fixes startup_failure)
• chore: Phase 1 — Config hygiene and foundation fixes #56: Created CHANGELOG.md, PR template, and issue templates (bug/feature)

Rust Safety

• fix: Phase 2 — Rust unwrap panics in torrential (P0) #58: Removed unwrap panic in torrential/src/downloads/download.rs:107 — now returns proper error
• chore: Pin Tauri plugins from "*" to explicit versions #63: Pinned all Tauri sub-crate wildcard dependencies to concrete versions

TypeScript/Prisma

• fix: Resolve API/state type mismatch in users.ts authMecs #46: Removed @ts-expect-error in users.ts by aligning state type with API response
• chore: Migrate jsonwebtoken → jose #62: Completed jsonwebtoken → jose migration (removed jsonwebtoken dependency)
• fix: Phase 2 — TypeScript/Prisma correctness fixes (P1) #59: Documented console.error usage in client-side error handler (pino is server-side only)

Sites

• fix: sites/promo missing content-collections module #47: Added content-collections build typegen script for sites/promo
• fix: sites/docs Astro 7 incompatibility with starlight-links-validator #49: Updated starlight-links-validator to v0.25.2 (Astro 7 compatible)
• fix: sites/docs missing prettier-plugin-astro #50: Added prettier-plugin-astro to sites/docs devDependencies

Verification

• ✅ pnpm --filter drop typecheck passes
• ✅ pnpm --filter drop lint passes (warnings only, no errors)
• ✅ pnpm --filter drop test passes (157 tests)
• ✅ All Tauri sub-crate wildcards eliminated

Closes

Closes #46, #47, #49, #50, #55, #56, #57, #58, #59, #62, #63

Summary by CodeRabbit

• New Features
  • Added structured GitHub issue and pull request templates for consistent reporting.
  • Added an “Unreleased” section to the changelog.
  • Added a Sanity-based type generation command for promotional content.
• Bug Fixes
  • Improved JWT/certificate verification and tightened handling of verification failures.
  • Invalid download backend configurations now return a server error instead of risking a crash.
• Security
  • Strengthened automated vulnerability scanning in CI.
• Chores / Maintenance
  • Pinned several dependency and workflow versions for more predictable builds.
• Documentation
  • Clarified client-side error logging guidance and updated download backend error documentation.

[coderabbitai]

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "auto_review"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d6d1f13f-aac0-4df2-adf7-eede46e746a4

📥 Commits

Reviewing files that changed from the base of the PR and between d571994 and 4f52f3f.

📒 Files selected for processing (4)

• .github/ISSUE_TEMPLATE/bug.yml
• .github/workflows/osv-scanner.yml
• server/server/internal/clients/event-handler.ts
• sites/promo/package.json

🚧 Files skipped from review as they are similar to previous changes (3)

• .github/ISSUE_TEMPLATE/bug.yml
• server/server/internal/clients/event-handler.ts
• .github/workflows/osv-scanner.yml

---

📝 Walkthrough

Walkthrough

This PR adds contribution templates, updates security workflows, pins desktop dependencies, migrates JWT verification to jose, aligns users state typing with the API, updates site tooling, and prevents backend construction from panicking on missing configuration.

Changes

Repository processes and security workflows

Layer / File(s)	Summary
Contribution templates and changelog .github/ISSUE_TEMPLATE/*, .github/PULL_REQUEST_TEMPLATE.md, CHANGELOG.md	Adds structured issue and pull request forms and an Unreleased changelog section.
Security workflow execution .github/workflows/codeql.yml, .github/workflows/osv-scanner.yml	Enables Rust autobuild analysis and updates scheduled and pull-request OSV-Scanner execution.

Dependency and site tooling updates

Layer / File(s)	Summary
Desktop dependency constraints desktop/src-tauri/**/Cargo.toml	Replaces wildcard Rust dependency versions with explicit releases while preserving existing features and paths.
Site package and generation updates sites/docs/package.json, sites/promo/package.json	Updates the documentation link validator and changes site type-generation scripts.

Server authentication and state typing

Layer / File(s)	Summary
JWT verification migration server/server/internal/clients/event-handler.ts, server/package.json	Replaces jsonwebtoken verification with jose certificate-key import and caught verification failures.
Users state contract server/composables/users.ts	Removes id from authMecs state entries and removes the fetch type suppression.
Client error handler documentation server/plugins/error-handler.ts	Documents client-side console logging and server-side logging boundaries.

Backend construction error handling

Layer / File(s)	Summary
Backend configuration validation torrential/src/downloads/download.rs	Returns an internal server error and logs a warning when backend configuration is absent instead of unwrapping and panicking.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• BillyOutlast/drop#41 — Also changes OSV-Scanner workflow references.

Suggested reviewers: invalid-email-address

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Workflow, template, changelog, dependency, and other code changes are unrelated to [#46] and appear out of scope.	Move unrelated CI/docs/dependency updates to separate PRs or link the issues they address.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the batch remediation work resolving multiple issues.
Linked Issues check	✅ Passed	The users.ts change removes the suppression and aligns state typing with the API payload, matching [#46].
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-remediation-batch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

Batch remediation PR closing 11 open issues across CI workflows, Rust safety, TypeScript/Prisma alignment, and site dependencies. The changes are largely mechanical and low-risk, with most fixes being straightforward pin/type/dependency corrections.

• JWT migration (event-handler.ts): jsonwebtoken fully removed; jose.importX509 is correctly wrapped in try/catch with warn-level logging, and jwtVerify failures now log at debug before returning null—addressing the previously flagged silent discard.
• Rust safety (download.rs, Cargo.toml files): unwrap() panic replaced with ok_or_else + StatusCode::INTERNAL_SERVER_ERROR; all wildcard * dependency versions in Tauri sub-crates pinned to concrete versions.
• CI/sites (osv-scanner.yml, codeql.yml, sites/*): OSV-Scanner switched to direct CLI for scheduled scans; Starlight peer-dep mismatch resolved; promo typegen script split to correctly preserve exit status on cleanup.

Confidence Score: 4/5

Safe to merge after fixing the mutable-tag reference in the OSV-Scanner PR workflow.

The vast majority of changes are clean, mechanical fixes. The one issue is in osv-scanner.yml where scan-pr references @v2.3.8 (a mutable tag) while the sibling scan-scheduled job correctly pins to an immutable commit hash. If that tag is ever moved, the PR security gate silently runs different code—a supply-chain inconsistency that should be resolved before merge.

Files Needing Attention: .github/workflows/osv-scanner.yml — scan-pr job needs its workflow reference pinned to a commit hash to match scan-scheduled.

Important Files Changed

Filename	Overview
.github/workflows/osv-scanner.yml	Replaces startup-failing reusable workflow with direct CLI for scheduled scans (good); scan-pr still uses the reusable PR workflow which preserves diff-based comparison, but it pins to a mutable @v2.3.8 tag instead of a commit hash—inconsistent with scan-scheduled.
server/server/internal/clients/event-handler.ts	Completes jsonwebtoken → jose migration: importX509 is correctly wrapped in try/catch with warn-level logging; jwtVerify now logs failures at debug before returning null. Algorithm is explicitly enforced as ES384. Addresses previous review comments.
torrential/src/downloads/download.rs	Removes unwrap() panic on version_data.source.backend; replaced with ok_or_else() returning INTERNAL_SERVER_ERROR and a warn log. Doc comments cleaned up to remove the now-incorrect # Panics section.
desktop/src-tauri/client/Cargo.toml	All six wildcard (*) dependency versions replaced with concrete pinned versions across the sub-crate.
sites/promo/package.json	typegen now points to content-collections build; old Sanity typegen logic moved to typegen:sanity which correctly captures exit status before cleanup so the temp file is always removed.
sites/docs/package.json	Bumps @astrojs/starlight to ^0.41.0 and starlight-links-validator to ^0.25.2 (resolving the peer dep mismatch flagged in the previous review); adds prettier-plugin-astro as a devDependency.

Sequence Diagram

sequenceDiagram
    participant Client
    participant defineClientEventHandler
    participant CA as CertificateAuthority
    participant jose
    participant Handler

    Client->>defineClientEventHandler: "Authorization: JWT <clientId> <token>"
    defineClientEventHandler->>CA: fetchClientCertificate(clientId)
    CA-->>defineClientEventHandler: "certBundle | null"

    alt certBundle is null
        defineClientEventHandler-->>Client: 403 Invalid client ID
    else certBundle present
        defineClientEventHandler->>jose: importX509(certBundle.cert, ES384)
        alt importX509 throws
            jose-->>defineClientEventHandler: Error
            defineClientEventHandler->>defineClientEventHandler: logger.warn(err)
            defineClientEventHandler-->>Client: 403 Invalid client certificate
        else importX509 succeeds
            jose-->>defineClientEventHandler: publicKey
            defineClientEventHandler->>jose: jwtVerify(token, publicKey, clockTolerance 30s)
            alt jwtVerify rejects
                jose-->>defineClientEventHandler: Error
                defineClientEventHandler->>defineClientEventHandler: logger.debug(err)
                defineClientEventHandler-->>Client: 403 Invalid nonce signature
            else jwtVerify resolves
                jose-->>defineClientEventHandler: JWTPayload
                defineClientEventHandler->>Handler: handler(h3, utils)
                Handler-->>Client: Response
            end
        end
    end

Loading

_{Reviews (3): Last reviewed commit: "fix: address review feedback - SHA pinni..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/ISSUE_TEMPLATE/bug.yml:
- Around line 88-93: Update the logs textarea in the bug issue template,
identified by id “logs,” to explicitly instruct reporters to redact tokens,
passwords, private keys, and personal information before submitting logs
publicly. Preserve the existing label and shell rendering configuration.

In @.github/workflows/osv-scanner.yml:
- Around line 23-28: Update both workflow jobs to pin the actions/checkout step
and google/osv-scanner-action/osv-scanner-cli step to their complete immutable
commit SHAs instead of the mutable v4 and v2.3.8 references, preserving the
existing action versions and configuration.

In `@server/server/internal/clients/event-handler.ts`:
- Around line 47-49: Update JWT_TIME_WIGGLE and its use in the jwtVerify call so
clockTolerance is expressed in seconds, preserving the intended 30-second
tolerance rather than passing milliseconds.
- Around line 45-50: Update the certificate key import in the event-handler JWT
verification flow to use jose.importX509() for certBundle.cert instead of
jose.importSPKI(). Preserve the existing ES384 algorithm and jwtVerify
clockTolerance behavior, ensuring certificate import failures remain handled by
the current authentication failure path rather than surfacing as 500 errors.

In `@sites/docs/package.json`:
- Line 20: Update the `@astrojs/starlight` dependency in sites/docs/package.json
to version ^0.41.0 or newer before retaining the starlight-links-validator
^0.25.2 dependency.

In `@sites/promo/package.json`:
- Line 14: Update the typegen:sanity script so ./src/sanity/extract.json is
removed whether sanity typegen generate succeeds or fails. Wrap the existing
schema extraction and type generation commands with cleanup handling, preserving
the command’s original failure status while ensuring cleanup always runs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a2f7296-9a93-433c-bf76-f0b0cc7be3c2

📥 Commits

Reviewing files that changed from the base of the PR and between 4a6402c and f08d499.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (21)

• .github/ISSUE_TEMPLATE/bug.yml
• .github/ISSUE_TEMPLATE/feature.yml
• .github/PULL_REQUEST_TEMPLATE.md
• .github/workflows/codeql.yml
• .github/workflows/osv-scanner.yml
• CHANGELOG.md
• desktop/src-tauri/Cargo.toml
• desktop/src-tauri/client/Cargo.toml
• desktop/src-tauri/database/Cargo.toml
• desktop/src-tauri/download_manager/Cargo.toml
• desktop/src-tauri/games/Cargo.toml
• desktop/src-tauri/process/Cargo.toml
• desktop/src-tauri/remote/Cargo.toml
• desktop/src-tauri/tailscale/Cargo.toml
• server/composables/users.ts
• server/package.json
• server/plugins/error-handler.ts
• server/server/internal/clients/event-handler.ts
• sites/docs/package.json
• sites/promo/package.json
• torrential/src/downloads/download.rs

💤 Files with no reviewable changes (1)

• server/package.json

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE