Security quick wins: show deletion auth, debug default off, non-root Docker, size limits

[Tim020]

What

• DELETE /api/v1/show now requires an authenticated admin (@api_authenticated @require_admin), matching show creation.
• Debug mode is opt-in: --debug defaults to off (previously on unless running as a PyInstaller bundle, including the Docker image). serve_traceback=False is set explicitly so stack traces are never returned, even with --debug. check_origin is untouched.
• Docker: the server runs as an unprivileged digiscript user; nano removed. Non-breaking upgrade: a new docker-entrypoint.sh starts as root, chown -Rs /server/conf only if the directory or digiscript.json/digiscript.sqlite is not already owned by digiscript (cheap check), then drops privileges with gosu and execs python3 main.py "$@". If the container is started with --user, the chown is skipped and the server just runs. No manual chown needed for existing volumes or bind mounts.
• Request size limits, now configurable and measured (see below): --max_body_size_mb (default 5) and --max_ws_message_size_mb (default 64), restart required. Exceeding either logs a WARNING with the limit and client IP (utils/web/size_limits.py). WebSocket closes use code 1009.
• client-v3: a 1009 close now backs off exponentially and shows one toast instead of reconnecting every second.
• README documents the Docker upgrade behaviour, --debug for development and the server options.

Measured payloads (450 pages x 40 lines, ~18,000 lines, multi-part lines)

• REST: the largest legitimate body is a single-page script PATCH (~17 KiB); other endpoints take single objects.
• Yjs full document state: ~10.7 MiB, ~14.3 MiB as a base64 JSON WebSocket frame (1000 pages: 32 MiB). Clients receive this but only send diffs; a rewrite of every line offline is ~0.9 MiB as a frame.
• Defaults: 5 MiB HTTP (~300x the largest page), 64 MiB WebSocket (>4x a whole-script insert, >70x a rewrite of every line).

Tests

• Show deletion: unauthenticated and non-admin rejected, admin allowed, current show still 400.
• Debug option default, no traceback in responses, default size limits (test_digi_server.py); HTTP body limit rejection + warning (test/utils/web/test_size_limits.py); WebSocket oversize closes and logs (test_ws_controller.py); client-v3 1009 backoff (useWebSocket.closeTooBig.test.ts).
• Docker verified locally: root-owned volume is chowned on first start and server runs as uid 1000; second start skips the chown; --user 1000:1000 works.
• pytest 1052 passed, ruff clean, Playwright chromium 225 passed, client-v3 vitest/lint/typecheck clean.

🤖 Generated with Claude Code

[github-actions]

Client Test Results

98 tests   98 ✅  0s ⏱️
 7 suites   0 💤
 1 files     0 ❌

Results for commit 61e8e36.

♻️ This comment has been updated with latest results.

[github-actions]

Client V3 Test Results

217 tests   217 ✅  0s ⏱️
 18 suites    0 💤
  1 files      0 ❌

Results for commit 61e8e36.

♻️ This comment has been updated with latest results.

[github-actions]

Python Test Results

    1 files      1 suites   49s ⏱️
1 052 tests 1 052 ✅ 0 💤 0 ❌
1 057 runs  1 057 ✅ 0 💤 0 ❌

Results for commit 61e8e36.

♻️ This comment has been updated with latest results.

[github-actions]

Playwright E2E Results (firefox)

225 tests   225 ✅  2m 14s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit 61e8e36.

♻️ This comment has been updated with latest results.

[github-actions]

Playwright E2E Results (chromium)

225 tests   225 ✅  2m 23s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit 61e8e36.

♻️ This comment has been updated with latest results.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud