Launch hardening II: critical security fix, perf budget gate, status uptime, SOC 2 groundwork #4084 — ccantynz/alecrae.com

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/47

Summary

Four parallel launch-hardening tranches. Verified locally: lint ✓, typecheck ✓, test ✓ (61/61), web build ✓ (admin's only build failure is the sandbox blocking Google Fonts — green in CI).

🔴 Security (G7) — the headline

Critical auth bypass FIXED. Three paths (middleware/auth.ts, routes/auth.ts /me + /logout) decoded JWTs with atob() and trusted them without verifying the signature — anyone could forge a token for any account. Now verified via jose (signature + expiry). jwt.test.ts 6/6 confirms legit login still works.
Reflected XSS FIXED on the unsubscribe page (tracking.ts).

📈 Status uptime (G6)

New public GET /v1/uptime: real probe-derived uptime (24h/7d/90d) from a Redis-backed sample ledger; honest "unknown" when no history. Replaces the status page's previously fabricated uptime numbers. No invented data.

⚡ Bundle/perf (P1-P3, P5)

Framer Motion off the FCP path on 8 below-fold landing sections (now Server Components) via a CSS+IntersectionObserver Reveal — exact visuals/copy preserved.
three.js/R3F → optionalDependencies + named lazy chunk; CollaborativeDraftViewDynamic keeps yjs out of the initial bundle.
Real bundle-size CI gate wired into GateTest.

📋 SOC 2 groundwork (C4)

docs/compliance/soc2/: README, controls matrix (47 implemented / 14 partial / 19 missing), gap analysis, and 6 policy templates pre-filled from real controls.

⚠️ Decisions needed before public traffic (tracked in GO_LIVE_GAPS.md)

The security review flagged these but did not auto-fix — each needs a design call:

S1 🔴 SAML assertion signature never verified (SSO bypass) — needs XML-DSig
S2 🔴 OAuth state unsigned (account-linking CSRF)
S3 🟠 SSRF guard on link-preview fetch
S4 🟠 Prod fail-closed guards on sso.ts/collaborate.ts fallback secrets
S5 🟠 E2E encryption key store is an in-memory Map (encryption.ts:18) — undermines zero-knowledge claim
P4 🟡 Framer Motion in Hero → landing route is 141KB gz vs <100KB budget (needs Hero→Server Component)

Known issue

dunning.test.ts (merged earlier) is occasionally flaky under turbo concurrency due to module-level mock state. Passes reliably in isolation. Follow-up: isolate the mock.

https://claude.ai/code/session_01CQjWseikSJdamHS8W6Kygz

Generated by Claude Code