diff --git a/docs/pages/about.mdx b/docs/pages/about.mdx index 5eb9e308..cc2dbedd 100644 --- a/docs/pages/about.mdx +++ b/docs/pages/about.mdx @@ -13,3 +13,5 @@ This site offers a more organized and structured approach to documenting the sof As of July 2024, **ACAP 2.0**, which includes new features and upgrades, is the latest version of ACAP and will be referred to simply as **"ACAP"** until further notice. + +Check out the [ACAP Changelog](/changelog) page for information about the ACAP versions developed and released from 2022 to 2024. diff --git a/docs/pages/announcements.mdx b/docs/pages/announcements.mdx index 4b072697..ec1351c5 100644 --- a/docs/pages/announcements.mdx +++ b/docs/pages/announcements.mdx @@ -5,7 +5,7 @@ import { Cards, Image } from 'nextra/components'
- + <>![Documentation theme](/assets/docs-theme.png) diff --git a/docs/pages/announcements/firebase-storage-2024.mdx b/docs/pages/announcements/firebase-storage-2024.mdx index a3371d95..f54b3497 100644 --- a/docs/pages/announcements/firebase-storage-2024.mdx +++ b/docs/pages/announcements/firebase-storage-2024.mdx @@ -134,16 +134,20 @@ _All Firebase components service usage (including those not used by ACAP) will o
-Yes. Some of the latest core deliverables implemented for ACAP in its [2.0](/changelog/#version-2-acap-20) version [**introduced security considerations**](/changelog#acap-2-security-debts) not present in the initial ([1.0](/changelog/#version-1-acap-10)) version, which followed a more rigid [security](/security) model that adhered to best practices in web development security. The security changes in **version 2.0** resulted in a **measured reduction in coverage compared to version 1.0, based on established criteria.** +Yes. Some of the latest core deliverables implemented for ACAP in its [2.0](/changelog/#version-2-acap-20) version [**introduced security considerations**](/changelog#acap-2-security-debts) not present in the initial ([1.0](/changelog/#version-1-acap-10)) version, which followed a more rigid [security model](/security) that adhered to best practices in web development security. The security changes in **version 2.0** resulted in a **measured reduction in coverage compared to version 1.0, based on established criteria.** (see table below) > With **ACAP 2.0+**, core development transitioned to a new lead programmer who made changes to improve development speed. As part of this effort, they introduced a more flexible Firestore database setup, which streamlined workflows. While these adjustments optimized workflows, they also altered security rules, introducing new considerations that require further refinements to align with [best practices](/security). > -> The lead programmer is aware of these trade-offs, and since they made these changes, they remain the best point of contact for security updates and fixes. +> The lead programmer is aware of these trade-offs, and since the lead programmer made these changes, they remain the best point of contact for security updates and fixes. > > For more details on these changes, refer to this GitHub [issue](https://github.com/amia-cis/acap-v2/issues/57) in the parent **acap-v2** repository, which provides a summary of the lead programmer's upcoming fixes and improvements. +##### ACAP Security Criteria + +This table shows the overall security criteria ensured and accounted for by ACAP's best practices in its recommended [security guidelines](/security). + | Criteria | Purpose | ACAP [1.0](/changelog/#version-1-acap-10) | ACAP [2.0](/changelog/#version-2-acap-20) | | --- | --- | :---: | :---: | | User authentication | Authorized, allowed, and predictable operations access to resources | ✅ | ✅ | diff --git a/docs/pages/security.mdx b/docs/pages/security.mdx index ac4337cd..2323bd65 100644 --- a/docs/pages/security.mdx +++ b/docs/pages/security.mdx @@ -47,7 +47,7 @@ ACAP's [Firestore Security Rules](https://firebase.google.com/docs/firestore/sec ``` -[ACAP 2.0](/changelog/#version-2-acap-20) allowed users to edit crop recommendations, a new feature introduced in **version 2.0** through weak Firestore Security Rules, making it vulnerable to **Cross-Site Scripting (XSS)**. This lets **unauthorized clients** (e.g., Postman) modify WYSIWYG-form data without protection if accessed from the [Firestore REST APIs](https://cloud.google.com/firestore/docs/reference/rest/). Allowing these in the Firestore Security Rules contradicts the best practices outlined in the [Database](#database) section. +[ACAP 2.0](/changelog/#version-2-acap-20) allowed users to edit crop recommendations, a new feature introduced in **version 2.0** through weak Firestore Security Rules, making it vulnerable to **Cross-Site Scripting (XSS)**. This lets **unauthorized clients** (e.g., Postman) modify WYSIWYG-form data without protection if accessed from the [Firestore REST APIs](https://cloud.google.com/firestore/docs/reference/rest/). Allowing these in the Firestore Security Rules contradicts the best practices outlined in the [Database](#database) section, which advocates for data mutation with thorough data validation in the **Node backend**. For more details, refer to GitHub Issues in the parent **acap-v2 repository** ([[1]](https://github.com/amia-cis/acap-v2/issues/34), [[2]](https://github.com/amia-cis/acap-v2/issues/57)) or check the **Firebase Storage Announcements 2024** under the [Are there security concerns I should be aware of?](/announcements/firebase-storage-2024#security-considerations) section for information and reference. @@ -91,6 +91,14 @@ ACAP's [Firebase Storage Security Rules](https://firebase.google.com/docs/storag These Security requirements carry over and apply to **ACAP 2.0**, even if the Software documents were written for **ACAP 1.0**. Since no new Software documents are available for the updates made in ACAP 2.0, you may consult the new lead programmer responsible for implementing ACAP 2.0 about detailed upgrades specifics made to the system. +## Node Package Libraries (NPM) + +ACAP, a web application built with Firebase, Express, React/Next.js, and Node.js, relies on open-source development libraries from the **Node Package Manager (NPM)** for its **client** and **server** applications. + +Since ACAP's initial development in 2022, many of these libraries may have become outdated as newer versions are released. + +Developers maintaining ACAP are encouraged to monitor and update these dependencies as needed to benefit from performance improvements, security patches, and new features, possibly requiring using newer Node versions. + ## Related - [Server Notes](/directories/server)