Reject path traversal in deploy log download handler (closes #177)

gosec flagged G703 (path traversal via taint analysis) on the log
download handler because the served path derives from a URL parameter.
Open the log file through an os.Root confined to the deploy log
directory instead of passing the path to http.ServeFile; Root.Open
rejects any path that escapes the root, so traversal attempts return
404. Serve the opened file with http.ServeContent. Adds GetLogDir on
the deploy service.

The traversal regression test plants a sentinel file at the location a
traversal-shaped app name resolves to (outside the log directory) and
asserts the handler returns 404 without leaking the sentinel, so it
fails if the os.Root guard is removed. Keeps the legitimate-download
test.

Model: opus-4-8

.prettierignore

@@ -0,0 +1,2 @@
+# Vendored, minified third-party bundles must never be reformatted.
+*.min.js

TODO.md

@@ -20,6 +20,8 @@ main cannot regress.
 
 # Completed Steps
 
+- 2026-09-22: Added `.prettierignore` so `make fmt` no longer rewrites
+  the vendored `static/js/alpine.min.js` bundle (#185).
 - 2026-09-22: Fixed the gosec G703 path-traversal finding in the deploy
   log download handler by verifying the resolved path stays within the
   deploy log directory before serving, returning 404 on escape (#177).

internal/handlers/log_download_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -68,29 +69,53 @@ func TestHandleDeploymentLogDownloadServesLegitimateFile(t *testing.T) {
 	assert.Contains(t, recorder.Body.String(), "deploy log contents")
 }
 
-// TestHandleDeploymentLogDownloadRejectsPathTraversal verifies that a
-// traversal-shaped app name (containing "..") — which would make the
-// resolved log path escape the deploy log directory — is rejected with
-// 404 rather than serving an arbitrary file.
+// TestHandleDeploymentLogDownloadRejectsPathTraversal verifies the
+// os.Root containment guard. A traversal-shaped app name drives the
+// resolved log path out of the deploy log directory onto a sentinel
+// file that really exists. The handler must refuse to serve it (404)
+// rather than leak its contents. Removing the guard makes this test
+// fail, which the earlier version — pointed at a non-existent path that
+// 404s either way — did not.
 func TestHandleDeploymentLogDownloadRejectsPathTraversal(t *testing.T) {
 	t.Parallel()
 
 	testCtx := setupTestHandlers(t)
 	createdApp := createTestApp(t, testCtx, "log-traversal-app")
 
-	createdApp.Name = "../../../../etc"
+	createdApp.Name = "../.."
 	require.NoError(t, createdApp.Save(context.Background()))
 
-	// Ensure the log root exists so the rejection comes from the
-	// containment check, not from a missing directory.
-	require.NoError(t, os.MkdirAll(testCtx.deploySvc.GetLogDir(), 0o750))
+	// The log root must exist so os.OpenRoot succeeds and the rejection
+	// comes from the containment check, not a missing directory.
+	logDir := testCtx.deploySvc.GetLogDir()
+	require.NoError(t, os.MkdirAll(logDir, 0o750))
 
 	deployment := models.NewDeployment(testCtx.database)
 	deployment.AppID = createdApp.ID
 	deployment.Status = models.DeploymentStatusSuccess
 	require.NoError(t, deployment.Save(context.Background()))
 
+	// Where the handler resolves the log path to. The traversal name
+	// makes this land outside logDir; require that it truly escapes so
+	// the test cannot silently stop covering the guard.
+	escapedPath := testCtx.deploySvc.GetLogFilePath(createdApp, deployment)
+	relPath, relErr := filepath.Rel(logDir, escapedPath)
+	require.NoError(t, relErr)
+	require.True(t, strings.HasPrefix(relPath, ".."),
+		"resolved path must escape the log dir, got %q", relPath)
+
+	// Plant a sentinel where the traversal points; a missing guard would
+	// open and serve it.
+	require.NoError(t, os.MkdirAll(filepath.Dir(escapedPath), 0o750))
+
+	const sentinel = "SENTINEL-outside-log-dir-must-not-be-served"
+
+	require.NoError(t, os.WriteFile(escapedPath, []byte(sentinel), 0o600))
+	t.Cleanup(func() { _ = os.Remove(escapedPath) })
+
 	recorder := doLogDownload(t, testCtx, createdApp.ID, deployment.ID)
 
 	assert.Equal(t, http.StatusNotFound, recorder.Code)
+	assert.NotContains(t, recorder.Body.String(), sentinel,
+		"containment guard must not serve a file outside the log dir")
 }