Scaffold dd0c/run: Rust agent (classifier, executor, audit) + TypeScript SaaS
- Rust agent: clap CLI, command classifier (read-only/modifying/destructive), executor with approval gates, audit log entries
- Classifier: pattern-based safety classification for shell, AWS, kubectl, terraform/tofu commands
- 6 Rust tests: read-only, destructive, modifying, empty, terraform apply, tofu destroy
- SaaS backend: Fastify server, runbook CRUD API, approval API, Slack interactive handler
- Slack integration: signature verification, block_actions for approve/reject buttons
- PostgreSQL schema with RLS: runbooks, executions, audit_entries (append-only), agents
- Dual Dockerfiles: Rust multi-stage (agent), Node multi-stage (SaaS)
- Gitea Actions CI: Rust test+clippy, Node typecheck+test
- Fly.io config for SaaS
2026-03-01 03:03:29 +00:00
|
|
|
{
|
|
|
|
|
"name": "dd0c-run",
|
|
|
|
|
"version": "0.1.0",
|
|
|
|
|
"private": true,
|
|
|
|
|
"type": "module",
|
|
|
|
|
"scripts": {
|
|
|
|
|
"dev": "tsx watch src/index.ts",
|
|
|
|
|
"build": "tsc",
|
|
|
|
|
"start": "node dist/index.js",
|
|
|
|
|
"test": "vitest run",
|
|
|
|
|
"lint": "eslint src/ tests/"
|
|
|
|
|
},
|
|
|
|
|
"dependencies": {
|
|
|
|
|
"fastify": "^4.28.0",
|
|
|
|
|
"@fastify/cors": "^9.0.0",
|
Security hardening: auth encapsulation, pool restriction, rate limiting, invites, async webhooks
Phase 1 (Security Critical):
- Auth plugin encapsulation: replaced global addHook with Fastify plugin scope
- Removed startsWith URL matching; public routes registered outside auth scope
- JWT verify now enforces algorithms: ['HS256'] (prevents algorithm confusion)
- Raw pool no longer exported from db.ts; systemQuery() + getPoolForAuth() instead
- withTenant() remains primary tenant-scoped query path
Phase 2 (Infrastructure):
- docker-compose.yml: all secrets via env var substitution (${VAR:-default})
- Per-service Postgres users (dd0c_drift, dd0c_alert, etc.) in docker-init-db.sh
- .env.example with all configurable secrets
- build-push.sh uses $REGISTRY_PASSWORD instead of hardcoded
- .gitignore excludes .env files
- @fastify/rate-limit: 100 req/min global, 5/min login, 3/min signup
- CORS_ORIGIN default changed from '*' to 'http://localhost:5173'
Phase 3 (Product):
- Team invite flow: tenant_invites table, POST /invite, GET /invites, DELETE /invites/:id
- Signup accepts optional invite_token to join existing tenant
- Async webhook ingestion (P3): LPUSH to Redis, BRPOP worker, dead-letter queue
Console:
- All 5 product modules wired: drift, alert, portal, cost, run
- PageHeader accepts children prop
- 71 modules, 70KB gzipped production build
All 6 projects compile clean (tsc --noEmit).
2026-03-02 23:53:55 +00:00
|
|
|
"@fastify/rate-limit": "^9.1.0",
|
Scaffold dd0c/run: Rust agent (classifier, executor, audit) + TypeScript SaaS
- Rust agent: clap CLI, command classifier (read-only/modifying/destructive), executor with approval gates, audit log entries
- Classifier: pattern-based safety classification for shell, AWS, kubectl, terraform/tofu commands
- 6 Rust tests: read-only, destructive, modifying, empty, terraform apply, tofu destroy
- SaaS backend: Fastify server, runbook CRUD API, approval API, Slack interactive handler
- Slack integration: signature verification, block_actions for approve/reject buttons
- PostgreSQL schema with RLS: runbooks, executions, audit_entries (append-only), agents
- Dual Dockerfiles: Rust multi-stage (agent), Node multi-stage (SaaS)
- Gitea Actions CI: Rust test+clippy, Node typecheck+test
- Fly.io config for SaaS
2026-03-01 03:03:29 +00:00
|
|
|
"@fastify/helmet": "^11.1.0",
|
|
|
|
|
"@fastify/websocket": "^10.0.0",
|
|
|
|
|
"pg": "^8.12.0",
|
|
|
|
|
"ioredis": "^5.4.0",
|
|
|
|
|
"zod": "^3.23.0",
|
|
|
|
|
"jsonwebtoken": "^9.0.2",
|
|
|
|
|
"pino": "^9.1.0",
|
|
|
|
|
"uuid": "^9.0.1",
|
|
|
|
|
"@slack/web-api": "^7.1.0",
|
|
|
|
|
"@slack/bolt": "^3.19.0"
|
|
|
|
|
},
|
|
|
|
|
"devDependencies": {
|
|
|
|
|
"typescript": "^5.5.0",
|
|
|
|
|
"tsx": "^4.15.0",
|
|
|
|
|
"vitest": "^1.6.0",
|
|
|
|
|
"@types/node": "^20.14.0",
|
|
|
|
|
"@types/pg": "^8.11.0",
|
|
|
|
|
"@types/jsonwebtoken": "^9.0.6",
|
|
|
|
|
"@types/uuid": "^9.0.8",
|
|
|
|
|
"@types/ws": "^8.5.10",
|
|
|
|
|
"eslint": "^9.5.0"
|
|
|
|
|
}
|
|
|
|
|
}
|