6 Commits

Author	SHA1	Message	Date
Max	ffe2b63877	feat(drift): add noisy neighbor protection, RBAC forgery prevention, remediation locks ... - Fair-share tenant processing: weighted round-robin, per-tenant queue depth tracking - API key → stack ownership validation on all ingestion routes - Enhanced replay attack prevention (timestamp + nonce + report_id dedup) - Remediation lock: Redis-based mutex prevents scan/remediation race conditions - Reports during active remediation tagged and excluded from scoring - 006_noisy_neighbor.sql migration	2026-03-03 13:42:34 +00:00
Max	f133ca8ff6	feat(drift): add normalizer, chunk assembly, daily digest, Slack interactions, analytics ... - Canonical schema normalizer: cross-provider resource type mapping - Chunked report reassembly via Redis (10min TTL, out-of-order safe) - Daily drift digest worker with Slack Block Kit summary - Slack interactive handler: remediate + accept drift actions - Analytics API: drift trends and health summary - 005_drift_features.sql migration (remediations, acceptances, indexes)	2026-03-03 06:56:44 +00:00
Protocol dd0c Agent	76715d169e	fix: RLS auth bypass for signup/login flows ... - Add set_config('app.tenant_id') before user INSERT in signup tx - Add 004_auth_rls_fix.sql: permissive SELECT on users/api_keys for auth lookups, INSERT on users with tenant context check - db-setup now runs migrations on every up (idempotent)	2026-03-03 05:38:25 +00:00
Max Mayfield	eb953cdea5	Security hardening: auth encapsulation, pool restriction, rate limiting, invites, async webhooks ... Phase 1 (Security Critical): - Auth plugin encapsulation: replaced global addHook with Fastify plugin scope - Removed startsWith URL matching; public routes registered outside auth scope - JWT verify now enforces algorithms: ['HS256'] (prevents algorithm confusion) - Raw pool no longer exported from db.ts; systemQuery() + getPoolForAuth() instead - withTenant() remains primary tenant-scoped query path Phase 2 (Infrastructure): - docker-compose.yml: all secrets via env var substitution (${VAR:-default}) - Per-service Postgres users (dd0c_drift, dd0c_alert, etc.) in docker-init-db.sh - .env.example with all configurable secrets - build-push.sh uses $REGISTRY_PASSWORD instead of hardcoded - .gitignore excludes .env files - @fastify/rate-limit: 100 req/min global, 5/min login, 3/min signup - CORS_ORIGIN default changed from '*' to 'http://localhost:5173' Phase 3 (Product): - Team invite flow: tenant_invites table, POST /invite, GET /invites, DELETE /invites/:id - Signup accepts optional invite_token to join existing tenant - Async webhook ingestion (P3): LPUSH to Redis, BRPOP worker, dead-letter queue Console: - All 5 product modules wired: drift, alert, portal, cost, run - PageHeader accepts children prop - 71 modules, 70KB gzipped production build All 6 projects compile clean (tsc --noEmit).	2026-03-02 23:53:55 +00:00
Max Mayfield	b9c480c06b	Copy shared auth migration (002_auth.sql) to P1 route and P2 drift	2026-03-01 06:12:36 +00:00
Max Mayfield	e67cef518e	Scaffold dd0c/drift SaaS backend: Fastify, RLS, ingestion, dashboard API ... - Fastify server with Zod validation, pino logging, CORS/helmet - Drift report ingestion endpoint with nonce replay prevention - Dashboard API: stacks list, drift history, report detail, summary stats - PostgreSQL schema with RLS: tenants, users, agent_keys, drift_reports, remediation_actions - withTenant() helper for safe connection pool tenant context management - Config via Zod-validated env vars	2026-03-01 02:45:33 +00:00