3 Commits

Author	SHA1	Message	Date
Max Mayfield	eb953cdea5	Security hardening: auth encapsulation, pool restriction, rate limiting, invites, async webhooks ... Phase 1 (Security Critical): - Auth plugin encapsulation: replaced global addHook with Fastify plugin scope - Removed startsWith URL matching; public routes registered outside auth scope - JWT verify now enforces algorithms: ['HS256'] (prevents algorithm confusion) - Raw pool no longer exported from db.ts; systemQuery() + getPoolForAuth() instead - withTenant() remains primary tenant-scoped query path Phase 2 (Infrastructure): - docker-compose.yml: all secrets via env var substitution (${VAR:-default}) - Per-service Postgres users (dd0c_drift, dd0c_alert, etc.) in docker-init-db.sh - .env.example with all configurable secrets - build-push.sh uses $REGISTRY_PASSWORD instead of hardcoded - .gitignore excludes .env files - @fastify/rate-limit: 100 req/min global, 5/min login, 3/min signup - CORS_ORIGIN default changed from '*' to 'http://localhost:5173' Phase 3 (Product): - Team invite flow: tenant_invites table, POST /invite, GET /invites, DELETE /invites/:id - Signup accepts optional invite_token to join existing tenant - Async webhook ingestion (P3): LPUSH to Redis, BRPOP worker, dead-letter queue Console: - All 5 product modules wired: drift, alert, portal, cost, run - PageHeader accepts children prop - 71 modules, 70KB gzipped production build All 6 projects compile clean (tsc --noEmit).	2026-03-02 23:53:55 +00:00
Max Mayfield	64213c39e9	Add P1/P2 to docker-compose, mount all 6 migration dirs, add P2 agent Dockerfile ... - route-api (3001), route-proxy (8080), route-worker as separate services - drift SaaS (3002) added - All 6 product migrations mounted into postgres init - docker-init-db.sh creates all 6 databases	2026-03-01 06:11:20 +00:00
Max Mayfield	b351f2f46b	Implement P2 Resend email + PagerDuty Events v2 + Slack retry backoff ... - Resend: HTML email with drift summary table and CTA button - PagerDuty: Events API v2 with dedup_key, severity mapping, custom_details - Slack: setTimeout retry on 429 rate limit instead of dropping	2026-03-01 05:51:28 +00:00