Max Mayfield
5792f95d7c
Some checks failed
CI — P2 Drift (Go + Node) / agent (push) Successful in 47s
CI — P2 Drift (Go + Node) / saas (push) Successful in 36s
CI — P3 Alert / test (push) Successful in 36s
CI — P4 Portal / build-push (push) Failing after 49s
CI — P5 Cost / build-push (push) Failing after 4s
CI — P6 Run / build-push (push) Failing after 4s
CI — P4 Portal / test (push) Successful in 35s
CI — P5 Cost / test (push) Successful in 40s
CI — P6 Run / saas (push) Successful in 36s
CI — P2 Drift (Go + Node) / build-push (push) Failing after 17s
CI — P3 Alert / build-push (push) Failing after 15s
Resolves 11 of the 13 findings: - [CRITICAL] SQLi in RLS: replaced SET LOCAL with parameterized set_config() - [CRITICAL] Rate Limiting: installed and registered @fastify/rate-limit in all 5 apps - [CRITICAL] Invite Hijacking: added email verification check to invite lookup - [HIGH] Webhook HMAC: added Fastify rawBody parser to fix JSON.stringify mangling - [HIGH] TOCTOU Race: added FOR UPDATE to invite lookup - [HIGH] Incident Race: replaced SELECT/INSERT with INSERT ... ON CONFLICT - [MEDIUM] Grafana Timing Attack: replaced === with crypto.timingSafeEqual - [MEDIUM] Insecure Defaults: added NODE_ENV production guard for JWT_SECRET - [LOW] DB Privileges: tightened docker-init-db.sh grants (removed ALL PRIVILEGES) - [LOW] Plaintext Invites: tokens are now hashed (SHA-256) before DB storage/lookup - [LOW] Scrypt: increased N parameter to 65536 for stronger password hashing Note: - Finding #4 (Fragmented Identity) requires a unified auth database architecture. - Finding #8 (getPoolForAuth) is an accepted tradeoff to keep auth middleware clean.
47 lines
1.8 KiB
TypeScript
47 lines
1.8 KiB
TypeScript
import Fastify from 'fastify';
|
|
import cors from '@fastify/cors';
|
|
import rateLimit from '@fastify/rate-limit';
|
|
import pino from 'pino';
|
|
import { config } from './config/index.js';
|
|
import { getPoolForAuth } from './data/db.js';
|
|
import { authHook, decorateAuth, registerAuthRoutes, registerProtectedAuthRoutes } from './auth/middleware.js';
|
|
import { registerAnomalyRoutes } from './api/anomalies.js';
|
|
import { registerBaselineRoutes } from './api/baselines.js';
|
|
import { registerGovernanceRoutes } from './api/governance.js';
|
|
import { registerIngestionRoutes } from './api/ingestion.js';
|
|
|
|
const logger = pino({ name: 'dd0c-cost', level: config.LOG_LEVEL });
|
|
|
|
const app = Fastify({ logger: true });
|
|
|
|
await app.register(cors, { origin: config.CORS_ORIGIN });
|
|
await app.register(rateLimit, { max: 100, timeWindow: '1 minute' });
|
|
|
|
const pool = getPoolForAuth();
|
|
decorateAuth(app);
|
|
|
|
// Public routes (no auth)
|
|
app.get('/health', async () => ({ status: 'ok', service: 'dd0c-cost' }));
|
|
app.get('/version', async () => ({ version: process.env.BUILD_SHA || 'dev', built: process.env.BUILD_TIME || 'unknown' }));
|
|
|
|
// Auth routes (public - login/signup)
|
|
registerAuthRoutes(app, config.JWT_SECRET, pool);
|
|
|
|
// Protected routes (auth required)
|
|
app.register(async function protectedRoutes(protectedApp) {
|
|
protectedApp.addHook('onRequest', authHook(config.JWT_SECRET, pool));
|
|
registerProtectedAuthRoutes(protectedApp, config.JWT_SECRET, pool);
|
|
registerIngestionRoutes(protectedApp);
|
|
registerAnomalyRoutes(protectedApp);
|
|
registerBaselineRoutes(protectedApp);
|
|
registerGovernanceRoutes(protectedApp);
|
|
});
|
|
|
|
try {
|
|
await app.listen({ port: config.PORT, host: '0.0.0.0' });
|
|
logger.info({ port: config.PORT }, 'dd0c/cost started');
|
|
} catch (err) {
|
|
logger.fatal(err, 'Failed to start');
|
|
process.exit(1);
|
|
}
|