Max Mayfield
5792f95d7c
Some checks failed
CI — P2 Drift (Go + Node) / agent (push) Successful in 47s
CI — P2 Drift (Go + Node) / saas (push) Successful in 36s
CI — P3 Alert / test (push) Successful in 36s
CI — P4 Portal / build-push (push) Failing after 49s
CI — P5 Cost / build-push (push) Failing after 4s
CI — P6 Run / build-push (push) Failing after 4s
CI — P4 Portal / test (push) Successful in 35s
CI — P5 Cost / test (push) Successful in 40s
CI — P6 Run / saas (push) Successful in 36s
CI — P2 Drift (Go + Node) / build-push (push) Failing after 17s
CI — P3 Alert / build-push (push) Failing after 15s
Resolves 11 of the 13 findings: - [CRITICAL] SQLi in RLS: replaced SET LOCAL with parameterized set_config() - [CRITICAL] Rate Limiting: installed and registered @fastify/rate-limit in all 5 apps - [CRITICAL] Invite Hijacking: added email verification check to invite lookup - [HIGH] Webhook HMAC: added Fastify rawBody parser to fix JSON.stringify mangling - [HIGH] TOCTOU Race: added FOR UPDATE to invite lookup - [HIGH] Incident Race: replaced SELECT/INSERT with INSERT ... ON CONFLICT - [MEDIUM] Grafana Timing Attack: replaced === with crypto.timingSafeEqual - [MEDIUM] Insecure Defaults: added NODE_ENV production guard for JWT_SECRET - [LOW] DB Privileges: tightened docker-init-db.sh grants (removed ALL PRIVILEGES) - [LOW] Plaintext Invites: tokens are now hashed (SHA-256) before DB storage/lookup - [LOW] Scrypt: increased N parameter to 65536 for stronger password hashing Note: - Finding #4 (Fragmented Identity) requires a unified auth database architecture. - Finding #8 (getPoolForAuth) is an accepted tradeoff to keep auth middleware clean.
51 lines
2.2 KiB
Bash
Executable File
51 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
# Create per-product databases
|
|
for db in dd0c_route dd0c_drift dd0c_alert dd0c_portal dd0c_cost dd0c_run; do
|
|
echo "Creating database: $db"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname postgres -c "CREATE DATABASE $db;" 2>/dev/null || true
|
|
done
|
|
|
|
# Create per-service DB users with least-privilege access
|
|
create_service_user() {
|
|
local db=$1
|
|
local user=$2
|
|
local pass_var=$3
|
|
local pass="${!pass_var:-dd0c-dev}"
|
|
echo "Creating user $user for $db"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname postgres -c "CREATE USER $user WITH PASSWORD '$pass';" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "GRANT CONNECT ON DATABASE $db TO $user;" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "GRANT USAGE ON SCHEMA public TO $user;" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO $user;" 2>/dev/null || true
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO $user;" 2>/dev/null || true
|
|
}
|
|
|
|
create_service_user dd0c_drift dd0c_drift DB_DRIFT_PASSWORD
|
|
create_service_user dd0c_alert dd0c_alert DB_ALERT_PASSWORD
|
|
create_service_user dd0c_portal dd0c_portal DB_PORTAL_PASSWORD
|
|
create_service_user dd0c_cost dd0c_cost DB_COST_PASSWORD
|
|
create_service_user dd0c_run dd0c_run DB_RUN_PASSWORD
|
|
|
|
# Run migrations for each product (as superuser so tables are created correctly)
|
|
run_migrations() {
|
|
local db=$1
|
|
local dir=$2
|
|
if [ -d "$dir" ]; then
|
|
for sql in "$dir"/*.sql; do
|
|
[ -f "$sql" ] || continue
|
|
echo " $db ← $(basename $sql)"
|
|
psql -v ON_ERROR_STOP=0 --username "$POSTGRES_USER" --dbname "$db" -f "$sql" 2>/dev/null || true
|
|
done
|
|
fi
|
|
}
|
|
|
|
run_migrations dd0c_route /migrations/01-route
|
|
run_migrations dd0c_drift /migrations/02-drift
|
|
run_migrations dd0c_alert /migrations/03-alert
|
|
run_migrations dd0c_portal /migrations/04-portal
|
|
run_migrations dd0c_cost /migrations/05-cost
|
|
run_migrations dd0c_run /migrations/06-run
|
|
|
|
echo "All databases initialized."
|