fix: P0 hardening — fail-closed SECRET_KEY, locked CORS, role-safe registration (HARDENING.md P0.1/P0.2/P0.3) #10

2026-09-03T00:00:03Z

mumuni-bot commented

2026-09-03 00:00:03 +00:00

Closes HARDENING.md P0.1, P0.2, P0.3.

Changes:

P0.1 fail-closed secrets: config.py refuses to boot with missing/placeholder/<32-char SECRET_KEY; compose reads secrets from git-ignored .env via env_file.
P0.2 locked CORS: main.py rejects */empty CORS_ORIGINS at boot; explicit allow-list only.
P0.3 role-safe registration: client-supplied role is ignored; self-registration always mints CS Rep (cannot mint Admin/Jerome, Admin/Wahab, or Director).

Tests: 44 passed (32 existing + 12 new in tests/test_p0_hardening.py), including subprocess boot-validation and role-escalation regression tests.

Legacy data: seed is insert-only — no orphaned tickets on 103E/103W/105E/105W or old category tree.

Redeploy note: openssl rand -hex 32 for real SECRET_KEY required in scottdenya's runtime .env before rebuild (new code refuses to boot with placeholder).

Closes HARDENING.md P0.1, P0.2, P0.3. **Changes:** - **P0.1 fail-closed secrets:** config.py refuses to boot with missing/placeholder/<32-char SECRET_KEY; compose reads secrets from git-ignored .env via env_file. - **P0.2 locked CORS:** main.py rejects */empty CORS_ORIGINS at boot; explicit allow-list only. - **P0.3 role-safe registration:** client-supplied role is ignored; self-registration always mints CS Rep (cannot mint Admin/Jerome, Admin/Wahab, or Director). **Tests:** 44 passed (32 existing + 12 new in tests/test_p0_hardening.py), including subprocess boot-validation and role-escalation regression tests. **Legacy data:** seed is insert-only — no orphaned tickets on 103E/103W/105E/105W or old category tree. **Redeploy note:** openssl rand -hex 32 for real SECRET_KEY required in scottdenya's runtime .env before rebuild (new code refuses to boot with placeholder).

mumuni-bot added 1 commit 2026-09-03 00:00:04 +00:00

fix: P0 hardening — fail-closed SECRET_KEY, locked CORS, role-safe registration (HARDENING.md P0.1/P0.2/P0.3) 3ec09470ff

P0.1 — fail-closed secrets:
- config.py: no default SECRET_KEY; refuses to boot when unset, a known
  placeholder, or <32 chars. Generate with: openssl rand -hex 32.
- docker-compose.yml: literal secrets removed; runtime env now comes from
  a git-ignored .env via env_file. .env.example added as template.
- .gitignore already covers .env (verified).

P0.2 — locked CORS:
- main.py: CORS_ORIGINS must be an explicit comma-separated allow-list.
  '*' or an empty value refuses to boot (was: silently ['*'] with
  allow_credentials=True).

P0.3 — role-safe registration:
- services/auth.py: client-supplied 'role' is IGNORED on POST
  /api/auth/register; self-registered users always get the
  least-privilege 'CS Rep' role. Unauthenticated callers can no longer
  mint Admin/Jerome, Admin/Wahab, or Director accounts.

Tests:
- conftest.py sets test SECRET_KEY/CORS_ORIGINS before app import.
- New tests/test_p0_hardening.py (8 tests): role-escalation blocked for
  Admin/Jerome and Admin/Wahab, duplicate-email 409, and subprocess
  boot-validation for placeholder/short/missing secret + wildcard CORS.
- Full suite: 44 passed.

Redeploy note (per research): seed_units/seed_categories are insert-only,
so the Aug-26 redeploy does NOT orphan historical tickets referencing
units 103E/103W/105E/105W or the legacy 34-category tree. Pending
Wahab: are 103E/103W/105E/105W real apartments dropped from the Excel
regeneration? Optional follow-up: floor-number backfill for already-
seeded units (mapping corrected floors; existing rows keep old values).

Checks per HARDENING.md acceptance:
- [x] starting without a real key fails loudly (subprocess-verified)
- [x] compose carries no literal secret; secrets come from .env
- [x] CORS_ORIGINS explicit allow-list, '*' rejected
- [x] unauthenticated register cannot mint Admin/* or Director

mumuni-bot merged commit 901f95e0f6 into main

2026-09-03 00:10:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/denya-onecare#10