feat(security): P0 lockdown - admin-managed users, registration removed, rate limit, webhook secret, headers, email normalization #11

2026-09-08T12:56:16Z

abiba-bot commented

2026-09-08 12:56:16 +00:00

Denya OneCare P0 batch per relay #746 / RA-H node #1903 (captain-approved full go). Scope: POST /api/auth/register removed; admin user-management endpoints (POST/PATCH/DELETE /api/auth/users); unified role model with unknown-role rejection at creation and JWT validation; login rate limiting (5/15min per IP+email to 429); fail-closed X-Webhook-Secret on WhatsApp webhook; mock-log 401/403 (was 500); security headers middleware (XFO DENY, nosniff, CSP, HSTS when TLS); tickets pagination verified with max page size; email normalization end-to-end incl. idempotent startup migration for legacy mixed-case rows + regression test (review-finding fix). no-mistakes validated: review fix round passed, full suite 82 passed. Deploy to CT115 + DB cleanup (probe users 19/20 + ticket 95) executes only after merge.

abiba-bot added 3 commits 2026-09-08 12:56:17 +00:00

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps 3ae1062d65

- Remove POST /api/auth/register (404); no sign-up UI; users are admin-managed
- Add admin-only POST/PATCH/DELETE /api/auth/users (forced canonical roles,
  self-lockout + reference guards)
- Unify role model in app/core/roles.py; reject unknown roles at creation and
  at login/JWT validation; startup normalizes unambiguous legacy aliases
- Login rate limiting ~5 fails/15 min per IP+email -> 429 (in-process, tunable)
- WhatsApp webhook requires X-Webhook-Secret; fail-closed when env unset;
  GET handshake uses constant-time verify token (403 on mismatch)
- GET /api/whatsapp/mock-log now requires auth
- Security headers middleware: X-Frame-Options DENY, nosniff, CSP on HTML,
  HSTS behind TLS
- Pagination: limit alias for page_size, hard cap enforced, both -> 422

no-mistakes(review): Normalize legacy emails to prevent case-based login lockout f1b68dd1b7

no-mistakes(document): Document P0 auth batch; reconcile HARDENING statuses; lint fixes e627f50f66

abiba-bot merged commit 371826c15e into main

2026-09-08 17:38:21 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/denya-onecare#11