Mumuni (Syslog Code Agent)
3ec09470ff
P0.1 — fail-closed secrets: - config.py: no default SECRET_KEY; refuses to boot when unset, a known placeholder, or <32 chars. Generate with: openssl rand -hex 32. - docker-compose.yml: literal secrets removed; runtime env now comes from a git-ignored .env via env_file. .env.example added as template. - .gitignore already covers .env (verified). P0.2 — locked CORS: - main.py: CORS_ORIGINS must be an explicit comma-separated allow-list. '*' or an empty value refuses to boot (was: silently ['*'] with allow_credentials=True). P0.3 — role-safe registration: - services/auth.py: client-supplied 'role' is IGNORED on POST /api/auth/register; self-registered users always get the least-privilege 'CS Rep' role. Unauthenticated callers can no longer mint Admin/Jerome, Admin/Wahab, or Director accounts. Tests: - conftest.py sets test SECRET_KEY/CORS_ORIGINS before app import. - New tests/test_p0_hardening.py (8 tests): role-escalation blocked for Admin/Jerome and Admin/Wahab, duplicate-email 409, and subprocess boot-validation for placeholder/short/missing secret + wildcard CORS. - Full suite: 44 passed. Redeploy note (per research): seed_units/seed_categories are insert-only, so the Aug-26 redeploy does NOT orphan historical tickets referencing units 103E/103W/105E/105W or the legacy 34-category tree. Pending Wahab: are 103E/103W/105E/105W real apartments dropped from the Excel regeneration? Optional follow-up: floor-number backfill for already- seeded units (mapping corrected floors; existing rows keep old values). Checks per HARDENING.md acceptance: - [x] starting without a real key fails loudly (subprocess-verified) - [x] compose carries no literal secret; secrets come from .env - [x] CORS_ORIGINS explicit allow-list, '*' rejected - [x] unauthenticated register cannot mint Admin/* or Director
16 lines
708 B
Bash
16 lines
708 B
Bash
# Denya OneCare — runtime environment template (HARDENING.md P0.1/P1.1)
|
|
# Copy to .env and fill in real values. NEVER commit .env.
|
|
# Generate the secret with: openssl rand -hex 32
|
|
|
|
# ── Required ─────────────────────────────────────────────
|
|
SECRET_KEY=
|
|
DATABASE_URL=sqlite+aiosqlite:///./data/denya_onecare.db
|
|
# Explicit origin allow-list — "*" is rejected at startup (P0.2)
|
|
CORS_ORIGINS=http://localhost:8000
|
|
|
|
# ── Optional (WhatsApp; needed before wiring Meta) ───────
|
|
WHATSAPP_PHONE_NUMBER_ID=
|
|
WHATSAPP_ACCESS_TOKEN=
|
|
WHATSAPP_VERIFY_TOKEN=
|
|
META_GRAPH_BASE=https://graph.facebook.com/v18.0
|