Leon SerfatyandClaude Fable 5
304f7f30c3
Addresses the findings from the platform security audit. Verified green: all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests, and 0 high/critical production dependency vulnerabilities. Dependencies (High): - Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier) and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal and the react-router open-redirect. Remaining audit items are dev-only build tooling (esbuild/vite), not shipped at runtime. AI cost control + storage quota (new ai_usage table, migration 0002): - Per-firm monthly AI token budget enforced before each completion (429), with every completion recorded to an ai_usage ledger (lib/ai-usage.ts). - Enforce per-plan storage quota on upload (402) and maintain storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the column int→bigint so 8GB/50GB plans don't overflow. Auth (defense-in-depth): - Constant-time login: verify against a dummy argon2 hash when the account doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe). - Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification. Web: - Validate the post-login ?next= redirect to same-origin paths only (open-redirect / phishing). Deploy hardening: - docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host. - .dockerignore: keep destructive one-off scripts (seed-demo, create-admin, migrate-storage) out of the runtime image; retain the cron scripts. - seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host. Webhooks / config: - Stripe idempotency via a stripe_events ledger (skip already-processed events; record only after successful processing so a transient failure still retries); make the plan-upgraded email non-blocking. - Rate-limit account export and invoice PDF; cap invoice item arrays at 200. - Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails open on a forgotten key); don't load .env under NODE_ENV=test so the suite is hermetic. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
74 lines
3.8 KiB
Docker
74 lines
3.8 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Container image for Dokploy (Docker + Traefik). Single Node process that serves the built
|
|
# React SPA and the Fastify API on one port. Documents live in DigitalOcean Spaces and logs go
|
|
# to stdout, so the container is stateless — no volumes required.
|
|
|
|
# ─── Builder ────────────────────────────────────────────────────────────────────
|
|
FROM node:20-bookworm-slim AS builder
|
|
WORKDIR /app
|
|
|
|
# Toolchain for native modules (argon2) in case no prebuilt binary is available for this platform.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 make g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install dependencies first for better layer caching — copy every workspace manifest, then npm ci.
|
|
COPY package.json package-lock.json ./
|
|
COPY apps/api/package.json ./apps/api/
|
|
COPY apps/web/package.json ./apps/web/
|
|
COPY packages/db/package.json ./packages/db/
|
|
RUN npm ci
|
|
|
|
# Copy the rest of the source.
|
|
COPY . .
|
|
|
|
# Public config baked into the Vite bundle. Vite inlines VITE_* AT BUILD TIME, so these must be
|
|
# provided as build args (Dokploy → Build → Build-time variables), NOT as runtime env vars.
|
|
# Both are optional: an empty value simply disables that feature in the browser bundle.
|
|
ARG VITE_TURNSTILE_SITE_KEY=""
|
|
ARG VITE_SENTRY_DSN=""
|
|
ENV VITE_TURNSTILE_SITE_KEY=${VITE_TURNSTILE_SITE_KEY} \
|
|
VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
|
|
|
|
# Build the SPA → apps/web/dist. The API runs from TypeScript source via the tsx loader, so there
|
|
# is no separate API build step.
|
|
RUN npm run build
|
|
|
|
# ─── Runtime ────────────────────────────────────────────────────────────────────
|
|
FROM node:20-bookworm-slim AS runtime
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production \
|
|
PORT=8080
|
|
|
|
# ca-certificates for outbound TLS (Postgres, Spaces, Stripe, SMTP2GO, Anthropic).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd -m -u 1001 app
|
|
|
|
# Bring over the fully-installed, already-built app (node_modules incl. the compiled argon2 binary
|
|
# and workspace symlinks, apps/web/dist, TS source run by tsx, and certs/ if the CA cert is present).
|
|
#
|
|
# Attack-surface note / future hardening: the runtime executes TypeScript source directly through the
|
|
# tsx ESM loader (see server.js), so this image MUST ship tsx (a prod dependency of apps/api) plus the
|
|
# TS sources and the full node_modules from the builder. node_modules is copied whole rather than
|
|
# pruned because tsx and its transitive prod deps are resolved at runtime, and an aggressive
|
|
# `npm prune --omit=dev` here risks breaking that resolution — correctness of the running container
|
|
# takes priority. The destructive operational scripts/ dir and test files are already excluded from
|
|
# the build context (see .dockerignore), so they never reach this image.
|
|
# Future improvement: precompile the API to plain JS (tsc/esbuild) in the builder stage and run it via
|
|
# plain `node dist/server.js`. That removes the tsx runtime dependency and lets the runtime install
|
|
# prod-only deps (`npm ci --omit=dev`), further shrinking the image and its attack surface.
|
|
COPY --from=builder --chown=app:app /app /app
|
|
|
|
USER app
|
|
EXPOSE 8080
|
|
|
|
# Container liveness. Dokploy/Traefik can additionally health-check the /api/health HTTP path.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=25s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8080)+'/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
|
|
|
|
# server.js registers the tsx ESM loader, builds the Fastify app, and listens on 0.0.0.0:$PORT.
|
|
CMD ["node", "server.js"]
|