Leon SerfatyandClaude Fable 5
304f7f30c3
Addresses the findings from the platform security audit. Verified green: all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests, and 0 high/critical production dependency vulnerabilities. Dependencies (High): - Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier) and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal and the react-router open-redirect. Remaining audit items are dev-only build tooling (esbuild/vite), not shipped at runtime. AI cost control + storage quota (new ai_usage table, migration 0002): - Per-firm monthly AI token budget enforced before each completion (429), with every completion recorded to an ai_usage ledger (lib/ai-usage.ts). - Enforce per-plan storage quota on upload (402) and maintain storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the column int→bigint so 8GB/50GB plans don't overflow. Auth (defense-in-depth): - Constant-time login: verify against a dummy argon2 hash when the account doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe). - Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification. Web: - Validate the post-login ?next= redirect to same-origin paths only (open-redirect / phishing). Deploy hardening: - docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host. - .dockerignore: keep destructive one-off scripts (seed-demo, create-admin, migrate-storage) out of the runtime image; retain the cron scripts. - seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host. Webhooks / config: - Stripe idempotency via a stripe_events ledger (skip already-processed events; record only after successful processing so a transient failure still retries); make the plan-upgraded email non-blocking. - Rate-limit account export and invoice PDF; cap invoice item arrays at 200. - Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails open on a forgotten key); don't load .env under NODE_ENV=test so the suite is hermetic. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
37 lines
1.5 KiB
TypeScript
37 lines
1.5 KiB
TypeScript
// Shared constants for the e2e harness. The database is a DISPOSABLE Docker container —
|
|
// these tests must never point at a real database. global-setup.ts creates/destroys the
|
|
// container; auth.e2e.test.ts refuses to run unless DATABASE_URL matches this URL exactly.
|
|
|
|
export const E2E_CONTAINER = 'elegal-e2e-pg';
|
|
export const E2E_DB_PORT = 54329;
|
|
export const E2E_DB_NAME = 'elegal_e2e';
|
|
export const E2E_DB_PASSWORD = 'e2e_throwaway_password';
|
|
|
|
export const E2E_DATABASE_URL = `postgres://postgres:${E2E_DB_PASSWORD}@127.0.0.1:${E2E_DB_PORT}/${E2E_DB_NAME}`;
|
|
|
|
export const E2E_ENV: Record<string, string> = {
|
|
NODE_ENV: 'test',
|
|
DATABASE_URL: E2E_DATABASE_URL,
|
|
DATABASE_SSL: 'disable',
|
|
DATABASE_CA_CERT_PATH: '',
|
|
PUBLIC_URL: 'http://localhost:8080',
|
|
COOKIE_DOMAIN: '',
|
|
SESSION_SECRET: 'e2e-session-secret-not-real-0123456789abcdef',
|
|
CSRF_SECRET: 'e2e-csrf-secret-not-real-0123456789abcdef',
|
|
SUPERADMIN_EMAILS: 'superadmin-e2e@example.com',
|
|
// Dummy Spaces config — env.ts requires these; no storage calls happen in auth tests.
|
|
SPACES_ENDPOINT: 'https://e2e-invalid.example.com',
|
|
SPACES_REGION: 'e2e',
|
|
SPACES_BUCKET: 'e2e-bucket',
|
|
SPACES_KEY: 'e2e-key',
|
|
SPACES_SECRET: 'e2e-secret',
|
|
// Empty → email sends are skipped, Stripe/Sentry stay inert, Turnstile CAPTCHA and AI are
|
|
// disabled so auth tests submit without a captcha token and AI endpoints report "not configured".
|
|
SMTP2GO_API_KEY: '',
|
|
STRIPE_SECRET_KEY: '',
|
|
STRIPE_WEBHOOK_SECRET: '',
|
|
SENTRY_DSN_API: '',
|
|
TURNSTILE_SECRET_KEY: '',
|
|
ANTHROPIC_API_KEY: '',
|
|
};
|