Leon SerfatyandClaude Fable 5
304f7f30c3
Addresses the findings from the platform security audit. Verified green: all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests, and 0 high/critical production dependency vulnerabilities. Dependencies (High): - Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier) and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal and the react-router open-redirect. Remaining audit items are dev-only build tooling (esbuild/vite), not shipped at runtime. AI cost control + storage quota (new ai_usage table, migration 0002): - Per-firm monthly AI token budget enforced before each completion (429), with every completion recorded to an ai_usage ledger (lib/ai-usage.ts). - Enforce per-plan storage quota on upload (402) and maintain storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the column int→bigint so 8GB/50GB plans don't overflow. Auth (defense-in-depth): - Constant-time login: verify against a dummy argon2 hash when the account doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe). - Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification. Web: - Validate the post-login ?next= redirect to same-origin paths only (open-redirect / phishing). Deploy hardening: - docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host. - .dockerignore: keep destructive one-off scripts (seed-demo, create-admin, migrate-storage) out of the runtime image; retain the cron scripts. - seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host. Webhooks / config: - Stripe idempotency via a stripe_events ledger (skip already-processed events; record only after successful processing so a transient failure still retries); make the plan-upgraded email non-blocking. - Rate-limit account export and invoice PDF; cap invoice item arrays at 200. - Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails open on a forgotten key); don't load .env under NODE_ENV=test so the suite is hermetic. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
50 lines
1.3 KiB
JSON
50 lines
1.3 KiB
JSON
{
|
|
"name": "@lawdesk/api",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"main": "./src/server.ts",
|
|
"scripts": {
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsc -p tsconfig.json --noEmit",
|
|
"start": "tsx src/server.ts",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:e2e": "vitest run -c vitest.e2e.config.ts",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/sdk": "^0.111.0",
|
|
"@aws-sdk/client-s3": "^3.1088.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.1088.0",
|
|
"@fastify/cookie": "^11.0.1",
|
|
"@fastify/cors": "^10.0.1",
|
|
"@fastify/helmet": "^12.0.1",
|
|
"@fastify/multipart": "^9.0.1",
|
|
"@fastify/rate-limit": "^10.2.1",
|
|
"@fastify/static": "^8.0.3",
|
|
"@lawdesk/db": "*",
|
|
"@sentry/node": "^8.45.0",
|
|
"argon2": "^0.41.1",
|
|
"dotenv": "^16.4.5",
|
|
"drizzle-orm": "^0.45.2",
|
|
"fastify": "^5.1.0",
|
|
"fastify-plugin": "^5.0.1",
|
|
"fastify-type-provider-zod": "^4.0.2",
|
|
"pdfkit": "^0.15.0",
|
|
"pg": "^8.13.1",
|
|
"pino": "^9.5.0",
|
|
"stripe": "^17.4.0",
|
|
"tsx": "^4.19.2",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.9.1",
|
|
"@types/pdfkit": "^0.13.5",
|
|
"@types/pg": "^8.11.10",
|
|
"pino-pretty": "^11.3.0",
|
|
"typescript": "^5.6.3",
|
|
"vitest": "^3.2.7"
|
|
}
|
|
}
|