Leon SerfatyandClaude Fable 5
304f7f30c3
Addresses the findings from the platform security audit. Verified green: all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests, and 0 high/critical production dependency vulnerabilities. Dependencies (High): - Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier) and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal and the react-router open-redirect. Remaining audit items are dev-only build tooling (esbuild/vite), not shipped at runtime. AI cost control + storage quota (new ai_usage table, migration 0002): - Per-firm monthly AI token budget enforced before each completion (429), with every completion recorded to an ai_usage ledger (lib/ai-usage.ts). - Enforce per-plan storage quota on upload (402) and maintain storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the column int→bigint so 8GB/50GB plans don't overflow. Auth (defense-in-depth): - Constant-time login: verify against a dummy argon2 hash when the account doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe). - Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification. Web: - Validate the post-login ?next= redirect to same-origin paths only (open-redirect / phishing). Deploy hardening: - docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host. - .dockerignore: keep destructive one-off scripts (seed-demo, create-admin, migrate-storage) out of the runtime image; retain the cron scripts. - seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host. Webhooks / config: - Stripe idempotency via a stripe_events ledger (skip already-processed events; record only after successful processing so a transient failure still retries); make the plan-upgraded email non-blocking. - Rate-limit account export and invoice PDF; cap invoice item arrays at 200. - Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails open on a forgotten key); don't load .env under NODE_ENV=test so the suite is hermetic. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
3.0 KiB
TypeScript
65 lines
3.0 KiB
TypeScript
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import dotenv from 'dotenv';
|
|
import { z } from 'zod';
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
// Load .env from the monorepo root regardless of cwd — but NEVER under test. The test suites
|
|
// inject their own env explicitly; loading a developer's/CI's real .env here makes tests
|
|
// non-hermetic (e.g. a real TURNSTILE_SECRET_KEY would switch on CAPTCHA and break auth tests).
|
|
if (process.env.NODE_ENV !== 'test') {
|
|
dotenv.config({ path: path.resolve(__dirname, '../../../.env') });
|
|
}
|
|
|
|
const envSchema = z.object({
|
|
NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
|
|
PORT: z.coerce.number().int().positive().default(8080),
|
|
PUBLIC_URL: z.string().url().default('http://localhost:8080'),
|
|
COOKIE_DOMAIN: z.string().optional(),
|
|
SESSION_SECRET: z.string().min(32),
|
|
CSRF_SECRET: z.string().min(32),
|
|
DATABASE_URL: z.string().min(1),
|
|
DATABASE_CA_CERT_PATH: z.string().optional(),
|
|
WEB_DIST_PATH: z.string().optional(),
|
|
SUPERADMIN_EMAILS: z.string().optional().default(''),
|
|
SENTRY_DSN_API: z.string().optional().default(''),
|
|
// Object storage — DigitalOcean Spaces (S3-compatible), the platform's sole storage backend.
|
|
// Required: the API must not boot into a state where uploads silently have nowhere to go.
|
|
SPACES_ENDPOINT: z.string().url(),
|
|
SPACES_REGION: z.string().min(1),
|
|
SPACES_BUCKET: z.string().min(1),
|
|
SPACES_KEY: z.string().min(1),
|
|
SPACES_SECRET: z.string().min(1),
|
|
SPACES_PUBLIC_BASE: z.string().optional().default(''),
|
|
// Legacy local path — read only by the one-time migration script, not the running app.
|
|
STORAGE_PATH: z.string().optional().default('./storage'),
|
|
SMTP2GO_API_KEY: z.string().optional().default(''),
|
|
ANTHROPIC_API_KEY: z.string().optional().default(''),
|
|
TURNSTILE_SECRET_KEY: z.string().optional().default(''),
|
|
EMAIL_FROM: z.string().optional().default('eLegal Software <noreply@elegalsoftware.com>'),
|
|
STRIPE_SECRET_KEY: z.string().optional().default(''),
|
|
STRIPE_WEBHOOK_SECRET: z.string().optional().default(''),
|
|
STRIPE_PRICE_PRO: z.string().optional().default(''),
|
|
STRIPE_PRICE_LIFETIME: z.string().optional().default(''),
|
|
});
|
|
|
|
const parsed = envSchema.parse(process.env);
|
|
|
|
// Production guard: Turnstile bot protection fails open when TURNSTILE_SECRET_KEY is unset
|
|
// (correct for dev/test, but in production a forgotten key silently disables all CAPTCHA/bot
|
|
// protection on signup/login/password-reset/contact). Fail fast at boot rather than run exposed.
|
|
if (parsed.NODE_ENV === 'production' && !parsed.TURNSTILE_SECRET_KEY) {
|
|
throw new Error(
|
|
'TURNSTILE_SECRET_KEY is required in production: without it, bot protection fails open and CAPTCHA verification is skipped entirely. Set TURNSTILE_SECRET_KEY in the environment.',
|
|
);
|
|
}
|
|
|
|
export const env = {
|
|
...parsed,
|
|
superadminEmails: parsed.SUPERADMIN_EMAILS.split(',')
|
|
.map((s) => s.trim().toLowerCase())
|
|
.filter(Boolean),
|
|
};
|
|
|
|
export const isProd = env.NODE_ENV === 'production';
|