Jason Woltje
06de72a355
fix( #338 ): Implement proper system admin role separate from workspace ownership
...
- Replace workspace ownership check with explicit SYSTEM_ADMIN_IDS env var
- System admin access is now explicit and configurable via environment
- Workspace owners no longer automatically get system admin privileges
- Add 15 unit tests verifying security separation
- Add SYSTEM_ADMIN_IDS documentation to .env.example
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 16:44:50 -06:00
Jason Woltje
7390cac2cc
fix( #338 ): Bind CSRF token to user session with HMAC
...
- Token now includes HMAC binding to session ID
- Validates session binding on verification
- Adds CSRF_SECRET configuration requirement
- Requires authentication for CSRF token endpoint
- 51 new tests covering session binding security
Security: CSRF tokens are now cryptographically tied to user sessions,
preventing token reuse across sessions and mitigating session fixation
attacks.
Token format: {random_part}:{hmac(random_part + user_id, secret)}
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-05 16:33:22 -06:00
Jason Woltje
6516843612
feat( #312 ): Implement core OpenTelemetry infrastructure
...
ci/woodpecker/push/woodpecker Pipeline failed
Complete the telemetry module with all acceptance criteria:
- Add service.version resource attribute from package.json
- Add deployment.environment resource attribute from env vars
- Add trace sampling configuration with OTEL_TRACES_SAMPLER_ARG
- Implement ParentBasedSampler for consistent distributed tracing
- Add comprehensive tests for SpanContextService (15 tests)
- Add comprehensive tests for LlmTelemetryDecorator (29 tests)
- Fix type safety issues (JSON.parse typing, template literals)
- Add security linter exception for package.json read
Test coverage: 74 tests passing, 85%+ coverage on telemetry module.
Fixes #312
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-02-04 12:52:20 -06:00
Jason Woltje
e3dd490d4d
fix( #84 ): address critical security issues in federation identity
...
Implemented comprehensive security fixes for federation instance identity:
CRITICAL SECURITY FIXES:
1. Private Key Encryption at Rest (AES-256-GCM)
- Implemented CryptoService with AES-256-GCM encryption
- Private keys encrypted before database storage
- Decrypted only when needed in-memory
- Master key stored in ENCRYPTION_KEY environment variable
- Updated schema comment to reflect actual encryption method
2. Admin Authorization on Key Regeneration
- Created AdminGuard for system-level admin operations
- Requires workspace ownership for admin privileges
- Key regeneration restricted to admin users only
- Proper authorization checks before sensitive operations
3. Private Key Never Exposed in API Responses
- Changed regenerateKeypair return type to PublicInstanceIdentity
- Service method strips private key before returning
- Added tests to verify private key exclusion
- Controller returns only public identity
ADDITIONAL SECURITY IMPROVEMENTS:
4. Audit Logging for Key Regeneration
- Created FederationAuditService
- Logs all keypair regeneration events
- Includes userId, instanceId, and timestamp
- Marked as security events for compliance
5. Input Validation for INSTANCE_URL
- Validates URL format (must be HTTP/HTTPS)
- Throws error on invalid URLs
- Prevents malformed configuration
6. Added .env.example
- Documents all required environment variables
- Includes INSTANCE_NAME, INSTANCE_URL
- Includes ENCRYPTION_KEY with generation instructions
- Clear security warnings for production use
TESTING:
- Added 11 comprehensive crypto service tests
- Updated 8 federation service tests for encryption
- Updated 5 controller tests for security verification
- Total: 24 tests passing (100% success rate)
- Verified private key never exposed in responses
- Verified encryption/decryption round-trip
- Verified admin authorization requirements
FILES CREATED:
- apps/api/src/federation/crypto.service.ts (encryption)
- apps/api/src/federation/crypto.service.spec.ts (tests)
- apps/api/src/federation/audit.service.ts (audit logging)
- apps/api/src/auth/guards/admin.guard.ts (authorization)
- apps/api/.env.example (configuration template)
FILES MODIFIED:
- apps/api/prisma/schema.prisma (updated comment)
- apps/api/src/federation/federation.service.ts (encryption integration)
- apps/api/src/federation/federation.controller.ts (admin guard, audit)
- apps/api/src/federation/federation.module.ts (new providers)
- All test files updated for new security requirements
CODE QUALITY:
- All tests passing (24/24)
- TypeScript compilation: PASS
- ESLint: PASS
- Test coverage maintained at 100%
Fixes #84
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-02-03 11:13:12 -06:00
