Files
stack/docs
Jason Woltje 0a527d2a4e
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
fix(#279): Validate orchestrator URL configuration (SSRF risk)
Implemented comprehensive URL validation to prevent SSRF attacks:
- Created URL validator utility with protocol whitelist (http/https only)
- Blocked access to private IP ranges (10.x, 192.168.x, 172.16-31.x)
- Blocked loopback addresses (127.x, localhost, 0.0.0.0)
- Blocked link-local addresses (169.254.x)
- Blocked IPv6 localhost (::1, ::)
- Allow localhost in development/test environments only
- Added structured audit logging for invalid URL attempts
- Comprehensive test coverage (37 tests for URL validator)

Security Impact:
- Prevents attackers from redirecting agent spawn requests to internal services
- Blocks data exfiltration via malicious orchestrator URL
- All agent operations now validated against SSRF

Files changed:
- apps/api/src/federation/utils/url-validator.ts (new)
- apps/api/src/federation/utils/url-validator.spec.ts (new)
- apps/api/src/federation/federation-agent.service.ts (validation integration)
- apps/api/src/federation/federation-agent.service.spec.ts (test updates)
- apps/api/src/federation/audit.service.ts (audit logging)
- apps/api/src/federation/federation.module.ts (service exports)

Fixes #279

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-03 20:47:41 -06:00
..

Mosaic Stack Documentation

Complete documentation for Mosaic Stack, organized in Bookstack-compatible shelf/book/chapter/page structure.

📚 Books

1. Getting Started

Essential guides to get Mosaic Stack installed and configured.

2. Development

Developer guides for contributing to Mosaic Stack.

3. Architecture

Technical architecture and design decisions.

4. API Reference

Complete API endpoint documentation.

📝 Scratchpads

Development notes and implementation details for specific issues:

For New Users

  1. Quick Start
  2. Local Setup
  3. Environment Configuration

For Developers

  1. Branching Strategy
  2. Testing Requirements
  3. Type Sharing

For Architects

  1. PDA-Friendly Design
  2. Authentication Flow (to be added)
  3. System Overview (to be added)

For API Consumers

  1. API Conventions
  2. Authentication Endpoints

📋 Documentation Standards

File Organization

docs/
├── {N}-{book-name}/              # Book (numbered)
│   ├── README.md                 # Book overview
│   ├── {N}-{chapter-name}/       # Chapter (numbered)
│   │   ├── {N}-{page-name}.md    # Page (numbered)
│   │   └── ...
│   └── ...
└── scratchpads/                  # Development notes (unnumbered)

Numbering Convention

  • Books: 1-getting-started, 2-development, 3-architecture, 4-api
  • Chapters: 1-quick-start, 2-installation, 3-configuration
  • Pages: 1-overview.md, 2-local-setup.md, 3-docker-setup.md

Numbers maintain order in file systems and Bookstack.

Writing Style

  • Concise — No unnecessary verbosity
  • Action-oriented — Use imperative mood ("Run the command", not "You should run")
  • Example-heavy — Show, don't just tell
  • Code blocks — Always include working examples
  • Links — Cross-reference related topics
  • PDA-friendly — Follow design principles

Code Examples

Always include:

  • Language identifier for syntax highlighting
  • Complete, runnable examples
  • Expected output when relevant
  • Error cases and troubleshooting

🛠️ Contributing to Docs

Adding New Pages

  1. Identify the appropriate book/chapter
  2. Create numbered markdown file
  3. Add to chapter's parent README
  4. Link from related pages
  5. Test all links and code examples

Updating Existing Pages

  1. Keep formatting consistent
  2. Update last-modified date
  3. Test all examples
  4. Check cross-references

Creating New Books

  1. Number sequentially (5-{new-book})
  2. Create README.md overview
  3. Add chapter directories
  4. Update this index

📊 Documentation Status

Book Completion
Getting Started 🟢 Complete
Development 🟡 Partial
Architecture 🟡 Partial
API Reference 🟡 Partial

Legend:

  • 🟢 Complete
  • 🟡 Partial
  • 🔵 Planned
  • Not started

🔗 External Resources

📧 Support


Last Updated: 2026-01-28 Version: 0.0.1 (Pre-MVP)