Jason Woltje
f53f310061
Replaced broad try-catch blocks with targeted error handling that only catches expected business logic errors (CommandProcessingError subclasses). System errors (OOM, DB failures, network issues) now propagate correctly for proper debugging and monitoring. Changes: - Created CommandProcessingError hierarchy for business logic errors - UnknownCommandTypeError for invalid command types - AgentCommandError for orchestrator communication failures - InvalidCommandPayloadError for payload validation - Updated command.service.ts to only catch CommandProcessingError - Updated federation-agent.service.ts to throw appropriate error types - Added comprehensive tests for both business and system error scenarios - System errors now include structured logging with context - All 286 federation tests pass Impact: - Debugging is now possible for system failures - System errors properly trigger monitoring/alerting - Business logic errors handled gracefully with error responses - No more masking of critical issues like OOM or DB failures Fixes #281 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Issue #282: Add HTTP request timeouts (DoS risk)
Objective
Add 10-second timeout to all HTTP requests to prevent DoS attacks via slowloris and resource exhaustion.
Security Impact
- DoS via slowloris attack (attacker sends data very slowly)
- Resource exhaustion from hung connections
- API becomes unresponsive
- P0 security vulnerability
Current Status
✅ HttpModule is already configured with 10-second timeout in federation.module.ts:29
- All HTTP requests via HttpService automatically use this timeout
- No code changes needed in command.service.ts, query.service.ts, or event.service.ts
Approach
- Verify timeout is properly configured at module level
- Add explicit test to verify timeout enforcement
- Add tests for timeout scenarios
- Document timeout configuration
- Verify all federation HTTP requests use the configured HttpService
Implementation Plan
- Review federation.module.ts timeout configuration
- Add test for HTTP timeout enforcement
- Add test for timeout error handling
- Verify query.service.ts uses timeout
- Verify event.service.ts uses timeout
- Verify command.service.ts uses timeout
- Run quality gates (lint, typecheck, build, tests)
Testing
- Test HTTP request times out after 10 seconds
- Test timeout errors are handled gracefully
- Test all federation services respect timeout
- Maintain 85%+ coverage
Notes
- Timeout already configured via HttpModule.register({ timeout: 10000 })
- Need to add explicit tests to verify timeout works
- This is a verification and testing issue, not an implementation issue