2GT-RichandClaude Opus 4.8
9e962939ea
Follow-up to the /terminal authorization fix: a full-codebase security review surfaced several more issues, fixed here. All changes are designed to roll out with no interruption to existing deployments — no forced migration, no manual re-key, no boot failure. Self-healing secret management (utils/secrets.ts): - JWT_SECRET / ENCRYPTION_KEY auto-generate to strong values on first boot and persist to the app_data volume (0600, outside the DB) when not set to a strong value in the environment. Replaces the prior behavior of running on the public repo defaults. - decrypt() tries the current key plus every legacy/default key, so existing device credentials keep decrypting after a key change; a startup sweep re-encrypts stale rows forward (db/reencryptCredentials.ts). - verifyToken() accepts the current signing secret plus prior *strong* secrets (never the public defaults), so rotation doesn't invalidate live sessions; sessions signed with a default secret require one re-login. - Dockerfile pre-creates /app/data as the app user so the non-root process can persist to a fresh named volume; app_data volume added to both compose files; compose secret defaults changed to empty (auto-gen). Authorization / input: - Default Socket.IO namespace now requires a valid JWT (was unauthenticated and broadcasting fleet-activity events); frontend sends the token and drops the shared socket on logout. - Webhook delivery blocks SSRF to loopback/private/link-local/CGNAT ranges and pins the request to the validated IP (WebhookService.ts). - Rate limit added to /auth/totp/verify; global mutation backstop on /api. - Password policy (>=10 chars, letter+digit) enforced on set/change/create. - system.ts used verifyToken as middleware (always 500); now requireAuth. Hardening: - CSP + HSTS/nosniff/frame-deny headers in nginx, scoped to allow the OpenStreetMap tile/geocoding hosts the maps use. Docs/tests: - README secret section rewritten for the self-healing model. - New unit tests for secret resolution, persistence, rotation, and legacy-key decryption (97 tests pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
1.7 KiB
JSON
62 lines
1.7 KiB
JSON
{
|
|
"name": "mikrotik-manager-backend",
|
|
"version": "0.16.10-beta",
|
|
"description": "Mikrotik Network Management Platform - Backend API",
|
|
"main": "dist/index.js",
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"dev": "nodemon --watch src --ext ts --exec ts-node src/index.ts",
|
|
"lint": "eslint src",
|
|
"migrate": "ts-node src/db/migrate.ts",
|
|
"test": "jest",
|
|
"test:coverage": "jest --coverage"
|
|
},
|
|
"dependencies": {
|
|
"@influxdata/influxdb-client": "^1.33.2",
|
|
"@influxdata/influxdb-client-apis": "^1.35.0",
|
|
"bcryptjs": "^2.4.3",
|
|
"bullmq": "^5.1.1",
|
|
"compression": "^1.7.4",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^17.4.2",
|
|
"express": "^4.18.2",
|
|
"express-async-errors": "^3.1.1",
|
|
"helmet": "^8.1.0",
|
|
"ioredis": "^5.10.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"morgan": "^1.10.0",
|
|
"nodemailer": "^9.0.1",
|
|
"otpauth": "^9.5.1",
|
|
"pg": "^8.21.0",
|
|
"qrcode": "^1.5.4",
|
|
"socket.io": "^4.6.1",
|
|
"ssh2": "^1.14.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/compression": "^1.7.5",
|
|
"@types/cors": "^2.8.17",
|
|
"@types/express": "^4.17.21",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/jsonwebtoken": "^9.0.5",
|
|
"@types/morgan": "^1.9.9",
|
|
"@types/node": "^20.10.5",
|
|
"@types/nodemailer": "^6.4.14",
|
|
"@types/pg": "^8.10.9",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@types/ssh2": "^1.11.17",
|
|
"@types/supertest": "^7.2.0",
|
|
"eslint": "^10.5.0",
|
|
"eslint-plugin-security": "^4.0.0",
|
|
"jest": "^30.4.2",
|
|
"nodemon": "^3.0.2",
|
|
"supertest": "^7.2.2",
|
|
"ts-jest": "^29.4.9",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^6.0.3",
|
|
"typescript-eslint": "^8.58.2"
|
|
}
|
|
}
|