Emanuel Almeida
f1756829af
HIGH-SEVERITY FIXES (Fase 2): 1. Rate Limiting (Vulnerabilidade 2.1) - express-rate-limit: 100 req/15min (prod), 1000 req/15min (dev) - Applied to all /api/* routes - Standard headers for retry-after 2. CORS Restrictions (Vulnerabilidade 2.2) - Whitelist: dashboard.descomplicar.pt, desk.descomplicar.pt - Localhost only in development - CORS blocking logs 3. Input Validation with Zod (Vulnerabilidade 2.4) - Generic validateRequest() middleware - Schemas: WordPress Monitor, server metrics, dashboard, financial - Applied to api/routes/wp-monitor.ts POST endpoint - Detailed field-level error messages 4. Backend Authentication OIDC (Vulnerabilidade 2.5 - OPTIONAL) - Enabled via OIDC_ENABLED=true - Bearer token validation on all APIs - Backward compatible (disabled by default) 5. SSH Key-Based Auth Migration (Vulnerabilidade 2.6) - Script: /media/ealmeida/Dados/Dev/ClaudeDev/migrate-ssh-keys.sh - Generates ed25519 key, copies to 6 servers - Instructions to remove passwords from .env - .env.example updated with SSH_PRIVATE_KEY_PATH 6. Improved Error Handling (Vulnerabilidade 2.5) - Unique error IDs (UUID) for tracking - Structured JSON logs in production - Stack traces blocked in production - Generic messages to client FILES CHANGED: - api/server.ts - Complete refactor with all security improvements - api/middleware/validation.ts - NEW: Zod middleware and schemas - api/routes/wp-monitor.ts - Added Zod validation on POST - .env.example - Complete security documentation - CHANGELOG.md - Full documentation of 9 fixes (3 critical + 6 high) - package.json + package-lock.json - New dependencies DEPENDENCIES ADDED: - express-rate-limit@7.x - zod@3.x - express-openid-connect@2.x AUDIT STATUS: - npm audit: 0 vulnerabilities - Hook Regra #47: PASSED PROGRESS: - Phase 1 (Critical): 3/3 ✅ COMPLETE - Phase 2 (High): 6/6 ✅ COMPLETE - Phase 3 (Medium): 0/6 - Next - Phase 4 (Low): 0/5 - Next Related: AUDIT-REPORT.md vulnerabilities 2.1, 2.2, 2.4, 2.5, 2.6 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
60 lines
1.6 KiB
JSON
Executable File
60 lines
1.6 KiB
JSON
Executable File
{
|
|
"name": "dash-descomplicar",
|
|
"private": true,
|
|
"version": "1.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "concurrently \"vite\" \"tsx watch api/server.ts\"",
|
|
"dev:api": "tsx watch api/server.ts",
|
|
"dev:ui": "vite",
|
|
"build": "tsc -b && vite build && tsc -p api/tsconfig.json",
|
|
"start": "node api/dist/server.js",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"clsx": "^2.1.1",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.6.1",
|
|
"express": "^4.19.2",
|
|
"express-openid-connect": "^2.19.4",
|
|
"express-rate-limit": "^8.2.1",
|
|
"framer-motion": "^12.30.1",
|
|
"googleapis": "^144.0.0",
|
|
"lucide-react": "^0.563.0",
|
|
"mysql2": "^3.11.5",
|
|
"oidc-client-ts": "^3.0.1",
|
|
"react": "^19.2.0",
|
|
"react-dom": "^19.2.0",
|
|
"react-oidc-context": "^3.1.1",
|
|
"react-router-dom": "^7.13.0",
|
|
"recharts": "^3.7.0",
|
|
"ssh2": "^1.17.0",
|
|
"tailwind-merge": "^3.4.0",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.1",
|
|
"@tailwindcss/postcss": "^4.1.18",
|
|
"@types/cors": "^2.8.17",
|
|
"@types/express": "^5.0.0",
|
|
"@types/node": "^24.10.10",
|
|
"@types/react": "^19.2.5",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@types/ssh2": "^1.15.5",
|
|
"@vitejs/plugin-react": "^5.1.1",
|
|
"autoprefixer": "^10.4.24",
|
|
"concurrently": "^9.1.2",
|
|
"eslint": "^9.39.1",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"eslint-plugin-react-refresh": "^0.4.24",
|
|
"globals": "^16.5.0",
|
|
"postcss": "^8.5.6",
|
|
"tailwindcss": "^4.1.18",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "~5.9.3",
|
|
"typescript-eslint": "^8.46.4",
|
|
"vite": "^7.2.4"
|
|
}
|
|
}
|