Emanuel Almeida
f1756829af
HIGH-SEVERITY FIXES (Fase 2): 1. Rate Limiting (Vulnerabilidade 2.1) - express-rate-limit: 100 req/15min (prod), 1000 req/15min (dev) - Applied to all /api/* routes - Standard headers for retry-after 2. CORS Restrictions (Vulnerabilidade 2.2) - Whitelist: dashboard.descomplicar.pt, desk.descomplicar.pt - Localhost only in development - CORS blocking logs 3. Input Validation with Zod (Vulnerabilidade 2.4) - Generic validateRequest() middleware - Schemas: WordPress Monitor, server metrics, dashboard, financial - Applied to api/routes/wp-monitor.ts POST endpoint - Detailed field-level error messages 4. Backend Authentication OIDC (Vulnerabilidade 2.5 - OPTIONAL) - Enabled via OIDC_ENABLED=true - Bearer token validation on all APIs - Backward compatible (disabled by default) 5. SSH Key-Based Auth Migration (Vulnerabilidade 2.6) - Script: /media/ealmeida/Dados/Dev/ClaudeDev/migrate-ssh-keys.sh - Generates ed25519 key, copies to 6 servers - Instructions to remove passwords from .env - .env.example updated with SSH_PRIVATE_KEY_PATH 6. Improved Error Handling (Vulnerabilidade 2.5) - Unique error IDs (UUID) for tracking - Structured JSON logs in production - Stack traces blocked in production - Generic messages to client FILES CHANGED: - api/server.ts - Complete refactor with all security improvements - api/middleware/validation.ts - NEW: Zod middleware and schemas - api/routes/wp-monitor.ts - Added Zod validation on POST - .env.example - Complete security documentation - CHANGELOG.md - Full documentation of 9 fixes (3 critical + 6 high) - package.json + package-lock.json - New dependencies DEPENDENCIES ADDED: - express-rate-limit@7.x - zod@3.x - express-openid-connect@2.x AUDIT STATUS: - npm audit: 0 vulnerabilities - Hook Regra #47: PASSED PROGRESS: - Phase 1 (Critical): 3/3 ✅ COMPLETE - Phase 2 (High): 6/6 ✅ COMPLETE - Phase 3 (Medium): 0/6 - Next - Phase 4 (Low): 0/5 - Next Related: AUDIT-REPORT.md vulnerabilities 2.1, 2.2, 2.4, 2.5, 2.6 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
64 lines
2.0 KiB
TypeScript
Executable File
64 lines
2.0 KiB
TypeScript
Executable File
#!/usr/bin/env npx tsx
|
|
/**
|
|
* Hetzner Metrics Collector - Standalone Script
|
|
* Run via cron for periodic metrics collection
|
|
*
|
|
* Usage:
|
|
* npx tsx api/scripts/hetzner-collector.ts
|
|
* npx tsx api/scripts/hetzner-collector.ts --sync # Sync + Collect
|
|
* npx tsx api/scripts/hetzner-collector.ts --cleanup # Collect + Cleanup
|
|
* npx tsx api/scripts/hetzner-collector.ts --all # Sync + Collect + Cleanup
|
|
*
|
|
* Cron example (every 5 minutes):
|
|
* 0,5,10,15,20,25,30,35,40,45,50,55 * * * * cd /path/to/DashDescomplicar && npx tsx api/scripts/hetzner-collector.ts
|
|
*
|
|
* @author Descomplicar | @link descomplicar.pt | @copyright 2026
|
|
*/
|
|
import 'dotenv/config'
|
|
import {
|
|
syncServers,
|
|
collectAllMetrics,
|
|
cleanupOldMetrics
|
|
} from '../services/hetzner.js'
|
|
|
|
const args = process.argv.slice(2)
|
|
const doSync = args.includes('--sync') || args.includes('--all')
|
|
const doCleanup = args.includes('--cleanup') || args.includes('--all')
|
|
|
|
async function main() {
|
|
const timestamp = new Date().toISOString()
|
|
console.log(`[${timestamp}] Hetzner Collector Started`)
|
|
console.log('='.repeat(50))
|
|
|
|
try {
|
|
// 1. Sync servers (optional)
|
|
if (doSync) {
|
|
console.log('[SYNC] Sincronizando lista de servidores...')
|
|
const synced = await syncServers()
|
|
console.log(`[SYNC] ✅ ${synced} servidores sincronizados`)
|
|
}
|
|
|
|
// 2. Collect metrics (always)
|
|
console.log('[COLLECT] Recolhendo métricas...')
|
|
const result = await collectAllMetrics()
|
|
console.log(`[COLLECT] ✅ ${result.success} OK, ${result.failed} falharam`)
|
|
|
|
// 3. Cleanup old data (optional)
|
|
if (doCleanup) {
|
|
console.log('[CLEANUP] Limpando métricas antigas (>7 dias)...')
|
|
const deleted = await cleanupOldMetrics(7)
|
|
console.log(`[CLEANUP] ✅ ${deleted} entradas eliminadas`)
|
|
}
|
|
|
|
console.log('='.repeat(50))
|
|
console.log(`[${new Date().toISOString()}] Collector Finished Successfully`)
|
|
process.exit(0)
|
|
|
|
} catch (error) {
|
|
console.error('[ERROR] Collector failed:', error)
|
|
process.exit(1)
|
|
}
|
|
}
|
|
|
|
main()
|