Emanuel Almeida
f1756829af
HIGH-SEVERITY FIXES (Fase 2): 1. Rate Limiting (Vulnerabilidade 2.1) - express-rate-limit: 100 req/15min (prod), 1000 req/15min (dev) - Applied to all /api/* routes - Standard headers for retry-after 2. CORS Restrictions (Vulnerabilidade 2.2) - Whitelist: dashboard.descomplicar.pt, desk.descomplicar.pt - Localhost only in development - CORS blocking logs 3. Input Validation with Zod (Vulnerabilidade 2.4) - Generic validateRequest() middleware - Schemas: WordPress Monitor, server metrics, dashboard, financial - Applied to api/routes/wp-monitor.ts POST endpoint - Detailed field-level error messages 4. Backend Authentication OIDC (Vulnerabilidade 2.5 - OPTIONAL) - Enabled via OIDC_ENABLED=true - Bearer token validation on all APIs - Backward compatible (disabled by default) 5. SSH Key-Based Auth Migration (Vulnerabilidade 2.6) - Script: /media/ealmeida/Dados/Dev/ClaudeDev/migrate-ssh-keys.sh - Generates ed25519 key, copies to 6 servers - Instructions to remove passwords from .env - .env.example updated with SSH_PRIVATE_KEY_PATH 6. Improved Error Handling (Vulnerabilidade 2.5) - Unique error IDs (UUID) for tracking - Structured JSON logs in production - Stack traces blocked in production - Generic messages to client FILES CHANGED: - api/server.ts - Complete refactor with all security improvements - api/middleware/validation.ts - NEW: Zod middleware and schemas - api/routes/wp-monitor.ts - Added Zod validation on POST - .env.example - Complete security documentation - CHANGELOG.md - Full documentation of 9 fixes (3 critical + 6 high) - package.json + package-lock.json - New dependencies DEPENDENCIES ADDED: - express-rate-limit@7.x - zod@3.x - express-openid-connect@2.x AUDIT STATUS: - npm audit: 0 vulnerabilities - Hook Regra #47: PASSED PROGRESS: - Phase 1 (Critical): 3/3 ✅ COMPLETE - Phase 2 (High): 6/6 ✅ COMPLETE - Phase 3 (Medium): 0/6 - Next - Phase 4 (Low): 0/5 - Next Related: AUDIT-REPORT.md vulnerabilities 2.1, 2.2, 2.4, 2.5, 2.6 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
101 lines
2.8 KiB
TypeScript
Executable File
101 lines
2.8 KiB
TypeScript
Executable File
/**
|
|
* Dashboard API Route
|
|
* GET /api/dashboard
|
|
* @author Descomplicar® | @link descomplicar.pt | @copyright 2026
|
|
*/
|
|
import { Router } from 'express'
|
|
import type { Request, Response } from 'express'
|
|
import * as dashboardService from '../services/dashboard.js'
|
|
import * as calendarService from '../services/calendar.js'
|
|
|
|
const router = Router()
|
|
|
|
router.get('/', async (_req: Request, res: Response) => {
|
|
try {
|
|
// Date info
|
|
const now = new Date()
|
|
const diasSemana = ['Domingo', 'Segunda-feira', 'Terça-feira', 'Quarta-feira', 'Quinta-feira', 'Sexta-feira', 'Sábado']
|
|
const meses = ['', 'Janeiro', 'Fevereiro', 'Março', 'Abril', 'Maio', 'Junho', 'Julho', 'Agosto', 'Setembro', 'Outubro', 'Novembro', 'Dezembro']
|
|
|
|
const data_formatada = `${diasSemana[now.getDay()]}, ${now.getDate()} de ${meses[now.getMonth() + 1]} de ${now.getFullYear()}`
|
|
const is_monday = now.getDay() === 1
|
|
|
|
// Parallel queries for performance
|
|
const [
|
|
urgente,
|
|
alta,
|
|
vencidas,
|
|
em_testes,
|
|
esta_semana,
|
|
monday_mood,
|
|
tickets,
|
|
contactar,
|
|
followup,
|
|
proposta,
|
|
projectos,
|
|
timesheet,
|
|
billing_360,
|
|
pipeline,
|
|
eventos_hoje,
|
|
eventos_semana
|
|
] = await Promise.all([
|
|
dashboardService.getUrgenteTasks(),
|
|
dashboardService.getAltaTasks(),
|
|
dashboardService.getVencidasTasks(),
|
|
dashboardService.getEmTestesTasks(),
|
|
dashboardService.getEstaSemana(),
|
|
dashboardService.getMondayMood(),
|
|
dashboardService.getTickets(),
|
|
dashboardService.getContactarLeads(),
|
|
dashboardService.getFollowupLeads(),
|
|
dashboardService.getPropostaLeads(),
|
|
dashboardService.getProjectos(),
|
|
dashboardService.getTimesheet(),
|
|
dashboardService.getBilling360(),
|
|
dashboardService.getPipeline(),
|
|
calendarService.getTodayEvents(),
|
|
calendarService.getWeekEvents()
|
|
])
|
|
|
|
// Calculate totals
|
|
const total_tarefas = urgente.length + alta.length
|
|
const total_leads = contactar.length + proposta.length + followup.length
|
|
|
|
// Build response matching React component format
|
|
const response = {
|
|
data_formatada,
|
|
is_monday,
|
|
eventos_hoje,
|
|
eventos_semana,
|
|
monday_mood,
|
|
urgente,
|
|
alta,
|
|
vencidas,
|
|
em_testes,
|
|
esta_semana,
|
|
tickets,
|
|
proposta,
|
|
contactar,
|
|
followup,
|
|
projectos,
|
|
billing_360,
|
|
resumo: {
|
|
tarefas: total_tarefas,
|
|
tickets: tickets.length,
|
|
projectos: projectos.length,
|
|
leads: total_leads,
|
|
horas: timesheet.horas,
|
|
horas_pct: timesheet.horas_pct,
|
|
pipeline_valor: pipeline.pipeline_valor
|
|
}
|
|
}
|
|
|
|
res.json(response)
|
|
} catch (error) {
|
|
console.error('Dashboard API error:', error)
|
|
res.status(500).json({ error: 'Internal server error' })
|
|
}
|
|
})
|
|
|
|
export default router
|