Basic Intelligence Community School
Powered by Notification System
@@ -247,6 +255,15 @@ const NotificationWizardComplete = () => {
// ================== SENDING NOTIFICATIONS ==================
const handleSendNotifications = async () => {
+ // Rate limiting check
+ if (!rateLimiter.isAllowed()) {
+ const timeToWait = Math.ceil(rateLimiter.timeUntilNextRequest() / 1000);
+ toast.error('Rate limit exceeded', {
+ description: `Please wait ${timeToWait} seconds before sending more notifications.`
+ });
+ return;
+ }
+
// Validation
if (notificationMode === 'individual' && selectedUsers.length === 0) {
toast.error('No recipients selected', {
diff --git a/src/utils/security.js b/src/utils/security.js
new file mode 100644
index 0000000..ff259e1
--- /dev/null
+++ b/src/utils/security.js
@@ -0,0 +1,227 @@
+/**
+ * Security utilities for input sanitization and validation
+ */
+
+/**
+ * Escape HTML entities to prevent XSS attacks
+ * @param {string} text - The text to escape
+ * @returns {string} - The escaped text safe for HTML rendering
+ */
+export const escapeHtml = (text) => {
+ if (typeof text !== 'string') return '';
+
+ const div = document.createElement('div');
+ div.textContent = text;
+ return div.innerHTML;
+};
+
+/**
+ * Sanitize user input for safe display in HTML
+ * @param {string} input - User input to sanitize
+ * @param {Object} options - Sanitization options
+ * @returns {string} - Sanitized HTML safe for rendering
+ */
+export const sanitizeHtml = (input, options = {}) => {
+ const {
+ allowLineBreaks = true,
+ allowLinks = false,
+ maxLength = 10000
+ } = options;
+
+ if (typeof input !== 'string') return '';
+
+ // Truncate input if too long
+ let sanitized = input.substring(0, maxLength);
+
+ // Escape HTML entities
+ sanitized = escapeHtml(sanitized);
+
+ // Optionally allow line breaks
+ if (allowLineBreaks) {
+ sanitized = sanitized.replace(/\n/g, '
');
+ }
+
+ // Optionally allow basic links (additional security risk)
+ if (allowLinks) {
+ // Simple URL regex - use with caution
+ const urlRegex = /(https?:\/\/[^\s<]+)/g;
+ sanitized = sanitized.replace(urlRegex, '
$1');
+ }
+
+ return sanitized;
+};
+
+/**
+ * Validate email format
+ * @param {string} email - Email to validate
+ * @returns {boolean} - True if valid email format
+ */
+export const isValidEmail = (email) => {
+ const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+ return emailRegex.test(email);
+};
+
+/**
+ * Validate password strength
+ * @param {string} password - Password to validate
+ * @returns {Object} - Validation result with details
+ */
+export const validatePassword = (password) => {
+ const validations = {
+ length: password.length >= 8,
+ lowercase: /[a-z]/.test(password),
+ uppercase: /[A-Z]/.test(password),
+ number: /[0-9]/.test(password),
+ special: /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password)
+ };
+
+ const strength = Object.values(validations).filter(Boolean).length;
+ const maxStrength = Object.keys(validations).length;
+
+ return {
+ isValid: strength === maxStrength && password.length >= 12,
+ strength: (strength / maxStrength) * 100,
+ validations,
+ suggestions: [
+ !validations.length && 'Use at least 12 characters',
+ !validations.lowercase && 'Include lowercase letters',
+ !validations.uppercase && 'Include uppercase letters',
+ !validations.number && 'Include numbers',
+ !validations.special && 'Include special characters'
+ ].filter(Boolean)
+ };
+};
+
+/**
+ * Generate a cryptographically secure random string
+ * @param {number} length - Length of the random string
+ * @param {string} charset - Character set to use
+ * @returns {string} - Random string
+ */
+export const generateSecureRandom = (length = 32, charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') => {
+ let result = '';
+ const values = new Uint32Array(length);
+
+ if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+ crypto.getRandomValues(values);
+ } else {
+ // Fallback for older browsers (less secure)
+ for (let i = 0; i < length; i++) {
+ values[i] = Math.random() * 0xFFFFFFFF;
+ }
+ }
+
+ for (let i = 0; i < length; i++) {
+ result += charset[values[i] % charset.length];
+ }
+
+ return result;
+};
+
+/**
+ * Check if a URL is safe (same origin or allowlisted)
+ * @param {string} url - URL to check
+ * @param {string[]} allowedDomains - Array of allowed domains
+ * @returns {boolean} - True if URL is safe
+ */
+export const isSafeUrl = (url, allowedDomains = []) => {
+ try {
+ const parsedUrl = new URL(url, window.location.origin);
+
+ // Allow same origin
+ if (parsedUrl.origin === window.location.origin) {
+ return true;
+ }
+
+ // Check allowlist
+ return allowedDomains.some(domain => {
+ try {
+ const allowedUrl = new URL(domain);
+ return parsedUrl.origin === allowedUrl.origin;
+ } catch {
+ return false;
+ }
+ });
+ } catch {
+ return false;
+ }
+};
+
+/**
+ * Create a safe redirect URL
+ * @param {string} url - Potential redirect URL
+ * @param {string} fallback - Fallback URL if unsafe
+ * @returns {string} - Safe redirect URL
+ */
+export const createSafeRedirect = (url, fallback = '/') => {
+ if (isSafeUrl(url)) {
+ return url;
+ }
+ return fallback;
+};
+
+/**
+ * Sanitize filename to prevent directory traversal
+ * @param {string} filename - Filename to sanitize
+ * @returns {string} - Sanitized filename
+ */
+export const sanitizeFilename = (filename) => {
+ if (typeof filename !== 'string') return '';
+
+ // Remove path separators and dangerous characters
+ return filename
+ .replace(/[\\/]/g, '_')
+ .replace(/\.\./g, '_')
+ .replace(/[<>:"|?*]/g, '_')
+ .substring(0, 255); // Limit length
+};
+
+/**
+ * Rate limiting utility for client-side operations
+ */
+export class RateLimiter {
+ constructor(maxRequests = 5, windowMs = 60000) {
+ this.maxRequests = maxRequests;
+ this.windowMs = windowMs;
+ this.requests = [];
+ }
+
+ isAllowed() {
+ const now = Date.now();
+ // Remove old requests outside the window
+ this.requests = this.requests.filter(time => now - time < this.windowMs);
+
+ if (this.requests.length >= this.maxRequests) {
+ return false;
+ }
+
+ this.requests.push(now);
+ return true;
+ }
+
+ reset() {
+ this.requests = [];
+ }
+
+ timeUntilNextRequest() {
+ const now = Date.now();
+ const oldestRequest = this.requests[0];
+ if (!oldestRequest || this.requests.length < this.maxRequests) {
+ return 0;
+ }
+ return Math.max(0, this.windowMs - (now - oldestRequest));
+ }
+}
+
+/**
+ * Security constants
+ */
+export const SECURITY_CONSTANTS = {
+ MAX_FILE_SIZE: 5 * 1024 * 1024, // 5MB
+ ALLOWED_FILE_TYPES: ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'],
+ MAX_LOGIN_ATTEMPTS: 5,
+ LOGIN_LOCKOUT_DURATION: 15 * 60 * 1000, // 15 minutes
+ SESSION_TIMEOUT: 30 * 60 * 1000, // 30 minutes
+ PASSWORD_MIN_LENGTH: 12,
+ TOKEN_REFRESH_THRESHOLD: 5 * 60 * 1000 // 5 minutes
+};
\ No newline at end of file
diff --git a/src/utils/validateEnv.js b/src/utils/validateEnv.js
index f9e211a..c013e18 100644
--- a/src/utils/validateEnv.js
+++ b/src/utils/validateEnv.js
@@ -2,39 +2,73 @@
* Environment variable validation service
*/
-const REQUIRED_VARS = [
+// Client-side only variables (safe to expose)
+const CLIENT_SIDE_VARS = [
'VITE_SUPABASE_URL',
'VITE_SUPABASE_ANON_KEY',
- 'VITE_SUPABASE_SERVICE_ROLE_KEY',
- 'VITE_RESEND_API_KEY'
+ 'VITE_APP_NAME',
+ 'VITE_SUPPORT_EMAIL',
+ 'VITE_BASE_PATH',
+ 'VITE_RESEND_API_KEY' // Only for local development
+];
+
+// Server-side only variables (never expose to client)
+const SERVER_SIDE_VARS = [
+ 'SUPABASE_SERVICE_ROLE_KEY',
+ 'STRIPE_SECRET',
+ 'PAYSTACK_SECRET',
+ 'JWT_SECRET',
+ 'ENCRYPTION_KEY',
+ 'SESSION_SECRET',
+ 'COOKIE_SECRET',
+ 'DATABASE_URL'
+];
+
+// Default values that indicate development configuration
+const DEVELOPMENT_DEFAULTS = [
+ 'your-supabase-anon-key',
+ 'your-resend-api-key',
+ 'your_supabase_project_url_here',
+ 'your_supabase_anon_key_here',
+ 'support@example.com',
+ 'your_email_service_key_here'
];
export const validateEnv = () => {
- const missing = REQUIRED_VARS.filter(key => !import.meta.env[key]);
+ // Only validate client-side variables in browser
+ const missing = CLIENT_SIDE_VARS.filter(key => !import.meta.env[key]);
if (missing.length > 0) {
throw new Error(`Missing required environment variables: ${missing.join(', ')}`);
}
// Validate Supabase URL format
- if (!import.meta.env.VITE_SUPABASE_URL.startsWith('https://')) {
+ if (import.meta.env.VITE_SUPABASE_URL && !import.meta.env.VITE_SUPABASE_URL.startsWith('https://')) {
throw new Error('VITE_SUPABASE_URL must be a valid HTTPS URL');
}
- // Validate keys are not default/example values
- const defaultValues = [
- 'your-supabase-anon-key',
- 'your-resend-api-key',
- 'your-supabase-service-role-key'
- ];
+ // Check for development/default values in production
+ if (import.meta.env.PROD) {
+ const devValuesFound = CLIENT_SIDE_VARS.filter(key => {
+ const value = import.meta.env[key];
+ return DEVELOPMENT_DEFAULTS.includes(value);
+ });
- REQUIRED_VARS.forEach(key => {
- const value = import.meta.env[key];
- if (defaultValues.includes(value)) {
- throw new Error(`${key} is still set to a default/example value`);
+ if (devValuesFound.length > 0) {
+ throw new Error(`Production environment still has default values: ${devValuesFound.join(', ')}`);
}
+ }
+
+ // Security: Warn if server-side variables are accidentally exposed
+ const exposedServerVars = SERVER_SIDE_VARS.filter(key => {
+ const clientKey = key.startsWith('VITE_') ? key : `VITE_${key}`;
+ return import.meta.env[clientKey];
});
+ if (exposedServerVars.length > 0) {
+ console.warn('⚠️ SECURITY WARNING: Server-side variables detected on client:', exposedServerVars);
+ }
+
return true;
};
@@ -44,4 +78,29 @@ export const getRequiredEnvVar = (key) => {
throw new Error(`Required environment variable ${key} is not set`);
}
return value;
+};
+
+// Security: Check if we're in a secure environment
+export const checkEnvironmentSecurity = () => {
+ const issues = [];
+
+ // Check for HTTP in production
+ if (import.meta.env.PROD && window.location.protocol === 'http:') {
+ issues.push('Production site should use HTTPS');
+ }
+
+ // Check for console exposure in production
+ if (import.meta.env.PROD && typeof console !== 'undefined') {
+ console.warn('⚠️ Console is available in production - ensure sensitive data is not logged');
+ }
+
+ // Check for development tools in production
+ if (import.meta.env.PROD && (window.__REACT_DEVTOOLS_GLOBAL_HOOK__ || window.__REDUX_DEVTOOLS_EXTENSION__)) {
+ issues.push('Development tools detected in production');
+ }
+
+ return {
+ isSecure: issues.length === 0,
+ issues
+ };
};
\ No newline at end of file
diff --git a/vite.config.mjs b/vite.config.mjs
index 865a893..5f9fbfa 100644
--- a/vite.config.mjs
+++ b/vite.config.mjs
@@ -22,7 +22,7 @@ export default defineConfig({
minify: 'terser',
terserOptions: {
compress: {
- drop_console: false, // Keep console logs for debugging
+ drop_console: process.env.NODE_ENV === 'production', // Remove console logs in production
drop_debugger: true,
},
},
@@ -109,11 +109,19 @@ export default defineConfig({
port: 4028,
host: "0.0.0.0",
strictPort: true,
- cors: true,
+ cors: {
+ origin: process.env.NODE_ENV === 'production'
+ ? ['https://yourdomain.com', 'https://www.yourdomain.com'] // Restrict to your domains in production
+ : true, // Allow all origins in development
+ credentials: true,
+ },
headers: {
- "Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "GET, HEAD, PUT, PATCH, POST, DELETE",
"Access-Control-Allow-Headers": "Content-Type, Authorization",
+ "X-Content-Type-Options": "nosniff",
+ "X-Frame-Options": "DENY",
+ "X-XSS-Protection": "1; mode=block",
+ "Referrer-Policy": "strict-origin-when-cross-origin",
},
},