Security update#3
Merged
Merged
Conversation
…r handling, tests Implements all 16 findings from a comprehensive project audit across security, code quality, test coverage, DevOps, and documentation. Security (Critical) ─────────────────── - Add API key authentication middleware on protected endpoints (/check-limit, /consume, /api/dashboard-data). Auth is disabled when API_KEY is unset so local development remains frictionless. - Eliminate XSS in dashboard by replacing all innerHTML with safe DOM construction (createElement + textContent). User-controlled data (subject, reason, anomaly codes) can no longer execute scripts. - Add max-length constraints on userId (256), ip (64), and identifier (256) in Zod schema to prevent Redis memory exhaustion via oversized keys. - Differentiate ZodError (400 + safe validation issues) from internal errors (500 + generic message). Error.message no longer leaks Redis connection strings or stack traces to clients. - Add X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy security headers on all responses. Code Quality ──────────── - Parallelize recordOutcome() and recordDecision() with Promise.all() on the hot path, cutting ~1 Redis round-trip per request. - Add 10-second graceful shutdown timeout. The process now force-exits instead of hanging indefinitely on undrained connections. - Add Redis reconnect strategy with exponential backoff (capped at 5s, max 10 retries) instead of silently logging errors forever. Test Coverage (5 → 62 tests) ──────────────────────────── - abuse-detector.test.ts: 18 tests — every signal threshold boundary, activeBlock override, recommendedBlock cutoff, cumulative scoring - schemas.test.ts: 16 tests — all superRefine rules, max-length enforcement, cost/baseLimitPerMinute ranges, field defaults - identity.test.ts: 11 tests — all 7 resolveSubject() branches, buildFingerprint() paths including whitespace trimming - time.test.ts: 5 tests — bucketStart() with default and custom windows, boundary alignment, zero timestamp - hashing.test.ts: 4 tests — determinism, hex format, length, empty string - express-middleware.test.ts: 3 tests — allow/deny/error-forwarding paths, rate-limit header assertions DevOps & CI ─────────── - Add .dockerignore to exclude node_modules, .git, tests, docs from build context - Dockerfile: run as non-root (USER node), add HEALTHCHECK, use npm ci, copy only dashboard/public instead of entire apps/ dir - CI: add format:check, typecheck, npm audit steps; add Redis 7 service container; test on Node 20 + 22 matrix Documentation ───────────── - Add Authentication section to README with usage example - Add API_KEY to configuration table and .env.example - Update SDK example with x-api-key header - Add format:check to development commands - Add CHANGELOG.md with 1.0.0 and 1.1.0 entries - Fill package.json author field - Reference CHANGELOG from README Files: 10 new, 11 modified Tests: 8 files, 62 passing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
npm run buildnpm run lintnpm run testRisk
Describe any behavioral, performance, or compatibility risks.
Follow-up
List any intentional omissions or future work.