code/cl8y-ecosystem-legal
4
0
Fork 0
Code Issues 4 Pull requests 3 Projects Releases Packages Wiki Activity

WIP: Draft: fix(#3): Harden ops security — auth /update_terms, ADMIN_TOKEN, redirect allowlist, trusted XFF #21

Closed
PlasticDigits wants to merge 0 commits from 3-security-ops-auth-update-terms-harden-admin-token-redirect-uri-allowlist-trusted-xff into main
pull from: 3-security-ops-auth-update-terms-harden-admin-token-redirect-uri-allowlist-trusted-xff
merge into: code:main
Conversation 0 Commits - Files changed -
PlasticDigits commented 2026-08-10 00:53:37 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Closes the portal/API ops security bundle from issue #3 / gap items 4–7:

  • Authenticate POST /update_terms with ADMIN_TOKEN Bearer (POST-only; auth before 1 req/s limit)
  • Fail-fast ADMIN_TOKEN (no silent dev-admin-token; ALLOW_INSECURE_DEFAULTS local opt-in)
  • Constant-time Bearer compare (subtle) shared by admin + update_terms
  • Portal redirect_uri allowlist (VITE_REDIRECT_URI_ALLOWLIST / localhost flag); SDK sanitizeRedirectUri
  • Rate-limit IP uses TCP peer by default; TRUSTED_PROXY_CIDRS enables XFF (rightmost hop)
  • GET /health for readiness (e2e/CI); docs + skills/security-ops/SKILL.md

Test plan

  • cd api && cargo test (unit + integration auth)
  • SDK + web Vitest (redirect allowlist)
  • Playwright e2e (authenticated terms sync + EVM sign) — 12 passed
  • Manual curl: unauth/bad Bearer → 401; valid Bearer → sync; /health → ok
  • Staging: confirm prod ADMIN_TOKEN set; TRUSTED_PROXY_CIDRS only if behind reverse proxy; set VITE_REDIRECT_URI_ALLOWLIST for real dapp origins

Acceptance criteria (issue #3)

  • Unauthenticated /update_terms → 401; authenticated still syncs
  • No known default admin token in production config; CI/dev documented
  • Portal refuses non-allowlisted redirect_uri
  • XFF spoofing ignored without trusted proxies; trusted mode documented + tested
  • Admin bearer comparison constant-time
  • README + .env.example + CI/e2e updated
  • EVM Playwright e2e green with authenticated terms sync

Closes #3

Closes #3

## Summary Closes the portal/API ops security bundle from issue #3 / gap items 4–7: - Authenticate `POST /update_terms` with `ADMIN_TOKEN` Bearer (POST-only; auth before 1 req/s limit) - Fail-fast `ADMIN_TOKEN` (no silent `dev-admin-token`; `ALLOW_INSECURE_DEFAULTS` local opt-in) - Constant-time Bearer compare (`subtle`) shared by admin + update_terms - Portal `redirect_uri` allowlist (`VITE_REDIRECT_URI_ALLOWLIST` / localhost flag); SDK `sanitizeRedirectUri` - Rate-limit IP uses TCP peer by default; `TRUSTED_PROXY_CIDRS` enables XFF (rightmost hop) - `GET /health` for readiness (e2e/CI); docs + `skills/security-ops/SKILL.md` ## Test plan - [x] `cd api && cargo test` (unit + integration auth) - [x] SDK + web Vitest (redirect allowlist) - [x] Playwright e2e (authenticated terms sync + EVM sign) — 12 passed - [x] Manual curl: unauth/bad Bearer → 401; valid Bearer → sync; `/health` → ok - [ ] Staging: confirm prod `ADMIN_TOKEN` set; `TRUSTED_PROXY_CIDRS` only if behind reverse proxy; set `VITE_REDIRECT_URI_ALLOWLIST` for real dapp origins ## Acceptance criteria (issue #3) - [x] Unauthenticated `/update_terms` → 401; authenticated still syncs - [x] No known default admin token in production config; CI/dev documented - [x] Portal refuses non-allowlisted `redirect_uri` - [x] XFF spoofing ignored without trusted proxies; trusted mode documented + tested - [x] Admin bearer comparison constant-time - [x] README + `.env.example` + CI/e2e updated - [x] EVM Playwright e2e green with authenticated terms sync Closes #3 Closes #3
PlasticDigits (Migrated from gitlab.com) closed this pull request 2026-08-10 00:54:03 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:implement
agent-control

  
agent:ready
agent-control

  
api

   
bot

   
bug

   
ci

   
enhancement

   
ready
agent-control

  
security

   
terra-classic

   
testing

   
ux

   
web
No labels
agent:implement
agent:ready
api
bot
bug
ci
enhancement
ready
security
terra-classic
testing
ux
web
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-ecosystem-legal!21
No description provided.