mporwoll/cms.c2sgmbh
1
0
Fork 0
mirror of https://github.com/complexcaresolutions/cms.c2sgmbh.git synced 2026-03-17 16:14:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
244 commits 17 branches 0 tags 17 MiB
Commit graph

7 commits

Author SHA1 Message Date
Martin Porwoll
e3987e50dc feat: security hardening, monitoring improvements, and API guards 
- Hardened cron endpoints with coordination and auth improvements
- Added API guards and input validation layer
- Security observability and secrets health checks
- Monitoring types and service improvements
- PDF URL validation and newsletter unsubscribe security
- Unit tests for security-critical paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-17 11:42:56 +00:00
Martin Porwoll
4386ac5d8d fix: resolve global typecheck errors 2026-02-17 08:57:32 +00:00
Martin Porwoll
2fae62eaf3 fix: apply CSRF protection and centralize rate limiting 
- Migrate /api/posts from legacy checkRateLimit to central searchLimiter
- Add IP blocklist check and rateLimitHeaders to /api/posts
- Apply CSRF validation to /api/send-email (POST)
- Apply CSRF validation to /api/users/login (POST)
- Apply CSRF validation to /api/auth/login (POST)

CSRF protection uses the Double Submit Cookie pattern which:
- Skips safe methods (GET, HEAD, OPTIONS)
- Allows server-to-server requests with Authorization header
- Validates Origin header for browser requests
- Requires matching tokens in header and cookie for browser POSTs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 23:47:07 +00:00
Martin Porwoll
cb2e903db5 fix: integrate security modules into actual endpoints 
Rate Limiting Integration:
- Add authLimiter (5 attempts/15min) to both login routes for brute-force protection
- Migrate search endpoints from local checkRateLimit to central searchLimiter
- Add IP blocklist checks to auth and search endpoints

Data Masking Integration:
- Integrate maskObject/maskString from security module into audit-service
- Auto-mask previousValue, newValue, metadata, and descriptions in audit logs
- Use maskError for error logging

Pre-commit Hook:
- Add "prepare" script to package.json for automatic hook installation
- Hook is now installed automatically on pnpm install

Note: CSRF middleware is available but not enforced on API routes since
Payload CMS uses JWT auth and has built-in CORS/CSRF protection in config.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 23:34:08 +00:00
Martin Porwoll
47d912016b fix: eliminate duplicate audit entries and add proper client context 
- Extend logLoginFailed to accept ClientInfo directly (not just PayloadRequest)
- Add logPasswordReset function for password reset audit logging
- Remove duplicate manual payload.create calls in login routes
- Implement real fallback in auditAfterForgotPassword with structured JSON log
- Login routes now create single audit entry with full IP/User-Agent context

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 22:07:52 +00:00
Martin Porwoll
dfb35566b7 fix: correct auth audit logging - use args.req.payload and override native login 
- Fix afterForgotPassword hook to read payload from args.req.payload instead of context
- Create /api/users/login route to override native Payload login endpoint
- Add IP/User-Agent context to failed login audit entries
- Update /api/auth/login with consistent client info logging

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 22:00:36 +00:00
Martin Porwoll
7b8efcff38 fix: complete auth event audit logging 
Addresses remaining gaps from the audit review:

1. Register afterForgotPassword hook in Users collection
   - Password reset requests are now properly logged
   - Fixed hook signature (uses context instead of req)

2. Create custom /api/auth/login endpoint
   - Wraps native Payload login
   - Logs failed login attempts via auditLoginFailed
   - Returns proper error responses without exposing details

3. Export auditLoginFailed helper function
   - Can be used by other custom auth handlers
   - Calls logLoginFailed from audit-service

Now all critical auth events are tracked:
- Successful logins (afterLogin hook)
- Failed logins (custom /api/auth/login endpoint)
- Logouts (afterLogout hook)
- Password reset requests (afterForgotPassword hook)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-12-07 21:31:11 +00:00