* fix(security+ops): #82 #85 #87 — auth hardening, API validation, deploy posture Security and operational hardening across three issue groups: - M23: docker-compose.override.yml → docker-compose.dev.yml (BREAKING, prod foot-gun) - C13: Container runs as non-root user 'agnes' (USER directive in Dockerfile) - M21: Docker resource limits (mem_limit, cpus) on app + scheduler - M22: Caddyfile security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, -Server) - M17: /api/health split into minimal (unauth) + /api/health/detailed (auth) (BREAKING) - M26: release.yml restricts build-and-push to main + workflow_dispatch; paths-ignore for docs - C2: table_id traversal validation on /api/data/{table_id}/download - M4: Upload streaming (chunk-read + temp file) instead of full-buffer; /local-md hashed filename - C5: reset_token removed from POST /api/users/{id}/reset-password response - C8: Startup WARNING when no user has password_hash (bootstrap window visible) - M9: Audit log on failed web form login (mirrors /auth/token endpoint) - M10: Atomic magic-link consume via compare-and-swap (CONSUMED: marker + DuckDB conflict catch) Also: SSRF protection on /api/admin/configure (#46), memory stats SQL aggregation (#90) Generated with [Devin](https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(review): SSRF 169.254.x.x + IPv6 multicast; M10 marker cleanup safety Review fixes: - Add 169.254.0.0/16 (link-local, cloud metadata) to SSRF regex — was missing, allowing requests to AWS/GCP/Azure metadata endpoints - Add ff[0-9a-f]{2}: (IPv6 multicast) to SSRF regex - M10: wrap Step 3 (CONSUMED marker cleanup) in try-except with warning log — prevents unhandled exception if DB write fails after successful token consumption - Add test for 169.254.169.254 SSRF rejection Generated with [Devin](https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(review): SSRF IPv6 bypass, CLI health endpoint, upload FD leak Address Devin Review findings on PR #104: 1. SSRF IPv6 bypass: Replace hostname regex with DNS resolution + ipaddress module checks. The old regex patterns like `fe80:` only matched up to the first colon, missing real IPv6 addresses like `fe80::1`, `fc00::1`, `ff02::1`. The new approach resolves the hostname via getaddrinfo and checks each resulting IP against ipaddress.is_private/is_loopback/is_link_local/is_reserved/is_multicast. 2. CLI commands broken: `da setup test-connection`, `da setup verify`, `da diagnose`, `da status` all called /api/health expecting the old format (status=="healthy", services dict). Now they call /api/health/detailed for service-level checks (with graceful fallback to the minimal endpoint when auth is not configured). 3. Temp file handle leak: _stream_to_temp returns an open NamedTemporaryFile; callers now close it before shutil.move() to prevent FD leaks until GC. Also adds IPv6 SSRF test cases (loopback, link-local, unique-local, multicast) with mocked DNS resolution for test environment independence. Generated with [Devin](https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(review): download regex blocks hyphenated IDs; document health split Address Devin Review round-3 findings on PR #104: 1. _SAFE_IDENTIFIER regex blocked hyphenated table IDs: The download endpoint used the strict SQL-identifier regex which does not allow dots or hyphens, but Keboola table IDs like in.c-crm.orders contain both. Switched to _SAFE_QUOTED_IDENTIFIER which allows dots and hyphens while still blocking path-traversal chars (/, .., \) and quote/control characters. Added test for hyphenated/dotted IDs. 2. Documented health endpoint split in DEPLOYMENT.md: Added Health checks & external monitoring section explaining both endpoints (minimal unauth /api/health vs authenticated /api/health/detailed) and how to wire external monitoring tools to the detailed endpoint with a PAT. Generated with [Devin](https://cli.devin.ai/docs) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> * release(0.12.1): cut hotfix for snapshot integrity + #82/#85/#87 hardening * fix(security): apply CAS pattern to password reset confirm (#82/M10 follow-up) Devin review on the rebased PR flagged the asymmetry: magic-link verify got the atomic compare-and-swap pattern in the original M10 fix, but password reset confirm at /auth/password/reset/confirm was still using read-validate-clear. Two concurrent POSTs with the same valid reset token could both succeed in setting different new passwords (last-write- wins). Lower severity than the magic-link race because the attacker would need the reset token AND to race the legitimate user, but the asymmetry was a polish gap. Mirrors app/auth/providers/email.py::_consume_token CAS exactly: write unique CONSUMED:<random> marker via UPDATE...WHERE token=old_token, then SELECT to verify our marker won, then proceed. Only the winner clears the marker and applies the password change. New regression test_concurrent_reset_only_one_wins in tests/test_password_flows.py::TestResetConfirm pins the contract: two ThreadPoolExecutor workers + Barrier hit /reset/confirm with the same token; exactly one gets 302 (password applied), the other gets 200 with 'Invalid or expired'. Sanity-checked against the pre-CAS code — both POSTs got 302 (race confirmed). --------- Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
109 lines
3.9 KiB
Python
109 lines
3.9 KiB
Python
"""Health check endpoint — structured diagnostics for AI agents."""
|
|
|
|
import os
|
|
from datetime import datetime, timezone
|
|
|
|
from fastapi import APIRouter, Depends
|
|
import duckdb
|
|
|
|
from app.auth.dependencies import _get_db, get_current_user
|
|
from src.db import SCHEMA_VERSION
|
|
from src.repositories.sync_state import SyncStateRepository
|
|
|
|
router = APIRouter(tags=["health"])
|
|
|
|
# Captured at module import (i.e., app process start) — proxy for "deployed at".
|
|
# When the cron auto-upgrade pulls a new digest and recreates the container,
|
|
# this resets. Accurate enough for a UI "last updated" badge.
|
|
_DEPLOYED_AT = datetime.now(timezone.utc).isoformat()
|
|
|
|
|
|
@router.get("/api/health")
|
|
async def health_check():
|
|
"""Minimal health check for load balancers / compose healthcheck. No auth required."""
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.get("/api/health/detailed")
|
|
async def health_check_detailed(
|
|
conn: duckdb.DuckDBPyConnection = Depends(_get_db),
|
|
_user: dict = Depends(get_current_user),
|
|
):
|
|
"""Structured health check with deployment metadata. Requires authentication."""
|
|
checks = {}
|
|
|
|
# DuckDB state
|
|
try:
|
|
conn.execute("SELECT 1").fetchone()
|
|
checks["duckdb_state"] = {"status": "ok"}
|
|
except Exception as e:
|
|
checks["duckdb_state"] = {"status": "error", "detail": str(e)}
|
|
|
|
# Sync state summary
|
|
try:
|
|
repo = SyncStateRepository(conn)
|
|
all_states = repo.get_all_states()
|
|
total_tables = len(all_states)
|
|
total_rows = sum(s.get("rows", 0) or 0 for s in all_states)
|
|
stale = []
|
|
now = datetime.now(timezone.utc)
|
|
for s in all_states:
|
|
last = s.get("last_sync")
|
|
if last:
|
|
try:
|
|
# Handle both tz-aware and tz-naive datetimes from DuckDB
|
|
if hasattr(last, 'tzinfo') and last.tzinfo is None:
|
|
from datetime import timezone as tz
|
|
last = last.replace(tzinfo=tz.utc)
|
|
if (now - last).total_seconds() > 86400:
|
|
stale.append(s["table_id"])
|
|
except (TypeError, AttributeError):
|
|
pass # skip if timestamp comparison fails
|
|
checks["data"] = {
|
|
"status": "ok" if not stale else "warning",
|
|
"tables": total_tables,
|
|
"total_rows": total_rows,
|
|
"stale_tables": stale,
|
|
}
|
|
except Exception as e:
|
|
checks["data"] = {"status": "error", "detail": str(e)}
|
|
|
|
# User count
|
|
try:
|
|
user_count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
|
|
checks["users"] = {"status": "ok", "count": user_count}
|
|
except Exception as e:
|
|
checks["users"] = {"status": "error", "detail": str(e)}
|
|
|
|
overall = "healthy"
|
|
for check in checks.values():
|
|
if check.get("status") == "error":
|
|
overall = "unhealthy"
|
|
break
|
|
if check.get("status") == "warning":
|
|
overall = "degraded"
|
|
|
|
return {
|
|
"status": overall,
|
|
"version": os.environ.get("AGNES_VERSION", "dev"),
|
|
"channel": os.environ.get("RELEASE_CHANNEL", "dev"),
|
|
"image_tag": os.environ.get("AGNES_TAG", "unknown"),
|
|
"commit_sha": os.environ.get("AGNES_COMMIT_SHA", "unknown"),
|
|
"schema_version": SCHEMA_VERSION,
|
|
"deployed_at": _DEPLOYED_AT,
|
|
"timestamp": datetime.now(timezone.utc).isoformat(),
|
|
"services": checks,
|
|
}
|
|
|
|
|
|
@router.get("/api/version")
|
|
async def version_info():
|
|
"""Lightweight version info — cacheable, no DB touch. Used by UI footer badge."""
|
|
return {
|
|
"version": os.environ.get("AGNES_VERSION", "dev"),
|
|
"channel": os.environ.get("RELEASE_CHANNEL", "dev"),
|
|
"image_tag": os.environ.get("AGNES_TAG", "unknown"),
|
|
"commit_sha": os.environ.get("AGNES_COMMIT_SHA", "unknown"),
|
|
"schema_version": SCHEMA_VERSION,
|
|
"deployed_at": _DEPLOYED_AT,
|
|
}
|