Proudlock
397c02611a
security: fix admin bootstrap race and KB article disclosure
...
Address two security findings from darkwing scan:
Finding 1 [High]: Unauthenticated admin bootstrap race
- Require SETUP_TOKEN header or loopback origin for POST /api/setup/create-admin
- Enforce 12-character minimum password for bootstrap admin
- Cross-check setup_complete setting to prevent re-arming
- Log token to container logs on first startup for operator retrieval
- Add flask seed show-setup-token CLI helper
- Add audit log entry when first admin is created
- Preserve existing flask seed admin workflow (uses loopback)
Finding 2 [Medium]: Unauthenticated KB article disclosure
- Gate POST /api/knowledgebase/<id>/click on kb.view permission
- Remove linkurl from response (caller already has it from GET)
- Apply _visible_articles() filter to respect retired applications
- Prevent anonymous link enumeration and counter manipulation
Recovery paths if token is lost:
1. docker logs shopdb-api | grep "Setup token"
2. docker exec shopdb-api flask seed show-setup-token
3. docker exec shopdb-api flask seed admin (unchanged, always works)
Zero breaking changes. CLI and existing workflows unaffected.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2026-09-07 03:37:22 -04:00
ff9ae693a6
Remediate the 2026-09-03 feature-test findings
2026-09-03 17:14:53 -04:00
e8f1de811f
nav items declare their permission
2026-08-27 14:51:04 -04:00
0c1fbfcc1e
read permissions on every GET
2026-08-27 14:26:17 -04:00
4da6c6aa36
guest role; guide section ticking
2026-08-27 13:02:35 -04:00
4e38303326
Tab titles name the record; Guides reach a site and the contract surface
2026-08-26 13:31:13 -04:00
04107ff8ab
Search spelling suggestions across every list
2026-08-21 11:15:06 -04:00
980b2e8be3
Find a knowledge base article by words from different fields
2026-08-21 09:40:14 -04:00
ece0e15f03
Page past the 100-row cap in pickers and batch label sheets
2026-08-17 14:17:28 -04:00
fbd99041b0
Buildings and levels for the floor map, and make every identifier searchable
2026-08-17 13:03:54 -04:00
d32513727b
Tech Tools section with a code generator, toner report that names the part, toner forecasting, warranty proof of cover, application uploads
2026-08-12 11:51:38 -04:00
9c530a70db
Filter pagination reset; catalog model retype tool
2026-08-05 11:26:40 -04:00
9cf026e31a
kb topic search + client-ip port strip + application notes html
2026-07-29 10:09:02 -04:00
d1592b84c7
ADR-013 Phase 4: all 13 plugin frontends relocated + staging machinery
2026-07-18 23:56:32 -04:00
a9d0dfff4a
Initial import: shopdb-flask multi-site asset platform
...
Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.
Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
(own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records
2026-07-14 07:58:51 -04:00
