Commit Graph

14 Commits

Author SHA1 Message Date
Proudlock
397c02611a security: fix admin bootstrap race and KB article disclosure
Address two security findings from darkwing scan:

Finding 1 [High]: Unauthenticated admin bootstrap race
- Require SETUP_TOKEN header or loopback origin for POST /api/setup/create-admin
- Enforce 12-character minimum password for bootstrap admin
- Cross-check setup_complete setting to prevent re-arming
- Log token to container logs on first startup for operator retrieval
- Add flask seed show-setup-token CLI helper
- Add audit log entry when first admin is created
- Preserve existing flask seed admin workflow (uses loopback)

Finding 2 [Medium]: Unauthenticated KB article disclosure
- Gate POST /api/knowledgebase/<id>/click on kb.view permission
- Remove linkurl from response (caller already has it from GET)
- Apply _visible_articles() filter to respect retired applications
- Prevent anonymous link enumeration and counter manipulation

Recovery paths if token is lost:
1. docker logs shopdb-api | grep "Setup token"
2. docker exec shopdb-api flask seed show-setup-token
3. docker exec shopdb-api flask seed admin (unchanged, always works)

Zero breaking changes. CLI and existing workflows unaffected.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-09-07 03:37:22 -04:00
4da6c6aa36 guest role; guide section ticking 2026-08-27 13:02:35 -04:00
0738d71525 Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction 2026-08-26 15:08:53 -04:00
1812def14f Catalog dedupe commands, and a seed catalog with no duplicate vendors or models 2026-08-24 14:49:54 -04:00
d267813999 Printer assignment end to end, and a container that keeps a site's files
Assign printers to a MACHINE and let whichever PC controls it install them, with
the observed half kept strictly apart from the assigned half: a collector report
can never write an assignment row. Adoption is explicit. Adds a singular
relationship type so defaultprinter can mean exactly one, client scripts that
converge a bay's queues and correct a drifted one in place, and a wave gate so a
fleet-wide driver rollout cannot stampede its own share.

On the container side: the compose stack never persisted the instance directory,
so a rebuild discarded plugins.json and every upload. It is a volume now, the
image ships instance/ owned by the app user so the mountpoint is writable, and
the database moves to MySQL 8.4 LTS, which the Windows runbook has recommended
since 8.0 went end of life. The image also could not build at all: the frontend
stage never copied the plugin staging script it runs.

Adds a topology migration guide covering IIS to Docker and back.
2026-08-20 07:46:35 -04:00
265ca2eb01 Security hardening, multi-site portability, and a documentation and API-surface sweep 2026-08-14 16:28:34 -04:00
6e0d8aec4e Relationship inverse guard, audit command, widened direction fixer 2026-08-13 12:25:35 -04:00
5c33b06688 Declarative subordinate devices + shared-machine check 2026-08-11 11:14:51 -04:00
d3e7311376 Catalog seeding, blank-unique fix, slides rotation, console repair 2026-08-05 13:19:51 -04:00
d8e3280dfc Release 0.8.0: Windows installer, twelve fixes from a real Server 2019 install, operator docs 2026-08-05 07:36:43 -04:00
3d43cb3d86 Windows installer: payload hash-locking, SBOM, client-IP handling, operator docs 2026-08-03 15:08:20 -04:00
99025d10f0 ADR-013 Phase 5: lean per-site builds (build-site.sh + guards + CI) 2026-07-19 00:11:41 -04:00
199438cec9 Add flask seed demo sample data; widen settings.description to TEXT 2026-07-17 20:32:38 -04:00
a9d0dfff4a Initial import: shopdb-flask multi-site asset platform
Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.

Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
  (own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records
2026-07-14 07:58:51 -04:00