jpetree331
f97d4845af
Complete RedFlag codebase with two major security audit implementations.
== A-1: Ed25519 Key Rotation Support ==
Server:
- SignCommand sets SignedAt timestamp and KeyID on every signature
- signing_keys database table (migration 020) for multi-key rotation
- InitializePrimaryKey registers active key at startup
- /api/v1/public-keys endpoint for rotation-aware agents
- SigningKeyQueries for key lifecycle management
Agent:
- Key-ID-aware verification via CheckKeyRotation
- FetchAndCacheAllActiveKeys for rotation pre-caching
- Cache metadata with TTL and staleness fallback
- SecurityLogger events for key rotation and command signing
== A-2: Replay Attack Fixes (F-1 through F-7) ==
F-5 CRITICAL - RetryCommand now signs via signAndCreateCommand
F-1 HIGH - v3 format: "{agent_id}:{cmd_id}:{type}:{hash}:{ts}"
F-7 HIGH - Migration 026: expires_at column with partial index
F-6 HIGH - GetPendingCommands/GetStuckCommands filter by expires_at
F-2 HIGH - Agent-side executedIDs dedup map with cleanup
F-4 HIGH - commandMaxAge reduced from 24h to 4h
F-3 CRITICAL - Old-format commands rejected after 48h via CreatedAt
Verification fixes: migration idempotency (ETHOS #4), log format
compliance (ETHOS #1), stale comments updated.
All 24 tests passing. Docker --no-cache build verified.
See docs/ for full audit reports and deviation log (DEV-001 to DEV-019).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
67 lines
1.6 KiB
Go
67 lines
1.6 KiB
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/Fimeg/RedFlag/aggregator-server/internal/services"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type SettingsHandler struct {
|
|
timezoneService *services.TimezoneService
|
|
}
|
|
|
|
func NewSettingsHandler(timezoneService *services.TimezoneService) *SettingsHandler {
|
|
return &SettingsHandler{
|
|
timezoneService: timezoneService,
|
|
}
|
|
}
|
|
|
|
// GetTimezones returns available timezone options
|
|
func (h *SettingsHandler) GetTimezones(c *gin.Context) {
|
|
timezones := h.timezoneService.GetAvailableTimezones()
|
|
c.JSON(http.StatusOK, gin.H{"timezones": timezones})
|
|
}
|
|
|
|
// GetTimezone returns the current timezone configuration
|
|
func (h *SettingsHandler) GetTimezone(c *gin.Context) {
|
|
// TODO: Get from user settings when implemented
|
|
// For now, return the server timezone
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"timezone": "UTC",
|
|
"label": "UTC (Coordinated Universal Time)",
|
|
})
|
|
}
|
|
|
|
// UpdateTimezone updates the timezone configuration
|
|
func (h *SettingsHandler) UpdateTimezone(c *gin.Context) {
|
|
var req struct {
|
|
Timezone string `json:"timezone" binding:"required"`
|
|
}
|
|
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
|
|
// TODO: Save to user settings when implemented
|
|
// For now, just validate it's a valid timezone
|
|
timezones := h.timezoneService.GetAvailableTimezones()
|
|
valid := false
|
|
for _, tz := range timezones {
|
|
if tz.Value == req.Timezone {
|
|
valid = true
|
|
break
|
|
}
|
|
}
|
|
|
|
if !valid {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid timezone"})
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"message": "timezone updated",
|
|
"timezone": req.Timezone,
|
|
})
|
|
} |