jpetree331
4c62de8d8b
Fixes 9 auth middleware findings from the A-3 recon audit. F-A3-11 CRITICAL: Removed JWT secret from WebAuthMiddleware log output. Replaced emoji-prefixed fmt.Printf with ETHOS-compliant log.Printf. No secret values in any log output. F-A3-7 CRITICAL: Config download now requires WebAuthMiddleware. GET /downloads/config/:agent_id is admin-only (agents never call it). F-A3-6 HIGH: Update package download now requires AuthMiddleware. GET /downloads/updates/:package_id requires valid agent JWT. F-A3-10 HIGH: Scheduler stats changed from AuthMiddleware to WebAuthMiddleware. Agent JWTs can no longer view scheduler internals. F-A3-13 LOW: RequireAdmin() middleware implemented. 7 security settings routes re-enabled (GET/PUT/POST under /security/settings). security_settings.go.broken renamed to .go, API mismatches fixed. F-A3-12 MEDIUM: JWT issuer claims added for token type separation. Agent tokens: issuer=redflag-agent, Web tokens: issuer=redflag-web. AuthMiddleware rejects tokens with wrong issuer. Grace period: tokens with no issuer still accepted (backward compat). F-A3-2 MEDIUM: /auth/verify now has WebAuthMiddleware applied. Endpoint returns 200 with valid=true for valid admin tokens. F-A3-9 MEDIUM: Agent self-unregister (DELETE /:id) now rate-limited using the same agent_reports rate limiter as other agent routes. F-A3-14 LOW: CORS origin configurable via REDFLAG_CORS_ORIGIN env var. Defaults to http://localhost:3000 for development. Added PATCH method and agent-specific headers to CORS config. All 27 server tests pass. All 14 agent tests pass. No regressions. See docs/A3_Fix_Implementation.md and docs/Deviations_Report.md (DEV-020 through DEV-022). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
31 lines
826 B
Plaintext
31 lines
826 B
Plaintext
# RedFlag Bootstrap Configuration
|
|
# Copy this to ./config/.env and edit the values below
|
|
|
|
# PostgreSQL Configuration
|
|
POSTGRES_DB=redflag
|
|
POSTGRES_USER=redflag
|
|
POSTGRES_PASSWORD=redflag_bootstrap
|
|
|
|
# RedFlag Server Configuration
|
|
REDFLAG_SERVER_HOST=0.0.0.0
|
|
REDFLAG_SERVER_PORT=8080
|
|
REDFLAG_DB_HOST=postgres
|
|
REDFLAG_DB_PORT=5432
|
|
REDFLAG_DB_NAME=redflag
|
|
REDFLAG_DB_USER=redflag
|
|
REDFLAG_DB_PASSWORD=redflag_bootstrap
|
|
|
|
# Admin Configuration
|
|
REDFLAG_ADMIN_USER=admin
|
|
REDFLAG_ADMIN_PASSWORD=CHANGE_ME_ADMIN_PASSWORD
|
|
REDFLAG_JWT_SECRET=CHANGE_ME_JWT_SECRET_AT_LEAST_32_CHARS_LONG
|
|
|
|
# Token Configuration
|
|
REDFLAG_TOKEN_EXPIRY=24h
|
|
REDFLAG_MAX_TOKENS=100
|
|
REDFLAG_MAX_SEATS=10
|
|
|
|
# CORS Configuration (F-A3-14)
|
|
# Set to your dashboard URL in production (default: http://localhost:3000)
|
|
# REDFLAG_CORS_ORIGIN=https://your-dashboard-domain.com
|