Files
Redflag/aggregator-server/internal/database/migrations/030_add_operational_settings.up.sql
jpetree331 5ae114df7a feat(config): E-1b/E-1c TypeScript strict compliance, configurable timeouts, path sanitization
E-1b: Fix 217 TypeScript strict errors to zero (tsc --noEmit clean).
  - Remove unused vars/imports, fix type mismatches, widen interfaces
  - TanStack Query v5 isLoading->isPending for mutations
  - No @ts-ignore or as any introduced

E-1ab verification fixes:
  - Fix audit table name mismatch (security_setting_audit -> security_settings_audit)
  - Fix DockerContainer TS type (image_name->image, image_tag->tag) to match server
  - Add 501 for empty binary_path in downloads
  - Fix ETHOS log format in downloads error path

E-1c: Configurable timeouts + path sanitization
  - Seed 6 operational timeout settings in DB (migration 030)
  - Wire server to read timeout values from DB at startup
  - Fallback to hardcoded defaults if DB settings missing
  - Fix binary_path traversal risk in downloads handler
  - Add BinaryStoragePath config (REDFLAG_BINARY_STORAGE_PATH)
  - Log resolved timeout values at startup

163 tests pass (103 server + 60 agent). No regressions.
Vite build passes. TypeScript: 0 errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-29 17:09:12 -04:00

32 lines
1.4 KiB
SQL

-- Migration 030: Seed operational timeout settings (F-E1-3)
-- These values replace hardcoded constants in main.go and timeout.go
-- Category: 'operational' — runtime-configurable server behavior
INSERT INTO security_settings
(id, category, key, value, value_type, description, requires_restart, validation_rules)
VALUES
(gen_random_uuid(), 'operational', 'offline_check_interval_seconds', '120',
'integer', 'How often to check for offline agents (seconds)', false,
'{"min": 30, "max": 3600}'),
(gen_random_uuid(), 'operational', 'offline_threshold_minutes', '10',
'integer', 'Minutes before an agent is marked offline', false,
'{"min": 2, "max": 60}'),
(gen_random_uuid(), 'operational', 'token_cleanup_interval_hours', '24',
'integer', 'Hours between expired token cleanup runs', false,
'{"min": 1, "max": 168}'),
(gen_random_uuid(), 'operational', 'sent_command_timeout_hours', '2',
'integer', 'Hours before sent commands are marked timed out', false,
'{"min": 1, "max": 24}'),
(gen_random_uuid(), 'operational', 'pending_command_timeout_minutes', '30',
'integer', 'Minutes before pending commands are marked timed out', false,
'{"min": 5, "max": 120}'),
(gen_random_uuid(), 'operational', 'timeout_check_interval_minutes', '5',
'integer', 'How often the timeout service checks for stuck commands (minutes)', false,
'{"min": 1, "max": 30}')
ON CONFLICT (category, key) DO NOTHING;