beabigegg
35c90fe76b
feat: implement 5 QA-driven security and quality proposals
...
Implemented proposals from comprehensive QA review:
1. extend-csrf-protection
- Add POST to CSRF protected methods in frontend
- Global CSRF middleware for all state-changing operations
- Update tests with CSRF token fixtures
2. tighten-cors-websocket-security
- Replace wildcard CORS with explicit method/header lists
- Disable query parameter auth in production (code 4002)
- Add per-user WebSocket connection limit (max 5, code 4005)
3. shorten-jwt-expiry
- Reduce JWT expiry from 7 days to 60 minutes
- Add refresh token support with 7-day expiry
- Implement token rotation on refresh
- Frontend auto-refresh when token near expiry (<5 min)
4. fix-frontend-quality
- Add React.lazy() code splitting for all pages
- Fix useCallback dependency arrays (Dashboard, Comments)
- Add localStorage data validation in AuthContext
- Complete i18n for AttachmentUpload component
5. enhance-backend-validation
- Add SecurityAuditMiddleware for access denied logging
- Add ErrorSanitizerMiddleware for production error messages
- Protect /health/detailed with admin authentication
- Add input length validation (comment 5000, desc 10000)
All 521 backend tests passing. Frontend builds successfully.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-12 23:19:05 +08:00
beabigegg
10db2c9d1f
feat: implement audit trail alignment (soft delete & permission audit)
...
- Task Soft Delete:
- Add is_deleted, deleted_at, deleted_by fields to Task model
- Convert DELETE to soft delete with cascade to subtasks
- Add include_deleted query param (admin only)
- Add POST /api/tasks/{id}/restore endpoint
- Exclude deleted tasks from subtask_count
- Permission Change Audit:
- Add user.role_change event (high sensitivity)
- Add user.admin_change event (critical, triggers alert)
- Add PATCH /api/users/{id}/admin endpoint
- Add role.permission_change event type
- Append-Only Enforcement:
- Add DB triggers for audit_logs immutability (manual for production)
- Migration 008 with graceful trigger failure handling
- Tests: 11 new soft delete tests (153 total passing)
- OpenSpec: fix-audit-trail archived, fix-realtime-notifications & fix-weekly-report proposals added
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2025-12-30 06:58:30 +08:00
beabigegg
0ef78e13ff
feat: implement audit trail module
...
- Backend (FastAPI):
- AuditLog and AuditAlert models with Alembic migration
- AuditService with SHA-256 checksum for log integrity
- AuditMiddleware for request metadata extraction (IP, user_agent)
- Integrated audit logging into Task, Project, Blocker APIs
- Query API with filtering, pagination, CSV export
- Integrity verification endpoint
- Sensitive operation alerts with acknowledgement
- Frontend (React + Vite):
- Admin AuditPage with filters and export
- ResourceHistory component for change tracking
- Audit service for API calls
- Testing:
- 15 tests covering service and API endpoints
- OpenSpec:
- add-audit-trail change archived
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2025-12-29 21:21:18 +08:00
