679b89ae4c
Security Validation (enhance-security-validation): - JWT secret validation with entropy checking and pattern detection - CSRF protection middleware with token generation/validation - Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests - MIME type validation with magic bytes detection for file uploads Error Resilience (add-error-resilience): - React ErrorBoundary component with fallback UI and retry functionality - ErrorBoundaryWithI18n wrapper for internationalization support - Page-level and section-level error boundaries in App.tsx Query Performance (optimize-query-performance): - Query monitoring utility with threshold warnings - N+1 query fixes using joinedload/selectinload - Optimized project members, tasks, and subtasks endpoints Bug Fixes: - WebSocket session management (P0): Return primitives instead of ORM objects - LIKE query injection (P1): Escape special characters in search queries Tests: 543 backend tests, 56 frontend tests passing Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: JWT Secret Validation
|
|
The system SHALL validate JWT secret key strength on startup.
|
|
|
|
#### Scenario: Weak secret rejected
|
|
- **WHEN** the configured JWT secret is less than 32 characters
|
|
- **THEN** the system SHALL log a critical warning
|
|
- **AND** optionally refuse to start in production mode
|
|
|
|
#### Scenario: Low entropy secret warning
|
|
- **WHEN** the JWT secret has low entropy (repeating patterns, common words)
|
|
- **THEN** the system SHALL log a security warning
|
|
|
|
### Requirement: CSRF Protection
|
|
The system SHALL protect sensitive state-changing operations with CSRF tokens.
|
|
|
|
#### Scenario: CSRF token required for password change
|
|
- **WHEN** a user attempts to change their password
|
|
- **AND** the request does not include a valid CSRF token
|
|
- **THEN** the request SHALL be rejected with 403 Forbidden
|
|
|
|
#### Scenario: CSRF token required for account deletion
|
|
- **WHEN** a user attempts to delete their account or resources
|
|
- **AND** the request does not include a valid CSRF token
|
|
- **THEN** the request SHALL be rejected with 403 Forbidden
|
|
|
|
#### Scenario: Valid CSRF token accepted
|
|
- **WHEN** a state-changing request includes a valid CSRF token
|
|
- **THEN** the request SHALL proceed normally
|