Jonathan Kirkwood
3a4b7dfd8b
Pre-release audit fixes: - External Administrators can only act on investors already in their own funds (grant_access, create_statement, set_partner_exited, import match), closing a cross-fund account-takeover chain. - Role and is_active changes are gated: no self-escalation, non-approvers cannot mint or alter approver accounts, and the Service Admin is protected. - must_change_password is enforced server-side, not just in the client. - Session cookie is Secure with a 12h max-age and SameSite; CSP and standard security headers on every response; the app refuses to boot on a known or short session secret; uvicorn runs with proxy-headers so login throttling keys on the real client IP behind the platform proxy. - Import preview no longer confirms cross-fund investors; no-store on document downloads. - Adds backend/tests/test_security_hardening.py (15 tests); full suite 76 passing. - SECURITY-AUDIT.md records the swarm audit, findings, and remediation status.
82 lines
3.5 KiB
Bash
82 lines
3.5 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Generate a session secret unless the operator supplied a real one. Any unset/empty value or a
|
|
# known placeholder counts as "not set" — the app also refuses to boot on these (see
|
|
# main.lifespan), so the two checks must agree on the full placeholder list.
|
|
case "$TEN31_SESSION_SECRET" in
|
|
""|change-me|change-me-in-production)
|
|
if [ -f /data/.session-secret ]; then
|
|
export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
|
|
else
|
|
export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
|
|
echo "$TEN31_SESSION_SECRET" > /data/.session-secret
|
|
chmod 600 /data/.session-secret
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
# The platform terminates TLS and reverse-proxies to us, so the session cookie is served over
|
|
# HTTPS to the client: mark it Secure. Default on here; overridable for a plain-HTTP setup.
|
|
export TEN31_SESSION_COOKIE_SECURE="${TEN31_SESSION_COOKIE_SECURE:-true}"
|
|
|
|
# Create first approver on first boot if no users exist
|
|
if [ ! -f /data/.initialized ]; then
|
|
echo "First boot: running migrations and creating the admin account..."
|
|
|
|
ADMIN_NAME="${TEN31_ADMIN_NAME:-Jonathan}"
|
|
ADMIN_USERNAME="${TEN31_ADMIN_USERNAME:-admin}"
|
|
ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-jonathan@ten31.xyz}"
|
|
|
|
# No weak default: use an operator-supplied password if given, else generate a strong random
|
|
# one and record it (0600) so it can be retrieved once via the "Show Initial Admin Password"
|
|
# action. There is no fixed default credential to guess.
|
|
ADMIN_PW_FILE="$(dirname "$TEN31_DB_PATH")/.admin-password"
|
|
if [ -n "$TEN31_ADMIN_PASSWORD" ]; then
|
|
ADMIN_PASSWORD="$TEN31_ADMIN_PASSWORD"
|
|
GENERATED=""
|
|
else
|
|
ADMIN_PASSWORD="$(python3 -c "import secrets; print(secrets.token_urlsafe(18))")"
|
|
GENERATED="yes"
|
|
fi
|
|
|
|
if python3 -m ten31portal.cli create-user \
|
|
--name "$ADMIN_NAME" \
|
|
--username "$ADMIN_USERNAME" \
|
|
--email "$ADMIN_EMAIL" \
|
|
--role approver \
|
|
--password "$ADMIN_PASSWORD" \
|
|
--service-admin; then
|
|
if [ -n "$GENERATED" ]; then
|
|
printf '%s' "$ADMIN_PASSWORD" > "$ADMIN_PW_FILE"
|
|
chmod 600 "$ADMIN_PW_FILE"
|
|
echo "Admin '$ADMIN_USERNAME' created with a generated password."
|
|
echo " Retrieve it once via the 'Show Initial Admin Password' service action, then change it."
|
|
else
|
|
echo "Admin '$ADMIN_USERNAME' created with the operator-supplied password."
|
|
fi
|
|
fi
|
|
|
|
touch /data/.initialized
|
|
fi
|
|
|
|
# Log level is overridable at runtime for debugging; defaults to info.
|
|
LOG_LEVEL="${TEN31_LOG_LEVEL:-info}"
|
|
|
|
# Hand off to the server as an unprivileged user. The platform mounts /data owned by root, so
|
|
# (while still root) we take ownership of the data volume first, then drop privileges with
|
|
# setpriv — the long-running server process is never root, limiting what a compromise can reach.
|
|
# --proxy-headers lets uvicorn read X-Forwarded-For from the platform's reverse proxy so the
|
|
# login rate limiter keys on the real client IP, not the single proxy address (otherwise one
|
|
# source's failures throttle every user). The container port is only reachable via that proxy,
|
|
# so trusting forwarded headers from any upstream is safe here.
|
|
if [ "$(id -u)" = "0" ]; then
|
|
chown -R 10001:10001 /data
|
|
exec setpriv --reuid=10001 --regid=10001 --clear-groups \
|
|
uvicorn ten31portal.main:app --host 0.0.0.0 --port 8000 --log-level "$LOG_LEVEL" \
|
|
--proxy-headers --forwarded-allow-ips="*"
|
|
else
|
|
exec uvicorn ten31portal.main:app --host 0.0.0.0 --port 8000 --log-level "$LOG_LEVEL" \
|
|
--proxy-headers --forwarded-allow-ips="*"
|
|
fi
|