260304:1233 20260304:1200 update app to lcbp3

2026-03-04 12:33:22 +07:00
parent 56b5d87abd
commit ad77a2ae94
43 changed files with 1708 additions and 434 deletions
--- a/.agents/skills/speckit.security-audit/SKILL.md
+++ b/.agents/skills/speckit.security-audit/SKILL.md
@@ -0,0 +1,199 @@
+---
+name: speckit.security-audit
+description: Perform a security-focused audit of the codebase against OWASP Top 10, CASL authorization, and LCBP3-DMS security requirements.
+version: 1.0.0
+depends-on:
+  - speckit.checker
+---
+
+## Role
+
+You are the **Antigravity Security Sentinel**. Your mission is to identify security vulnerabilities, authorization gaps, and compliance issues specific to the LCBP3-DMS project before they reach production.
+
+## Task
+
+Perform a comprehensive security audit covering OWASP Top 10, CASL permission enforcement, file upload safety, and project-specific security rules defined in `specs/06-Decision-Records/ADR-016-security.md`.
+
+## Context Loading
+
+Before auditing, load the security context:
+
+1. Read `specs/06-Decision-Records/ADR-016-security.md` for project security decisions
+2. Read `specs/05-Engineering-Guidelines/05-02-backend-guidelines.md` for backend security patterns
+3. Read `specs/03-Data-and-Storage/lcbp3-v1.7.0-seed-permissions.sql` for CASL permission definitions
+4. Read `GEMINI.md` for security rules (Section: Security & Integrity Rules)
+
+## Execution Steps
+
+### Phase 1: OWASP Top 10 Scan
+
+Scan the `backend/src/` directory for each OWASP category:
+
+| #   | OWASP Category            | What to Check                                                                            | Files to Scan                                     |
+| --- | ------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| A01 | Broken Access Control     | Missing `@UseGuards(JwtAuthGuard, CaslAbilityGuard)` on controllers, unprotected routes  | `**/*.controller.ts`                              |
+| A02 | Cryptographic Failures    | Hardcoded secrets, weak hashing, missing HTTPS enforcement                               | `**/*.ts`, `docker-compose*.yml`                  |
+| A03 | Injection                 | Raw SQL queries, unsanitized user input in TypeORM queries, template literals in queries | `**/*.service.ts`, `**/*.repository.ts`           |
+| A04 | Insecure Design           | Missing rate limiting on auth endpoints, no idempotency checks on mutations              | `**/*.controller.ts`, `**/*.guard.ts`             |
+| A05 | Security Misconfiguration | Missing Helmet.js, CORS misconfiguration, debug mode in production                       | `main.ts`, `app.module.ts`, `docker-compose*.yml` |
+| A06 | Vulnerable Components     | Outdated dependencies with known CVEs                                                    | `package.json`, `pnpm-lock.yaml`                  |
+| A07 | Auth Failures             | Missing brute-force protection, weak password policy, JWT misconfiguration               | `auth/`, `**/*.strategy.ts`                       |
+| A08 | Data Integrity            | Missing input validation, unvalidated file types, missing CSRF protection                | `**/*.dto.ts`, `**/*.interceptor.ts`              |
+| A09 | Logging Failures          | Missing audit logs for security events, sensitive data in logs                           | `**/*.service.ts`, `**/*.interceptor.ts`          |
+| A10 | SSRF                      | Unrestricted outbound requests, user-controlled URLs                                     | `**/*.service.ts`                                 |
+
+### Phase 2: CASL Authorization Audit
+
+1. **Load permission matrix** from `specs/03-Data-and-Storage/lcbp3-v1.7.0-seed-permissions.sql`
+2. **Scan all controllers** for `@UseGuards(CaslAbilityGuard)` coverage:
+
+   ```bash
+   # Find controllers without CASL guard
+   grep -rL "CaslAbilityGuard" backend/src/modules/*/\*.controller.ts
+   ```
+
+3. **Verify 4-Level RBAC enforcement**:
+   - Level 1: System Admin (full access)
+   - Level 2: Project Admin (project-scoped)
+   - Level 3: Department Lead (department-scoped)
+   - Level 4: User (own-records only)
+
+4. **Check ability definitions** — ensure every endpoint has:
+   - `@CheckPolicies()` or `@Can()` decorator
+   - Correct action (`read`, `create`, `update`, `delete`, `manage`)
+   - Correct subject (entity class, not string)
+
+5. **Cross-reference with routes** — verify:
+   - No public endpoints that should be protected
+   - No endpoints with broader permissions than required (principle of least privilege)
+   - Query scoping: users can only query their own records (unless admin)
+
+### Phase 3: File Upload Security (ClamAV)
+
+Check LCBP3-DMS-specific file handling per ADR-016:
+
+1. **Two-Phase Storage verification**:
+   - Upload goes to temp directory first → scanned by ClamAV → moved to permanent
+   - Check for direct writes to permanent storage (violation)
+
+2. **ClamAV integration**:
+   - Verify ClamAV service is configured in `docker-compose*.yml`
+   - Check that file upload endpoints call ClamAV scan before commit
+   - Verify rejection flow for infected files
+
+3. **File type validation**:
+   - Check allowed MIME types against whitelist
+   - Verify file extension validation exists
+   - Check for double-extension attacks (e.g., `file.pdf.exe`)
+
+4. **File size limits**:
+   - Verify upload size limits are enforced
+   - Check for path traversal in filenames (`../`, `..\\`)
+
+### Phase 4: LCBP3-DMS-Specific Checks
+
+1. **Idempotency** — verify all POST/PUT/PATCH endpoints check `Idempotency-Key` header:
+
+   ```bash
+   # Find mutation endpoints without idempotency
+   grep -rn "@Post\|@Put\|@Patch" backend/src/modules/*/\*.controller.ts
+   # Cross-reference with idempotency guard usage
+   grep -rn "IdempotencyGuard\|Idempotency-Key" backend/src/
+   ```
+
+2. **Optimistic Locking** — verify document entities use `@VersionColumn()`:
+
+   ```bash
+   grep -rn "VersionColumn" backend/src/modules/*/entities/*.entity.ts
+   ```
+
+3. **Redis Redlock** — verify document numbering uses distributed locks:
+
+   ```bash
+   grep -rn "Redlock\|redlock\|acquireLock" backend/src/
+   ```
+
+4. **Password Security** — verify bcrypt with 12+ salt rounds:
+
+   ```bash
+   grep -rn "bcrypt\|saltRounds\|genSalt" backend/src/
+   ```
+
+5. **Rate Limiting** — verify throttle guard on auth endpoints:
+
+   ```bash
+   grep -rn "ThrottlerGuard\|@Throttle" backend/src/modules/auth/
+   ```
+
+6. **Environment Variables** — ensure no `.env` files for production:
+   - Check for `.env` files committed to git
+   - Verify Docker compose uses `environment:` section, not `env_file:`
+
+## Severity Classification
+
+| Severity       | Description                                           | Response                |
+| -------------- | ----------------------------------------------------- | ----------------------- |
+| 🔴 **Critical** | Exploitable vulnerability, data exposure, auth bypass | Immediate fix required  |
+| 🟠 **High**     | Missing security control, potential escalation path   | Fix before next release |
+| 🟡 **Medium**   | Best practice violation, defense-in-depth gap         | Plan fix in sprint      |
+| 🟢 **Low**      | Informational, minor hardening opportunity            | Track in backlog        |
+
+## Report Format
+
+Generate a structured report:
+
+```markdown
+# 🔒 Security Audit Report
+
+**Date**: <date>
+**Scope**: <backend/frontend/both>
+**Auditor**: Antigravity Security Sentinel
+
+## Summary
+
+| Severity   | Count |
+| ---------- | ----- |
+| 🔴 Critical | X     |
+| 🟠 High     | X     |
+| 🟡 Medium   | X     |
+| 🟢 Low      | X     |
+
+## Findings
+
+### [SEV-001] <Title> — 🔴 Critical
+
+**Category**: OWASP A01 / CASL / ClamAV / LCBP3-Specific
+**File**: `<path>:<line>`
+**Description**: <what is wrong>
+**Impact**: <what could happen>
+**Recommendation**: <how to fix>
+**Code Example**:
+\`\`\`typescript
+// Before (vulnerable)
+...
+// After (fixed)
+...
+\`\`\`
+
+## CASL Coverage Matrix
+
+| Module | Controller      | Guard? | Policies? | Level        |
+| ------ | --------------- | ------ | --------- | ------------ |
+| auth   | AuthController  | ✅      | ✅         | N/A (public) |
+| users  | UsersController | ✅      | ✅         | L1-L4        |
+| ...    | ...             | ...    | ...       | ...          |
+
+## Recommendations Priority
+
+1. <Critical fix 1>
+2. <Critical fix 2>
+   ...
+```
+
+## Operating Principles
+
+- **Read-Only**: This skill only reads and reports. Never modify code.
+- **Evidence-Based**: Every finding must include the exact file path and line number.
+- **No False Confidence**: If a check is inconclusive, mark it as "⚠️ Needs Manual Review" rather than passing.
+- **LCBP3-Specific**: Prioritize project-specific rules (idempotency, ClamAV, Redlock) over generic checks.
+- **Frontend Too**: If scope includes frontend, also check for XSS in React components, unescaped user data, and exposed API keys.