From 809ba0ddcce07f494f76e5006edf9b0f344ac197 Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Mon, 10 Aug 2026 22:32:58 +0200 Subject: [PATCH] M35: harden the shared public demo --- .env.example | 3 ++ PROJECT_STATE.md | 18 ++++++++ backend/app/api/routers/demo.py | 54 +++++++++++++++------- backend/app/core/config.py | 2 + backend/app/main.py | 11 ++++- backend/app/services/integration_status.py | 22 +++++++-- backend/tests/test_auth.py | 22 +++++++++ compose.test.yaml | 1 + frontend/nginx.conf | 31 +++++++++++++ 9 files changed, 142 insertions(+), 22 deletions(-) diff --git a/.env.example b/.env.example index f5429c2..8d5a483 100644 --- a/.env.example +++ b/.env.example @@ -51,6 +51,9 @@ PRIVACY_AUDIT_EXPORT_MAX_ROWS=10000 DEMO_ORGANIZATION_NAME=Northstar Mobility DEMO_TIMEZONE=Europe/Brussels DEMO_ALLOW_RESET=true +# Prevent public visitors from repeatedly rebuilding the shared dataset. Concurrent +# resets are always rejected using both process and PostgreSQL advisory locks. +DEMO_RESET_COOLDOWN_SECONDS=60 # Operational mode: set MOBILITYOPS_DEMO_MODE=false and provide the first manager. # Keep these values in a secret store or an untracked production .env file. diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md index 5e815b3..3618247 100644 --- a/PROJECT_STATE.md +++ b/PROJECT_STATE.md @@ -2775,3 +2775,21 @@ evidence yet." direct invalid-state writes were rejected by their named constraints; Ruff passed. - Exact next action: serialize and rate-limit shared demo reset, add production web guards and cache MCP reachability evidence. + +## M35 — shared public demo and edge hardening (2026-08-10) + +- Demo resets now use a non-blocking process guard plus a PostgreSQL transaction advisory + lock, and enforce a configurable post-success cooldown with a standards-based + `Retry-After`. Test deployments explicitly disable only the cooldown, never locking. +- Nginx rate-limits public demo login/reset endpoints and adds CSP, anti-framing, MIME, + referrer and browser capability headers. Hashed assets receive long-lived caching while + the application shell is revalidated. Production FastAPI deployments no longer expose + Swagger, ReDoc or OpenAPI routes. +- MCP Hub reachability probes are synchronized and cached for 60 seconds, removing a + remote network call from every Integration Management page load while retaining honest + failure evidence. +- Validation: authentication/reset suite **15 passed**; Ruff and mypy passed across 58 + source files; production web image built and `nginx -t` passed; production API docs-off + assertion passed. +- Exact next action: improve mobile Data Quality operations, technical evidence labels, + RAG scope clarity and sticky resolution actions. diff --git a/backend/app/api/routers/demo.py b/backend/app/api/routers/demo.py index ff271ed..a04c7bd 100644 --- a/backend/app/api/routers/demo.py +++ b/backend/app/api/routers/demo.py @@ -1,10 +1,11 @@ from __future__ import annotations +import threading import time import uuid from fastapi import APIRouter, Depends, HTTPException, Request, Response, status -from sqlalchemy import select +from sqlalchemy import func, select from sqlalchemy.orm import Session from app.api.deps import get_current_user, get_db, require_operations_manager @@ -19,6 +20,9 @@ from app.services.sessions import revoke_session router = APIRouter(prefix="/api/v1/demo", tags=["demo"]) settings = get_settings() +_reset_guard = threading.Lock() +_last_reset_monotonic = 0.0 +_RESET_ADVISORY_LOCK_ID = 706_533_149 @router.get("/manifest", response_model=DemoManifestOut) @@ -106,26 +110,44 @@ def demo_reset( db: Session = Depends(get_db), user: CurrentUser = Depends(require_operations_manager), ) -> dict: + global _last_reset_monotonic if not settings.demo_allow_reset: raise HTTPException( status_code=status.HTTP_403_FORBIDDEN, detail="Demo reset is disabled on this deployment.", ) - result = reset_and_seed(db, preserve_integration_telemetry=True) - integrity = scenario_integrity_report(db) - record_audit_event( - db, - actor_type="user", - actor_label=user.display_name, - action="demo_reset", - entity_type="system", - metadata={ - "counts": result.counts, - "anchor_date": result.anchor_date.isoformat(), - "scenario_integrity": integrity, - }, - ) - db.commit() + if not _reset_guard.acquire(blocking=False): + raise HTTPException(status_code=409, detail="A demo reset is already running.") + try: + elapsed = time.monotonic() - _last_reset_monotonic + if _last_reset_monotonic and elapsed < settings.demo_reset_cooldown_seconds: + retry_after = max(1, int(settings.demo_reset_cooldown_seconds - elapsed + 0.999)) + raise HTTPException( + status_code=429, + detail=f"Demo reset is cooling down. Retry in {retry_after} seconds.", + headers={"Retry-After": str(retry_after)}, + ) + locked = db.scalar(select(func.pg_try_advisory_xact_lock(_RESET_ADVISORY_LOCK_ID))) + if not locked: + raise HTTPException(status_code=409, detail="A demo reset is already running.") + result = reset_and_seed(db, preserve_integration_telemetry=True) + integrity = scenario_integrity_report(db) + record_audit_event( + db, + actor_type="user", + actor_label=user.display_name, + action="demo_reset", + entity_type="system", + metadata={ + "counts": result.counts, + "anchor_date": result.anchor_date.isoformat(), + "scenario_integrity": integrity, + }, + ) + db.commit() + _last_reset_monotonic = time.monotonic() + finally: + _reset_guard.release() response.delete_cookie(settings.session_cookie_name) return { "status": "reset", diff --git a/backend/app/core/config.py b/backend/app/core/config.py index c42f189..a60b56b 100644 --- a/backend/app/core/config.py +++ b/backend/app/core/config.py @@ -48,6 +48,8 @@ class Settings(BaseSettings): demo_organization_name: str = "Northstar Mobility" demo_timezone: str = "Europe/Brussels" demo_allow_reset: bool = True + demo_reset_cooldown_seconds: int = 60 + mcp_hub_health_cache_seconds: int = 60 initial_admin_email: str = "" initial_admin_password: str = "" initial_admin_display_name: str = "Operations Manager" diff --git a/backend/app/main.py b/backend/app/main.py index 5f6484a..ef2260d 100644 --- a/backend/app/main.py +++ b/backend/app/main.py @@ -55,7 +55,15 @@ async def lifespan(_app: FastAPI): stop_background_dispatcher() -app = FastAPI(title=f"{PRODUCT_NAME} API", version="0.1.0", lifespan=lifespan) +production = settings.mobilityops_env.lower() == "production" +app = FastAPI( + title=f"{PRODUCT_NAME} API", + version="0.1.0", + lifespan=lifespan, + docs_url=None if production else "/docs", + redoc_url=None if production else "/redoc", + openapi_url=None if production else "/openapi.json", +) app.add_middleware( SessionMiddleware, @@ -126,6 +134,7 @@ def handle_http_exception(request: Request, exc: HTTPException) -> JSONResponse: correlation_id=getattr(request.state, "correlation_id", str(uuid.uuid4())), details={}, ), + headers=exc.headers, ) diff --git a/backend/app/services/integration_status.py b/backend/app/services/integration_status.py index 82b4847..45f9085 100644 --- a/backend/app/services/integration_status.py +++ b/backend/app/services/integration_status.py @@ -1,5 +1,7 @@ from __future__ import annotations +import threading +import time from datetime import UTC, datetime, timedelta from typing import Literal @@ -18,6 +20,9 @@ from app.schemas import ( ) settings = get_settings() +_hub_health_lock = threading.Lock() +_hub_health_cached_at = 0.0 +_hub_health_cached_value: bool | None = None # The 4 canonical Fleet Ops n8n workflows (see n8n/workflows/MANIFEST.md). All 4 are # built (all with their full node set saved). @@ -278,8 +283,15 @@ def _check_hub_reachable() -> bool | None: `None` means not configured / not checked, never a guess.""" if not settings.mcp_hub_base_url: return None - try: - response = httpx.get(f"{settings.mcp_hub_base_url.rstrip('/')}/health", timeout=1.5) - return response.status_code == 200 - except httpx.HTTPError: - return False + global _hub_health_cached_at, _hub_health_cached_value + now = time.monotonic() + with _hub_health_lock: + if now - _hub_health_cached_at < settings.mcp_hub_health_cache_seconds: + return _hub_health_cached_value + try: + response = httpx.get(f"{settings.mcp_hub_base_url.rstrip('/')}/health", timeout=1.5) + _hub_health_cached_value = response.status_code == 200 + except httpx.HTTPError: + _hub_health_cached_value = False + _hub_health_cached_at = time.monotonic() + return _hub_health_cached_value diff --git a/backend/tests/test_auth.py b/backend/tests/test_auth.py index ddb5b98..8f36a69 100644 --- a/backend/tests/test_auth.py +++ b/backend/tests/test_auth.py @@ -67,6 +67,28 @@ def test_operations_manager_can_reset_demo(ops_client): assert body["scenario_integrity"]["not_ready"] == [] +def test_demo_reset_rejects_concurrent_rebuild(ops_client): + import app.api.routers.demo as demo_router + + assert demo_router._reset_guard.acquire(blocking=False) + try: + response = ops_client.post("/api/v1/demo/reset") + finally: + demo_router._reset_guard.release() + assert response.status_code == 409 + + +def test_demo_reset_cooldown_returns_retry_after(ops_client, monkeypatch): + import app.api.routers.demo as demo_router + + monkeypatch.setattr(demo_router.settings, "demo_reset_cooldown_seconds", 60) + monkeypatch.setattr(demo_router, "_last_reset_monotonic", demo_router.time.monotonic()) + response = ops_client.post("/api/v1/demo/reset") + assert response.status_code == 429 + assert int(response.headers["retry-after"]) >= 1 + monkeypatch.setattr(demo_router, "_last_reset_monotonic", 0.0) + + def test_reset_is_rejected_when_demo_allow_reset_is_disabled(ops_client, monkeypatch): import app.api.routers.demo as demo_router diff --git a/compose.test.yaml b/compose.test.yaml index bbcb157..622eaa7 100644 --- a/compose.test.yaml +++ b/compose.test.yaml @@ -15,6 +15,7 @@ services: KNOWLEDGE_PROVIDER: demo MCP_HUB_REGISTRATION_ENABLED: "false" DEMO_ALLOW_RESET: "true" + DEMO_RESET_COOLDOWN_SECONDS: "0" ports: !reset [] web: diff --git a/frontend/nginx.conf b/frontend/nginx.conf index c753a38..19db5e4 100644 --- a/frontend/nginx.conf +++ b/frontend/nginx.conf @@ -1,3 +1,6 @@ +limit_req_zone $binary_remote_addr zone=demo_login:10m rate=10r/m; +limit_req_zone $binary_remote_addr zone=demo_reset:10m rate=2r/m; + server { listen 80; server_name _; @@ -5,6 +8,28 @@ server { root /usr/share/nginx/html; index index.html; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "DENY" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always; + + location = /api/v1/demo/login { + limit_req zone=demo_login burst=5 nodelay; + proxy_pass http://api:8000; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location = /api/v1/demo/reset { + limit_req zone=demo_reset burst=1 nodelay; + proxy_pass http://api:8000; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + location /api/ { proxy_pass http://api:8000; proxy_set_header Host $host; @@ -17,6 +42,12 @@ server { } location / { + expires -1; try_files $uri /index.html; } + + location ~* ^/assets/.+\.[a-fA-F0-9_-]+\.(css|js|woff2|png|svg)$ { + expires 1y; + try_files $uri =404; + } }