fix: wire security headers, graceful shutdown, and settings invalidation
Lifecycle (internal/app + main.go): - App.OnShutdown hooks run after the HTTP server drains, in registration order: Worker.Shutdown (background jobs now drain instead of dying on SIGTERM), DeviceAuthMiddleware.Stop (releases the rate-limiter ticker), Handler.CloseScanner (fsnotify watcher and scan log files) Security headers: - SecurityHeadersMiddleware (survivor of middleware/security.go, renamed security_headers.go) is now on the echo stack: nosniff, frame-deny, HSTS, CSP (unsafe-inline required by the sanctioned theme flash guard + Alpine), referrer and permissions policy Scanner settings cache: - settings saves (UpdateScanSettings + ApplySetting for the three scan keys) now invalidate MediaScanner's 30s settings cache via SystemSettingsHandler.SetScanSettingsChanged, so changes apply on the next poll instead of after the TTL - MediaScanner.Close closes the scan logger, fixing a file-descriptor leak on every per-item rescan (fresh scanners never closed logs) Client fix: - custom-section-builder's add/remove-selection buttons used inline onclick attributes referencing module-scoped functions, which are not global in a bundled ES module: the buttons threw ReferenceError. Functions restored and exposed on window via declare global Also fixes a pre-existing vet error (saveCoverImage copied echo.Context by value, mutex included) and drops the per-key SettingsCache.InvalidateKey variant left callerless by the full-flush invalidation wiring.
This commit is contained in:
John O'Keefe committed
1 parent
8631aa00bf
commit
a716b386a1
10 files changed
+98
-195
No files matched your search
@@ -197,61 +197,10 @@ func (m *DeviceAuthMiddleware) getRequestType(path string) string {
|
||||
return "sync"
|
||||
}
|
||||
|
||||
func (m *DeviceAuthMiddleware) RequirePermission(permission string) echo.MiddlewareFunc {
|
||||
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c *echo.Context) error {
|
||||
device, ok := c.Get("device").(database.Devices)
|
||||
if !ok {
|
||||
return c.JSON(http.StatusUnauthorized, map[string]string{
|
||||
"error": "device not authenticated",
|
||||
})
|
||||
}
|
||||
|
||||
if !m.hasPermission(device.DeviceType, permission) {
|
||||
return c.JSON(http.StatusForbidden, map[string]string{
|
||||
"error": "insufficient permissions",
|
||||
})
|
||||
}
|
||||
|
||||
return next(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (m *DeviceAuthMiddleware) hasPermission(deviceType string, permission string) bool {
|
||||
permissions := map[string][]string{
|
||||
"koreader": {"sync:progress", "sync:annotations", "sync:metadata"},
|
||||
"kobo": {"sync:progress", "sync:annotations", "sync:metadata"},
|
||||
"web": {"sync:progress", "sync:annotations", "sync:metadata", "device:manage"},
|
||||
"mobile": {"sync:progress", "sync:annotations", "sync:metadata"},
|
||||
}
|
||||
|
||||
devicePerms, exists := permissions[deviceType]
|
||||
if !exists {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, p := range devicePerms {
|
||||
if p == permission {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
func (m *DeviceAuthMiddleware) UpdateLastSeen(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c *echo.Context) error {
|
||||
err := next(c)
|
||||
|
||||
deviceIDBytes, ok := c.Get("device_id").([16]byte)
|
||||
if ok {
|
||||
pgDeviceID := pgtype.UUID{Bytes: deviceIDBytes, Valid: true}
|
||||
m.db.UpdateDeviceLastSeen(c.Request().Context(), pgDeviceID)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
// Stop releases the device rate limiter's cleanup resources (its ticker
|
||||
// goroutine). Call once during graceful shutdown.
|
||||
func (m *DeviceAuthMiddleware) Stop() {
|
||||
m.rateLimiter.Stop()
|
||||
}
|
||||
|
||||
func (m *DeviceAuthMiddleware) ValidateDeviceToken(token string) (database.Devices, error) {
|
||||
|
||||
@@ -1,10 +1,6 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/labstack/echo/v5"
|
||||
)
|
||||
|
||||
@@ -25,126 +21,3 @@ func SecurityHeadersMiddleware() echo.MiddlewareFunc {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// HTTPSRedirectMiddleware redirects HTTP to HTTPS
|
||||
// NOTE: Disabled for Docker self-hosted deployments - SSL is handled by reverse proxy
|
||||
func HTTPSRedirectMiddleware(httpsPort string) echo.MiddlewareFunc {
|
||||
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c *echo.Context) error {
|
||||
// SSL is handled by proxy - no redirect needed
|
||||
return next(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// isTestMode checks if the application is running in test mode
|
||||
func isTestMode(c *echo.Context) bool {
|
||||
// Check for test mode header or environment
|
||||
return c.Request().Header.Get("X-Test-Mode") == "true" ||
|
||||
c.Request().Header.Get("X-Forwarded-Proto") == "http"
|
||||
}
|
||||
|
||||
// SSLProxyMiddleware handles SSL termination proxy headers
|
||||
// NOTE: Essential for Docker deployments where SSL is handled by reverse proxy (nginx, traefik, etc.)
|
||||
// This middleware reads X-Forwarded-Proto and X-Forwarded-Host headers set by the proxy
|
||||
func SSLProxyMiddleware() echo.MiddlewareFunc {
|
||||
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c *echo.Context) error {
|
||||
// Check for proxy headers
|
||||
if proto := c.Request().Header.Get("X-Forwarded-Proto"); proto == "https" {
|
||||
c.Request().URL.Scheme = "https"
|
||||
}
|
||||
|
||||
if host := c.Request().Header.Get("X-Forwarded-Host"); host != "" {
|
||||
c.Request().URL.Host = host
|
||||
}
|
||||
|
||||
return next(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// HTTPSProtectionMiddleware provides HTTPS protection for production
|
||||
func HTTPSProtectionMiddleware(enableRedirect bool, httpsPort string) []echo.MiddlewareFunc {
|
||||
return []echo.MiddlewareFunc{
|
||||
SSLProxyMiddleware(),
|
||||
SecurityHeadersMiddleware(),
|
||||
HTTPSRedirectMiddleware(httpsPort),
|
||||
}
|
||||
}
|
||||
|
||||
// CORSSecurityConfig configures CORS with security best practices
|
||||
type CORSSecurityConfig struct {
|
||||
AllowedOrigins []string
|
||||
AllowedMethods []string
|
||||
AllowedHeaders []string
|
||||
ExposedHeaders []string
|
||||
AllowCredentials bool
|
||||
MaxAge int
|
||||
}
|
||||
|
||||
// NewSecureCORSConfig creates production-ready CORS config
|
||||
func NewSecureCORSConfig() CORSSecurityConfig {
|
||||
return CORSSecurityConfig{
|
||||
AllowedOrigins: []string{
|
||||
"https://bookhoard.example.com",
|
||||
"https://*.bookhoard.example.com",
|
||||
},
|
||||
AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
|
||||
AllowedHeaders: []string{
|
||||
"Accept",
|
||||
"Authorization",
|
||||
"Content-Type",
|
||||
"X-Request-ID",
|
||||
"X-Timestamp",
|
||||
"X-Signature",
|
||||
"X-Device-ID",
|
||||
},
|
||||
ExposedHeaders: []string{
|
||||
"X-Request-ID",
|
||||
"X-Sync-Status",
|
||||
"X-Conflict-Detected",
|
||||
},
|
||||
AllowCredentials: true,
|
||||
MaxAge: 86400, // 24 hours
|
||||
}
|
||||
}
|
||||
|
||||
// SecureCORSMiddleware creates CORS middleware with security
|
||||
func SecureCORSMiddleware(config CORSSecurityConfig) echo.MiddlewareFunc {
|
||||
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
||||
return func(c *echo.Context) error {
|
||||
origin := c.Request().Header.Get("Origin")
|
||||
|
||||
// Check if origin is allowed
|
||||
allowed := false
|
||||
for _, allowedOrigin := range config.AllowedOrigins {
|
||||
if origin == allowedOrigin || allowedOrigin == "*" {
|
||||
allowed = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !allowed {
|
||||
return c.JSON(http.StatusForbidden, map[string]string{
|
||||
"error": "Origin not allowed",
|
||||
})
|
||||
}
|
||||
|
||||
// Set CORS headers
|
||||
c.Response().Header().Set("Access-Control-Allow-Origin", origin)
|
||||
c.Response().Header().Set("Access-Control-Allow-Methods", strings.Join(config.AllowedMethods, ", "))
|
||||
c.Response().Header().Set("Access-Control-Allow-Headers", strings.Join(config.AllowedHeaders, ", "))
|
||||
c.Response().Header().Set("Access-Control-Expose-Headers", strings.Join(config.ExposedHeaders, ", "))
|
||||
c.Response().Header().Set("Access-Control-Allow-Credentials", "true")
|
||||
c.Response().Header().Set("Access-Control-Max-Age", strconv.Itoa(config.MaxAge))
|
||||
|
||||
// Handle preflight
|
||||
if c.Request().Method == "OPTIONS" {
|
||||
return c.NoContent(http.StatusNoContent)
|
||||
}
|
||||
|
||||
return next(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user