7ba78a31fb
Address the four P0 security items from the project review: * token_version validation (#1): the JWT middleware now rejects access tokens whose token_version claim is stale (e.g. issued before a password change). A short-TTL (30s) in-memory cache (TokenVersionCache) avoids a Mongo lookup per request; credential changes invalidate the cache immediately on the handling instance. * Fail-fast config (#2): add APP_ENVIRONMENT (development|production). In production the server refuses to boot unless JWT_SECRET and ENCRYPTION_KEY are set to non-default values; development keeps the insecure defaults with a warning. * Real client IP in audit logs (#4): new client_ip middleware resolves the originating IP (X-Forwarded-For > X-Real-IP > ConnectInfo socket) and exposes it via a ClientIp extractor. All five hardcoded "0.0.0.0" audit calls are replaced, and the missing PasswordChanged audit event is added to change_password. axum::serve now uses into_make_service_with_connect_info. * Refresh token persistence (#5): refresh tokens are now stored hashed in MongoDB (RefreshTokenRepository) instead of an in-memory map lost on restart. Added /api/auth/refresh (with rotation + token_version check) and /api/auth/logout routes; register/login return a refresh_token; password change/recovery revoke all of a user's refresh tokens. JwtService now honors JwtConfig expiries instead of hardcoding 15min/30d, and the dead in-memory refresh store is removed. Also: wire up DatabaseInitializer (was never called), fix the refresh_tokens index to tokenHash + add an expiresAt TTL index, add sha2 dep. Rate limiting (#3) is deferred per scope; the stub remains. Verified: cargo fmt --check clean, cargo build/clippy --all-targets clean, 18 unit tests pass (9 new). Integration tests (tests/*) still need a live server — fixing them is tracked as P1. BREAKING CHANGE: AuthResponse now includes a refresh_token field.
33 lines
983 B
TOML
33 lines
983 B
TOML
[package]
|
|
name = "normogen-backend"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[dependencies]
|
|
axum = "0.7.9"
|
|
tokio = { version = "1.41.1", features = ["full"] }
|
|
tower = "0.4.13"
|
|
tower-http = { version = "0.5.2", features = ["cors", "trace"] }
|
|
tower_governor = "0.4.3"
|
|
serde = { version = "1.0.215", features = ["derive"] }
|
|
serde_json = "1.0.133"
|
|
mongodb = "2.8.2"
|
|
jsonwebtoken = "9.3.1"
|
|
chrono = { version = "0.4.38", features = ["serde"] }
|
|
dotenv = "0.15.0"
|
|
validator = { version = "0.16.1", features = ["derive"] }
|
|
uuid = { version = "1.11.0", features = ["v4", "serde"] }
|
|
reqwest = { version = "0.12.28", features = ["json"] }
|
|
pbkdf2 = { version = "0.12.2", features = ["simple"] }
|
|
password-hash = "0.5.0"
|
|
rand = "0.8.5"
|
|
base64 = "0.22.1"
|
|
sha2 = "0.10"
|
|
thiserror = "1.0.69"
|
|
anyhow = "1.0.94"
|
|
tracing = "0.1.41"
|
|
tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
|
|
slog = "2.7.0"
|
|
strum = { version = "0.26", features = ["derive"] }
|
|
strum_macros = "0.26"
|
|
futures = "0.3"
|