chaim
0340a670ed
Implements the fixes catalogued under Task Master tasks 1-19, derived from the security audit at .claude/plans/adaptive-sleeping-diffie.md. Critical - C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing userinfo or non-default ports, and asserts netloc == hostname. - C-2 No authentication: optional NADLAN_API_KEY gate guards /api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS is wired up. Default behavior unchanged when env unset. High - H-1 Error info leak: HTTPException details replaced with generic string; full exceptions still logged via logger.exception. - H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, CSP, server-banner stripped. - H-3 Swagger gated: /api/docs and /api/openapi.json hidden when ENVIRONMENT=production. - H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above 50MB Content-Length, also rejects mid-stream overrun. Magic-byte check moved before StreamingResponse so we can 502 cleanly. - H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp, /api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for client IP behind Traefik. Medium - M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds. - M-2 Deal model: extra="ignore" + explicit fields for gushNum, parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source, deal_type, deal_type_description, distance_meters. Frontend now reads snake_case. - M-3 Input validators: regex on block, plot, appraiser names, dates, address, free-text — Hebrew + Latin + safe punctuation. - M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions secret. - M-5 Base images pinned to sha256 digests. - M-6 Runtime deps tightened to ~= compatible-release. - M-7 1MB request-body size limit middleware. Low / privacy - L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links and CSP entries. Added meta referrer + meta robots noindex. - L-2 Cache-Control: immutable for /assets, no-cache for HTML. - L-3 Logger no longer prints user-supplied addresses; emits length only. - L-4 Dockerfile healthcheck uses literal port 8000. - L-5 PDF proxy stream cleanup uses contextlib.suppress. Tests: 331 passed, 17 skipped. Frontend typecheck passes. Findings file: .claude/plans/adaptive-sleeping-diffie.md Tasks: .taskmaster/tasks/tasks.json Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
327 lines
4.3 KiB
Plaintext
327 lines
4.3 KiB
Plaintext
# Logs
|
|
logs
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
lerna-debug.log*
|
|
|
|
# Diagnostic reports (https://nodejs.org/api/report.html)
|
|
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
|
|
|
|
# Runtime data
|
|
pids
|
|
*.pid
|
|
*.seed
|
|
*.pid.lock
|
|
|
|
# Directory for instrumented libs generated by jscoverage/JSCover
|
|
lib-cov
|
|
|
|
# Coverage directory used by tools like istanbul
|
|
coverage
|
|
*.lcov
|
|
|
|
# nyc test coverage
|
|
.nyc_output
|
|
|
|
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
|
|
.grunt
|
|
|
|
# Bower dependency directory (https://bower.io/)
|
|
bower_components
|
|
|
|
# node-waf configuration
|
|
.lock-wscript
|
|
|
|
# Compiled binary addons (https://nodejs.org/api/addons.html)
|
|
build/Release
|
|
|
|
# Dependency directories
|
|
node_modules/
|
|
jspm_packages/
|
|
|
|
# Snowpack dependency directory (https://snowpack.dev/)
|
|
web_modules/
|
|
|
|
# TypeScript cache
|
|
*.tsbuildinfo
|
|
|
|
# Optional npm cache directory
|
|
.npm
|
|
|
|
# Optional eslint cache
|
|
.eslintcache
|
|
|
|
# Optional stylelint cache
|
|
.stylelintcache
|
|
|
|
# Optional REPL history
|
|
.node_repl_history
|
|
|
|
# Output of 'npm pack'
|
|
*.tgz
|
|
|
|
# Yarn Integrity file
|
|
.yarn-integrity
|
|
|
|
# dotenv environment variable files
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# parcel-bundler cache (https://parceljs.org/)
|
|
.cache
|
|
.parcel-cache
|
|
|
|
# Next.js build output
|
|
.next
|
|
out
|
|
|
|
# Nuxt.js build / generate output
|
|
.nuxt
|
|
dist
|
|
|
|
# Gatsby files
|
|
.cache/
|
|
# Comment in the public line in if your project uses Gatsby and not Next.js
|
|
# https://nextjs.org/blog/next-9-1#public-directory-support
|
|
# public
|
|
|
|
# vuepress build output
|
|
.vuepress/dist
|
|
|
|
# vuepress v2.x temp and cache directory
|
|
.temp
|
|
.cache
|
|
|
|
# Sveltekit cache directory
|
|
.svelte-kit/
|
|
|
|
# vitepress build output
|
|
**/.vitepress/dist
|
|
|
|
# vitepress cache directory
|
|
**/.vitepress/cache
|
|
|
|
# Docusaurus cache and generated files
|
|
.docusaurus
|
|
|
|
# Serverless directories
|
|
.serverless/
|
|
|
|
# FuseBox cache
|
|
.fusebox/
|
|
|
|
# DynamoDB Local files
|
|
.dynamodb/
|
|
|
|
# Firebase cache directory
|
|
.firebase/
|
|
|
|
# TernJS port file
|
|
.tern-port
|
|
|
|
# Stores VSCode versions used for testing VSCode extensions
|
|
.vscode-test
|
|
|
|
# yarn v3
|
|
.pnp.*
|
|
.yarn/*
|
|
!.yarn/patches
|
|
!.yarn/plugins
|
|
!.yarn/releases
|
|
!.yarn/sdks
|
|
!.yarn/versions
|
|
|
|
# Vite logs files
|
|
vite.config.js.timestamp-*
|
|
vite.config.ts.timestamp-*
|
|
|
|
# Byte-compiled / optimized / DLL files
|
|
__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
|
|
# C extensions
|
|
*.so
|
|
|
|
# Distribution / packaging
|
|
.Python
|
|
build/
|
|
develop-eggs/
|
|
dist/
|
|
downloads/
|
|
eggs/
|
|
.eggs/
|
|
/lib/
|
|
/lib64/
|
|
parts/
|
|
sdist/
|
|
var/
|
|
wheels/
|
|
pip-wheel-metadata/
|
|
share/python-wheels/
|
|
*.egg-info/
|
|
.installed.cfg
|
|
*.egg
|
|
MANIFEST
|
|
|
|
# Virtual environments
|
|
venv/
|
|
ENV/
|
|
env/
|
|
.venv/
|
|
env.bak/
|
|
venv.bak/
|
|
|
|
# PyInstaller
|
|
# Usually these files are written by a python script from a template
|
|
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
|
*.manifest
|
|
*.spec
|
|
|
|
# Installer logs
|
|
pip-log.txt
|
|
pip-delete-this-directory.txt
|
|
|
|
# Unit test / coverage reports
|
|
htmlcov/
|
|
.tox/
|
|
.nox/
|
|
.coverage
|
|
.coverage.*
|
|
.cache
|
|
nosetests.xml
|
|
coverage.xml
|
|
*.cover
|
|
.hypothesis/
|
|
.pytest_cache/
|
|
|
|
# Translations
|
|
*.mo
|
|
*.pot
|
|
|
|
# Django stuff:
|
|
*.log
|
|
local_settings.py
|
|
db.sqlite3
|
|
db.sqlite3-journal
|
|
|
|
# Flask stuff:
|
|
instance/
|
|
.webassets-cache
|
|
|
|
# Scrapy stuff:
|
|
.scrapy
|
|
|
|
# Sphinx documentation
|
|
docs/_build/
|
|
build/
|
|
tmp/
|
|
temp/
|
|
|
|
# PyBuilder
|
|
target/
|
|
|
|
# Jupyter Notebook
|
|
.ipynb_checkpoints
|
|
|
|
# IPython
|
|
profile_default/
|
|
ipython_config.py
|
|
|
|
# pyenv
|
|
.python-version
|
|
|
|
# pipenv
|
|
Pipfile.lock
|
|
|
|
# poetry
|
|
poetry.lock
|
|
poetry.toml
|
|
|
|
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
|
|
__pypackages__/
|
|
|
|
# Celery stuff
|
|
celerybeat-schedule
|
|
celerybeat.pid
|
|
|
|
# SageMath parsed files
|
|
*.sage.py
|
|
|
|
# Environments
|
|
.env
|
|
.env.*
|
|
.envrc
|
|
*.env
|
|
*.env.*
|
|
|
|
# mypy
|
|
.mypy_cache/
|
|
.dmypy.json
|
|
dmypy.json
|
|
|
|
# Pyre type checker
|
|
.pyre/
|
|
|
|
# pytype static type analyzer
|
|
.pytype/
|
|
|
|
# Cython debug symbols
|
|
cython_debug/
|
|
|
|
# VS Code settings
|
|
.vscode/
|
|
|
|
# MacOS
|
|
.DS_Store
|
|
|
|
# System files
|
|
Thumbs.db
|
|
ehthumbs.db
|
|
Desktop.ini
|
|
|
|
# Test output
|
|
test-output/
|
|
tests/__pycache__/
|
|
nadlan_mcp/__pycache__/
|
|
|
|
# Project-specific
|
|
nadlan_mcp/.env
|
|
nadlan_mcp/.env.*
|
|
nadlan_mcp/local_settings.py
|
|
|
|
# Claude Code workspace and local config
|
|
.claude/
|
|
.mcp.json
|
|
|
|
# Phase summaries should stay in .cursor/plans/ only
|
|
PHASE*.md
|
|
|
|
# Archived files (historical reference, not tracked)
|
|
.archive/
|
|
|
|
dev-debug.log
|
|
# Environment variables
|
|
# Editor directories and files
|
|
.idea
|
|
.vscode
|
|
*.suo
|
|
*.ntvs*
|
|
*.njsproj
|
|
*.sln
|
|
*.sw?
|
|
# OS specific
|
|
|
|
# Task files
|
|
# tasks.json
|
|
# tasks/
|
|
|
|
# Task Master config (may contain API keys)
|
|
.taskmaster/config.json
|
|
.taskmaster/state.json
|
|
.taskmaster/reports/
|
|
|