rar-autopass

romfast/rar-autopass

Fork 0

Commit Graph

Author	SHA1	Message	Date
Claude Agent	c842e3352a	feat(5.6): observabilitate + jurnal aplicatie + lifecycle trimiteri blocate Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe: Lifecycle trimiteri blocate (Val A): - submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare) - reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete (JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true` - retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat la reactivare/requeue - API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil Observabilitate: - app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces, redactare creds/PII la scriere (redact_pii/vin_partial) - request_id middleware + X-Request-ID pe toate raspunsurile - handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal) - audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii) - tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z - rar_error expus in GET /v1/prezentari/{id} (recovery observabil) pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 18:45:39 +00:00
Claude Agent	c17c1aa4f4	feat(securitate-CORE): redactare creds + auth API-key per cont Redactare: - handler RequestValidationError dropeaza input/ctx din 422 (vectorul de scurgere a rar_credentials.password pe /v1/prezentari); pastreaza type/loc/msg - app/security.py: scrub/scrub_text + CredentialRedactingFilter pe root+uvicorn - models.py: password cu repr=False Auth API-key: - app/auth.py: hash SHA-256 in api_keys (cheia in clar emisa o singura data), header X-API-Key / Authorization: Bearer, dependency resolve_account_id - enforcement pe flag AUTOPASS_require_api_key (prod on->401, dev off->cont default id=1; cheie prezenta invalida->401 mereu) - account_id real curge din cheie in ingestie + mapare - tools/apikey.py: CLI create/rotate/revoke/list (fara endpoint HTTP admin) 16 teste noi (tests/test_security.py). 85 pass total. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-15 20:02:07 +00:00

Author

SHA1

Message

Date

Claude Agent

c842e3352a

feat(5.6): observabilitate + jurnal aplicatie + lifecycle trimiteri blocate

Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe:

Lifecycle trimiteri blocate (Val A):
- submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare)
- reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in
  submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete
  (JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true`
- retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat
  la reactivare/requeue
- API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil

Observabilitate:
- app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces,
  redactare creds/PII la scriere (redact_pii/vin_partial)
- request_id middleware + X-Request-ID pe toate raspunsurile
- handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal)
- audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii)
- tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z
- rar_error expus in GET /v1/prezentari/{id} (recovery observabil)

pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-23 18:45:39 +00:00

Claude Agent

c17c1aa4f4

feat(securitate-CORE): redactare creds + auth API-key per cont

Redactare:
- handler RequestValidationError dropeaza input/ctx din 422 (vectorul de
  scurgere a rar_credentials.password pe /v1/prezentari); pastreaza type/loc/msg
- app/security.py: scrub/scrub_text + CredentialRedactingFilter pe root+uvicorn
- models.py: password cu repr=False

Auth API-key:
- app/auth.py: hash SHA-256 in api_keys (cheia in clar emisa o singura data),
  header X-API-Key / Authorization: Bearer, dependency resolve_account_id
- enforcement pe flag AUTOPASS_require_api_key (prod on->401, dev off->cont
  default id=1; cheie prezenta invalida->401 mereu)
- account_id real curge din cheie in ingestie + mapare
- tools/apikey.py: CLI create/rotate/revoke/list (fara endpoint HTTP admin)

16 teste noi (tests/test_security.py). 85 pass total.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-15 20:02:07 +00:00

2 Commits