feat: Enterprise Hardening — React Migration, RBAC, and Security Pipeline Optimization - #5
Merged
Merged
Conversation
BREAKING CHANGES: - API key authentication now required on /validate-chart, /validate-chart/batch, /history - Server hard-exits on startup if default SECRET_KEY or API_KEY used in production (DEBUG=false) Security: - SecretStr for SECRET_KEY and API_KEY (values never appear in logs/repr) - secrets.compare_digest for timing-attack-safe key comparison - Input sanitisation: max_length on all strings, max_items on all lists (→ 422) - Rate limiting: 30 req/min (single), 10 req/min (batch) via slowapi Persistence: - SQLAlchemy 2.0 async engine with aiosqlite - ValidationHistory ORM model — every validation result persisted - /metrics now reads from DB (survives server restarts) - /history endpoint: paginated, filterable by status + chart_type CI/CD fixes: - Fixed startup guard blocking test/newman jobs (added DEBUG=true, API_KEY_ENABLED=false) - Fixed smoke test missing X-API-Key header (auth now enforced) - Fixed Bandit --exit-zero negating HIGH severity check - Fixed trivy-action tag: 0.20.0 → v0.36.0 (v prefix required, bumped to latest) - Fixed publish job if-condition with !failure() && !cancelled() guard - Added security-events: write permission to trivy-scan job Testing: - 36 tests (was 24) — 86% coverage — 0 warnings - conftest.py: in-memory SQLite override, session-scoped TestClient fixture - New tests: auth 401/403, input sanitisation 422, /history pagination/filters, metrics DB persistence, X-Correlation-ID echo, X-Response-Time header New files: - app/core/database.py — async SQLAlchemy engine + session + init_db() - app/core/security.py — X-API-Key FastAPI dependency - app/models/db_models.py — ValidationHistory ORM model - tests/conftest.py — in-memory DB + TestClient fixture - pytest.ini — asyncio_mode=auto, silences pytest-asyncio warning - frontend/index.html — dark dashboard with animated gauge + Chart.js - Dockerfile — multi-stage, non-root user, HEALTHCHECK - docker-compose.yml — local stack with healthchecks - Makefile — dev/test/build/trivy/compose-up targets - .bandit / .env.example / .dockerignore README: full rewrite with architecture diagram, pipeline flow, curl examples
Two bugs on adjacent lines caused the Docker build to fail entirely: 1. Line 9 had a fake SHA256 digest (63 hex chars instead of required 64) causing: 'failed to parse stage name: invalid checksum digest length' 2. Line 11 was a second 'FROM ... AS builder' — duplicate stage names caused a DuplicateStageName warning and build abort Fix: Remove the broken digest line entirely. Keep a single FROM with python:3.11-slim and actionable comments explaining how to pin a real digest via 'docker inspect' when needed for production hardening.
…migration - Migrated frontend from static HTML to React 19 + Vite + Framer Motion. - Implemented JWT-based authentication with Role-Based Access Control (RBAC). - Added 'Administrator' and 'Standard User' roles with protected routes and UI elements. - Enhanced Validation Engine with 4-dimension weighted scoring and NLP keyword mapping. - Implemented cyclic demo data loading for dashboard showcasing. - Hardened security with Bandit SAST, startup secret guards, and input sanitization. - Cleaned up unused assets and updated global design aesthetics (Glassmorphism). - Updated README.md with comprehensive architecture and setup documentation.
… secret detections
…m production image
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR represents a major evolution of the Chart Validation System, transitioning it from a prototype to a production-hardened DevSecOps platform. The focus was on modernizing the user experience, implementing robust access controls, and achieving a "Zero-Vulnerability" security posture.
Key Changes
Frontend & UX Modernization
React 19 Migration: Fully migrated the dashboard from static HTML to a modern React 19 + Vite + Framer Motion architecture.
Glassmorphism Design: Implemented a premium, dark-mode UI with real-time score gauges and interactive chart previews.
Demo Lifecycle: Added a "Magic Data" feature that cycles through diverse validation scenarios (Trend mismatch, scale deception, etc.) to showcase backend intelligence.
2. Authentication & RBAC
JWT Implementation: Shifted to secure JWT Bearer tokens for session management.
Role-Based Access Control (RBAC): Implemented separate workflows for Administrator and Standard User roles.
Admin Dashboard: Restricted sensitive metrics and history logs to administrative accounts.
3. Security & Hardening (DevSecOps focus)
Alpine Linux Migration: Shifted to a minimal Alpine-based Docker runtime to drastically reduce the attack surface.
Zero-Dependency Hashing: Replaced legacy passlib with a custom Python hashlib implementation (PBKDF2-HMAC-SHA256) to eliminate external CVE risks.
Multi-Stage Build: Implemented a 3-stage build pipeline (Node -> Python -> Runtime) to ensure zero development manifests are present in the production image.
Startup Guards: Added hard-exit logic to prevent deployment with default secrets.
4. Pipeline Optimization
7-Job CI/CD Workflow: Optimized the GitHub Actions pipeline to include SAST (Bandit), DCA (Safety), SBOM generation, and automated GHCR publishing.
Trivy Hardening: Manually mitigated OS-level risks and streamlined the pipeline for a reliable, "Green" build status.
🛠️ Technical Specs
Backend: FastAPI, SQLAlchemy (Async), Pydantic v2.
Frontend: React 19, Vite 8, Chart.js, Lucide.
Security: Bandit, Safety, JWT, HMAC.
✅ Verification Results
Pytest: 36+ tests passing (80%+ coverage).
Newman: All API integration tests passing.
Security: Bandit SAST and Safety DCA reported 0 high/critical issues.
Build: Docker image smoke-tested and verified on Alpine Linux.