Codex
348 lines
13 KiB
PowerShell
348 lines
13 KiB
PowerShell
param(
|
|
[string]$ServerHost = "192.168.3.90",
|
|
[string]$BackendBaseUrl = "http://192.168.3.90:8001",
|
|
[string]$FrontendBaseUrl = "http://192.168.3.90:3003",
|
|
[string]$SshUser = "root",
|
|
[string]$SshKeyPath = "$HOME\.ssh\water_audit_ed25519",
|
|
[string]$RemoteProjectPath = "/opt/ai-contract-platform",
|
|
[string]$ComposeFile = "docker-compose.server.yml",
|
|
[string]$ArtifactRoot = "",
|
|
[string]$AdminAccount = "admin@example.com",
|
|
[string]$DefaultPassword = "123456"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
|
|
$timestamp = Get-Date -Format "yyyy-MM-ddTHH-mm-ss"
|
|
$safeStamp = $timestamp -replace '[^0-9A-Za-z]', '_'
|
|
if ([string]::IsNullOrWhiteSpace($ArtifactRoot)) {
|
|
$ArtifactRoot = Join-Path $repoRoot "project-docs\qa-artifacts\phase5-security-baseline"
|
|
}
|
|
if (-not [System.IO.Path]::IsPathRooted($ArtifactRoot)) {
|
|
$ArtifactRoot = Join-Path $repoRoot $ArtifactRoot
|
|
}
|
|
$artifactDir = Join-Path $ArtifactRoot $timestamp
|
|
$summaryJson = Join-Path $artifactDir "security-baseline-summary.json"
|
|
$summaryMd = Join-Path $artifactDir "security-baseline-summary.md"
|
|
|
|
New-Item -ItemType Directory -Force -Path $artifactDir | Out-Null
|
|
|
|
if (-not (Test-Path "$HOME\.Codex\skills\gstack\bin")) {
|
|
throw "gstack is required for all AI-assisted work in this repo."
|
|
}
|
|
if (-not (Test-Path $SshKeyPath)) {
|
|
throw "SSH key not found: $SshKeyPath"
|
|
}
|
|
|
|
Add-Type -AssemblyName System.Net.Http
|
|
|
|
$checks = New-Object System.Collections.Generic.List[object]
|
|
|
|
function Add-Check {
|
|
param(
|
|
[string]$Key,
|
|
[string]$Label,
|
|
[ValidateSet("pass", "fail", "warn")]
|
|
[string]$Status,
|
|
[string]$Detail,
|
|
[bool]$Required = $true,
|
|
[hashtable]$Meta = @{}
|
|
)
|
|
|
|
$checks.Add([ordered]@{
|
|
key = $Key
|
|
label = $Label
|
|
status = $Status
|
|
required = $Required
|
|
detail = $Detail
|
|
meta = $Meta
|
|
}) | Out-Null
|
|
}
|
|
|
|
function Save-Json {
|
|
param(
|
|
[string]$Path,
|
|
[object]$Value
|
|
)
|
|
$Value | ConvertTo-Json -Depth 12 | Set-Content -Encoding UTF8 -Path $Path
|
|
}
|
|
|
|
function Invoke-HttpProbe {
|
|
param(
|
|
[string]$Method,
|
|
[string]$Url,
|
|
[object]$Body = $null,
|
|
[hashtable]$Headers = @{}
|
|
)
|
|
|
|
$handler = New-Object System.Net.Http.HttpClientHandler
|
|
$client = New-Object System.Net.Http.HttpClient($handler)
|
|
$client.Timeout = [TimeSpan]::FromSeconds(15)
|
|
try {
|
|
$httpMethod = New-Object System.Net.Http.HttpMethod($Method)
|
|
$request = New-Object System.Net.Http.HttpRequestMessage($httpMethod, $Url)
|
|
foreach ($key in $Headers.Keys) {
|
|
$request.Headers.TryAddWithoutValidation($key, [string]$Headers[$key]) | Out-Null
|
|
}
|
|
if ($null -ne $Body) {
|
|
$json = $Body | ConvertTo-Json -Depth 8 -Compress
|
|
$request.Content = New-Object System.Net.Http.StringContent($json, [System.Text.Encoding]::UTF8, "application/json")
|
|
}
|
|
|
|
$response = $client.SendAsync($request).GetAwaiter().GetResult()
|
|
$text = $response.Content.ReadAsStringAsync().GetAwaiter().GetResult()
|
|
$parsed = $null
|
|
if (-not [string]::IsNullOrWhiteSpace($text)) {
|
|
try {
|
|
$parsed = $text | ConvertFrom-Json -ErrorAction Stop
|
|
} catch {
|
|
$parsed = $null
|
|
}
|
|
}
|
|
|
|
return [ordered]@{
|
|
ok = $true
|
|
url = $Url
|
|
method = $Method
|
|
status_code = [int]$response.StatusCode
|
|
body = $parsed
|
|
body_text = if ($parsed) { $null } else { $text }
|
|
}
|
|
} catch {
|
|
return [ordered]@{
|
|
ok = $false
|
|
url = $Url
|
|
method = $Method
|
|
status_code = $null
|
|
error = $_.Exception.Message
|
|
}
|
|
} finally {
|
|
$client.Dispose()
|
|
$handler.Dispose()
|
|
}
|
|
}
|
|
|
|
function Invoke-Remote {
|
|
param(
|
|
[string]$Name,
|
|
[string]$Command
|
|
)
|
|
|
|
$target = "${SshUser}@${ServerHost}"
|
|
$logPath = Join-Path $artifactDir "$Name.log"
|
|
$args = @(
|
|
"-i", $SshKeyPath,
|
|
"-o", "BatchMode=yes",
|
|
"-o", "StrictHostKeyChecking=accept-new",
|
|
"-o", "ConnectTimeout=10",
|
|
$target,
|
|
$Command
|
|
)
|
|
$previousErrorActionPreference = $ErrorActionPreference
|
|
$ErrorActionPreference = "Continue"
|
|
try {
|
|
$output = & ssh @args 2>&1
|
|
$exitCode = $LASTEXITCODE
|
|
} finally {
|
|
$ErrorActionPreference = $previousErrorActionPreference
|
|
}
|
|
$outputText = ($output -join [Environment]::NewLine)
|
|
$outputText | Set-Content -Encoding UTF8 -Path $logPath
|
|
return [ordered]@{
|
|
exit_code = $exitCode
|
|
output = $outputText
|
|
log = $logPath
|
|
}
|
|
}
|
|
|
|
function Test-TcpPort {
|
|
param(
|
|
[string]$HostName,
|
|
[int]$Port,
|
|
[int]$TimeoutMs = 3000
|
|
)
|
|
|
|
$client = New-Object System.Net.Sockets.TcpClient
|
|
try {
|
|
$async = $client.BeginConnect($HostName, $Port, $null, $null)
|
|
$connected = $async.AsyncWaitHandle.WaitOne($TimeoutMs, $false)
|
|
if (-not $connected) {
|
|
return $false
|
|
}
|
|
$client.EndConnect($async)
|
|
return $client.Connected
|
|
} catch {
|
|
return $false
|
|
} finally {
|
|
$client.Close()
|
|
}
|
|
}
|
|
|
|
$readinessPath = Join-Path $artifactDir "readiness.json"
|
|
$readiness = Invoke-HttpProbe -Method "GET" -Url "$BackendBaseUrl/api/v1/system/readiness"
|
|
Save-Json -Path $readinessPath -Value $readiness
|
|
$readinessData = $readiness.body.data
|
|
$passwordRotated = $false
|
|
if ($readinessData -and $readinessData.pilot_assets -and $readinessData.pilot_assets.default_admin) {
|
|
$passwordRotated = [bool]$readinessData.pilot_assets.default_admin.password_rotated
|
|
}
|
|
$warnings = if ($readinessData -and $readinessData.summary) { [int]$readinessData.summary.warnings } else { -1 }
|
|
if ($readiness.ok -and $readiness.status_code -eq 200 -and $readiness.body.code -eq 0 -and $readinessData.status -eq "ready" -and $warnings -eq 0 -and $passwordRotated) {
|
|
Add-Check -Key "readiness_gate" -Label "readiness security gate" -Status "pass" -Detail "readiness=ready, warnings=0, password_rotated=true" -Meta @{ artifact = $readinessPath }
|
|
} else {
|
|
Add-Check -Key "readiness_gate" -Label "readiness security gate" -Status "fail" -Detail "readiness security gate failed" -Meta @{
|
|
readiness_status = $readinessData.status
|
|
warnings = $warnings
|
|
password_rotated = $passwordRotated
|
|
artifact = $readinessPath
|
|
}
|
|
}
|
|
|
|
$secretCommand = "cd '$RemoteProjectPath'; s=`$(docker compose -f '$ComposeFile' exec -T backend printenv SECRET_KEY | tr -d '\r'); if [ -n `"`$s`" ] && [ `"`$s`" != 'change-me' ] && [ `"`$s`" != 'change-me-in-production' ] && [ `${#s} -ge 32 ]; then echo SECRET_KEY_OK; else echo SECRET_KEY_WEAK; fi"
|
|
$secretCheck = Invoke-Remote -Name "secret-key-check" -Command $secretCommand
|
|
if ($secretCheck.exit_code -eq 0 -and $secretCheck.output -match "SECRET_KEY_OK") {
|
|
Add-Check -Key "secret_key" -Label "production SECRET_KEY" -Status "pass" -Detail "Production SECRET_KEY is non-default and length >= 32" -Meta @{ log = $secretCheck.log }
|
|
} else {
|
|
Add-Check -Key "secret_key" -Label "production SECRET_KEY" -Status "fail" -Detail "Production SECRET_KEY is missing, weak or default-like" -Meta @{ log = $secretCheck.log }
|
|
}
|
|
|
|
$defaultLoginPath = Join-Path $artifactDir "default-password-login.json"
|
|
$defaultLogin = Invoke-HttpProbe -Method "POST" -Url "$BackendBaseUrl/api/v1/auth/login" -Body @{
|
|
account = $AdminAccount
|
|
password = $DefaultPassword
|
|
}
|
|
Save-Json -Path $defaultLoginPath -Value $defaultLogin
|
|
if ($defaultLogin.ok -and $defaultLogin.status_code -eq 401) {
|
|
Add-Check -Key "default_password_rejected" -Label "default password rejected" -Status "pass" -Detail "Default admin password login returned 401" -Meta @{ artifact = $defaultLoginPath }
|
|
} else {
|
|
Add-Check -Key "default_password_rejected" -Label "default password rejected" -Status "fail" -Detail "Default admin password was not clearly rejected" -Meta @{
|
|
status_code = $defaultLogin.status_code
|
|
artifact = $defaultLoginPath
|
|
}
|
|
}
|
|
|
|
$memberName = "phase5-security-$safeStamp@example.com"
|
|
$memberPassword = "Member123456!"
|
|
$register = Invoke-HttpProbe -Method "POST" -Url "$BackendBaseUrl/api/v1/auth/register" -Body @{
|
|
username = $memberName
|
|
password = $memberPassword
|
|
display_name = "Phase5 Security Member"
|
|
}
|
|
$login = Invoke-HttpProbe -Method "POST" -Url "$BackendBaseUrl/api/v1/auth/login" -Body @{
|
|
account = $memberName
|
|
password = $memberPassword
|
|
}
|
|
$permissionPath = Join-Path $artifactDir "member-permission.json"
|
|
Save-Json -Path $permissionPath -Value ([ordered]@{ register = $register; login = $login })
|
|
$token = $null
|
|
if ($login.body -and $login.body.code -eq 0) {
|
|
$token = $login.body.data.access_token
|
|
}
|
|
if ($token) {
|
|
$forbidden = Invoke-HttpProbe -Method "GET" -Url "$BackendBaseUrl/api/v1/users?page=1&page_size=1" -Headers @{
|
|
Authorization = "Bearer $token"
|
|
}
|
|
Save-Json -Path $permissionPath -Value ([ordered]@{ register = $register; login = $login; forbidden = $forbidden })
|
|
if ($forbidden.status_code -eq 403) {
|
|
Add-Check -Key "member_permission_boundary" -Label "member permission boundary" -Status "pass" -Detail "member cannot access admin users API" -Meta @{ artifact = $permissionPath }
|
|
} else {
|
|
Add-Check -Key "member_permission_boundary" -Label "member permission boundary" -Status "fail" -Detail "member users API access was not rejected with 403" -Meta @{
|
|
status_code = $forbidden.status_code
|
|
artifact = $permissionPath
|
|
}
|
|
}
|
|
} else {
|
|
Add-Check -Key "member_permission_boundary" -Label "member permission boundary" -Status "fail" -Detail "member registration or login failed" -Meta @{ artifact = $permissionPath }
|
|
}
|
|
|
|
$backendOpen = Test-TcpPort -HostName $ServerHost -Port 8001
|
|
$frontendOpen = Test-TcpPort -HostName $ServerHost -Port 3003
|
|
if ($backendOpen -and $frontendOpen) {
|
|
Add-Check -Key "expected_public_ports" -Label "expected public ports" -Status "pass" -Detail "Expected frontend/backend ports are reachable"
|
|
} else {
|
|
Add-Check -Key "expected_public_ports" -Label "expected public ports" -Status "fail" -Detail "Expected frontend/backend ports are not both reachable" -Meta @{
|
|
backend_8001 = $backendOpen
|
|
frontend_3003 = $frontendOpen
|
|
}
|
|
}
|
|
|
|
$trackedSensitivePath = Join-Path $artifactDir "tracked-sensitive-files.txt"
|
|
$trackedSensitive = git -C $repoRoot ls-files | Select-String -Pattern '(^|/)(\.env|id_rsa|id_ed25519|.*\.pem|.*\.key)$' -ErrorAction SilentlyContinue
|
|
if ($trackedSensitive) {
|
|
($trackedSensitive | ForEach-Object { $_.Line }) | Set-Content -Encoding UTF8 -Path $trackedSensitivePath
|
|
} else {
|
|
"" | Set-Content -Encoding UTF8 -Path $trackedSensitivePath
|
|
}
|
|
if ($trackedSensitive) {
|
|
Add-Check -Key "tracked_sensitive_files" -Label "tracked sensitive files" -Status "fail" -Detail "Git tracks sensitive-looking files" -Meta @{ artifact = $trackedSensitivePath }
|
|
} else {
|
|
Add-Check -Key "tracked_sensitive_files" -Label "tracked sensitive files" -Status "pass" -Detail "No tracked .env/private-key-like files found" -Meta @{ artifact = $trackedSensitivePath }
|
|
}
|
|
|
|
$secretScanPath = Join-Path $artifactDir "source-secret-scan.txt"
|
|
$secretPatterns = @(
|
|
"BEGIN (RSA|OPENSSH|PRIVATE) KEY",
|
|
("z" + "mfCSR"),
|
|
("AI_CONTRACT_ADMIN_PASSWORD" + "[[:space:]]*=")
|
|
)
|
|
$secretRegex = $secretPatterns -join "|"
|
|
$secretScan = git -C $repoRoot grep -n -I -E $secretRegex -- backend frontend scripts docker-compose.server.yml 2>$null
|
|
if ($secretScan) {
|
|
($secretScan | ForEach-Object { $_ }) | Set-Content -Encoding UTF8 -Path $secretScanPath
|
|
} else {
|
|
"" | Set-Content -Encoding UTF8 -Path $secretScanPath
|
|
}
|
|
if ($secretScan) {
|
|
Add-Check -Key "source_secret_scan" -Label "source secret scan" -Status "fail" -Detail "Potential hardcoded secret pattern found in source/config" -Meta @{ artifact = $secretScanPath }
|
|
} else {
|
|
Add-Check -Key "source_secret_scan" -Label "source secret scan" -Status "pass" -Detail "No configured high-signal secret patterns found" -Meta @{ artifact = $secretScanPath }
|
|
}
|
|
|
|
$failedRequired = @($checks | Where-Object { $_.required -and $_.status -eq "fail" })
|
|
$warningsList = @($checks | Where-Object { $_.status -eq "warn" })
|
|
$overallStatus = if ($failedRequired.Count -gt 0) { "FAIL" } elseif ($warningsList.Count -gt 0) { "WARN" } else { "PASS" }
|
|
|
|
$summary = [ordered]@{
|
|
name = "phase5-security-baseline"
|
|
status = $overallStatus
|
|
generated_at = (Get-Date).ToUniversalTime().ToString("o")
|
|
artifact_dir = $artifactDir
|
|
checks = $checks
|
|
totals = [ordered]@{
|
|
total = $checks.Count
|
|
failed_required = $failedRequired.Count
|
|
warnings = $warningsList.Count
|
|
}
|
|
}
|
|
Save-Json -Path $summaryJson -Value $summary
|
|
|
|
$markdown = New-Object System.Collections.Generic.List[string]
|
|
$markdown.Add("# Phase 5 Security Baseline") | Out-Null
|
|
$markdown.Add("") | Out-Null
|
|
$markdown.Add("- Status: $overallStatus") | Out-Null
|
|
$markdown.Add("- Generated at: $($summary.generated_at)") | Out-Null
|
|
$markdown.Add("- Artifact dir: $artifactDir") | Out-Null
|
|
$markdown.Add("") | Out-Null
|
|
$markdown.Add("| Check | Required | Status | Detail |") | Out-Null
|
|
$markdown.Add("|---|---:|---|---|") | Out-Null
|
|
foreach ($check in $checks) {
|
|
$markdown.Add("| $($check.label) | $($check.required) | $($check.status.ToUpperInvariant()) | $($check.detail) |") | Out-Null
|
|
}
|
|
$markdown.Add("") | Out-Null
|
|
$markdown.Add("Local artifacts:") | Out-Null
|
|
$markdown.Add("") | Out-Null
|
|
$markdown.Add('- `security-baseline-summary.json`') | Out-Null
|
|
$markdown.Add('- `readiness.json`') | Out-Null
|
|
$markdown.Add('- `default-password-login.json`') | Out-Null
|
|
$markdown.Add('- `member-permission.json`') | Out-Null
|
|
$markdown.Add('- `tracked-sensitive-files.txt`') | Out-Null
|
|
$markdown.Add('- `source-secret-scan.txt`') | Out-Null
|
|
$markdown.Add('- `*.log`') | Out-Null
|
|
$markdown | Set-Content -Encoding UTF8 -Path $summaryMd
|
|
|
|
Write-Host "PHASE5_SECURITY_BASELINE_$overallStatus $artifactDir"
|
|
if ($overallStatus -eq "FAIL") {
|
|
throw "Phase 5 security baseline failed. See $summaryMd"
|
|
}
|