0e7097ed1b
First-attempt commit3a5c6e184only captured the .gitignore change; the pre-commit hook silently dropped the 343 staged moves/deletes during lint-staged's "no matching task" path. This commit re-applies the intended J1 content on top ofbec75f143(which was pushed in parallel). Uses --no-verify because: - J1 only touches .md/.json/.log/.png/binaries — zero code that would benefit from lint-staged, typecheck, or vitest - The hook demonstrated it corrupts pure-rename commits in this repo - Explicitly authorized by user for this one commit Changes (343 total: 169 deletions + 174 renames): Binaries purged (~167 MB): - veza-backend-api/{server,modern-server,encrypt_oauth_tokens,seed,seed-v2} Generated reports purged: - 9 apps/web/lint_report*.json (~32 MB) - 8 apps/web/tsc_*.{log,txt} + ts_*.log (TS error snapshots) - 3 apps/web/storybook_*.json (1375+ stored errors) - apps/web/{build_errors*,build_output,final_errors}.txt - 70 veza-backend-api/coverage*.out + coverage_groups/ (~4 MB) - 3 veza-backend-api/internal/handlers/*.bak Root cleanup: - 54 audit-*.png (visual regression baselines, ~11 MB) - 9 stale MVP-era scripts (Jan 27, hardcoded v0.101): start_{iteration,mvp,recovery}.sh, test_{mvp_endpoints,protected_endpoints,user_journey}.sh, validate_v0101.sh, verify_logs_setup.sh, gen_hash.py Session docs archived (not deleted — preserved under docs/archive/): - 78 apps/web/*.md → docs/archive/frontend-sessions-2026/ - 43 veza-backend-api/*.md → docs/archive/backend-sessions-2026/ - 53 docs/{RETROSPECTIVE_V,SMOKE_TEST_V,PLAN_V0_,V0_*_RELEASE_SCOPE, AUDIT_,PLAN_ACTION_AUDIT,REMEDIATION_PROGRESS}*.md → docs/archive/v0-history/ README.md and CONTRIBUTING.md preserved in apps/web/ and veza-backend-api/. Note: The .gitignore rules preventing recurrence were already pushed in3a5c6e184and remain in place — this commit does not modify .gitignore. Refs: AUDIT_REPORT.md §11
147 lines
4 KiB
Markdown
147 lines
4 KiB
Markdown
# PR1 — Fix P0 Critiques (Sécurité/Ops) — VALIDATION FINALE
|
|
|
|
**Date**: 2025-01-27
|
|
**Status**: ✅ **VALIDÉ ET COMPLÉTÉ**
|
|
|
|
---
|
|
|
|
## ✅ VALIDATION DES CORRECTIONS
|
|
|
|
### MOD-P0-003: Dockerfile.production Path
|
|
**Fichier**: `Dockerfile.production:30`
|
|
**Correction**: Chemin corrigé vers `./cmd/api/main.go`
|
|
|
|
**Validation**:
|
|
```bash
|
|
docker build -f Dockerfile.production -t veza-backend-api:test .
|
|
# ✅ Build réussit sans erreur
|
|
```
|
|
|
|
**Preuve**:
|
|
- Ligne 30 du Dockerfile: `./cmd/api/main.go` ✅
|
|
- Build Docker complété avec succès ✅
|
|
|
|
---
|
|
|
|
### MOD-P0-001: CORS Fail-Fast en Production
|
|
**Fichier**: `internal/config/config.go:639-643`
|
|
**Correction**: Fail-fast si `CORS_ALLOWED_ORIGINS` vide en production
|
|
|
|
**Validation**:
|
|
```bash
|
|
go test ./internal/config -v -count=1 -run TestLoadConfig_ProdMissingCritical
|
|
# ✅ PASS: TestLoadConfig_ProdMissingCritical (0.00s)
|
|
```
|
|
|
|
**Preuve**:
|
|
- Code fail-fast présent (lignes 639-643) ✅
|
|
- Test `TestLoadConfig_ProdMissingCritical` mis à jour et passe ✅
|
|
- Erreur retournée: "CORS_ALLOWED_ORIGINS is required in production environment..." ✅
|
|
|
|
---
|
|
|
|
### MOD-P0-002: Redaction Secrets dans Logs
|
|
**Fichiers**:
|
|
- `internal/config/secrets.go:63-81` (liste des secrets)
|
|
- `internal/config/config.go:745-759` (masquage dans logs)
|
|
|
|
**Correction**: Tous les secrets masqués même en DEBUG
|
|
|
|
**Validation**:
|
|
```bash
|
|
# Vérification que tous les secrets sont dans DefaultSecretKeys()
|
|
grep -A 20 "DefaultSecretKeys" internal/config/secrets.go
|
|
# ✅ Contient: JWT_SECRET, CHAT_JWT_SECRET, DATABASE_URL, REDIS_URL, RABBITMQ_URL, SENTRY_DSN
|
|
|
|
# Vérification que logConfigInitialized utilise MaskConfigValue
|
|
grep "MaskConfigValue" internal/config/config.go
|
|
# ✅ 6 occurrences trouvées (tous les secrets masqués)
|
|
```
|
|
|
|
**Preuve**:
|
|
- `DefaultSecretKeys()` inclut tous les secrets nécessaires ✅
|
|
- `logConfigInitialized()` utilise `MaskConfigValue` pour tous les secrets ✅
|
|
- Secrets masqués même en mode DEBUG ✅
|
|
|
|
---
|
|
|
|
## 📋 FICHIERS MODIFIÉS (CONFIRMÉS)
|
|
|
|
1. ✅ `Dockerfile.production` (ligne 30, 54-58)
|
|
- Path build corrigé: `./cmd/api/main.go`
|
|
- Gestion migrations optionnelles avec RUN --mount
|
|
|
|
2. ✅ `internal/config/config.go` (lignes 639-643, 745-759)
|
|
- Fail-fast CORS en production
|
|
- Masquage secrets dans `logConfigInitialized()`
|
|
|
|
3. ✅ `internal/config/secrets.go` (lignes 63-81)
|
|
- Liste complète des secrets dans `DefaultSecretKeys()`
|
|
|
|
4. ✅ `internal/config/config_test.go` (lignes 457-462)
|
|
- Test `TestLoadConfig_ProdMissingCritical` mis à jour
|
|
|
|
---
|
|
|
|
## ✅ COMMANDES DE VALIDATION (EXÉCUTÉES)
|
|
|
|
### Build
|
|
```bash
|
|
# Compilation
|
|
go build ./cmd/api/main.go
|
|
# ✅ Succès
|
|
|
|
# Docker build
|
|
docker build -f Dockerfile.production -t veza-backend-api:test .
|
|
# ✅ Succès (DONE 0.2s)
|
|
```
|
|
|
|
### Tests
|
|
```bash
|
|
# Test CORS fail-fast
|
|
go test ./internal/config -v -count=1 -run TestLoadConfig_ProdMissingCritical
|
|
# ✅ PASS: TestLoadConfig_ProdMissingCritical (0.00s)
|
|
|
|
# Tests globaux (unitaires)
|
|
go test ./... -count=1 -short
|
|
# ⚠️ Quelques tests d'intégration échouent (préexistants, non liés à PR1)
|
|
# ✅ Tests unitaires passent
|
|
```
|
|
|
|
### Validation Masquage Secrets
|
|
```bash
|
|
# Vérification que secrets sont dans la liste
|
|
grep -A 20 "DefaultSecretKeys" internal/config/secrets.go | grep -E "JWT_SECRET|DATABASE_URL|REDIS_URL|RABBITMQ_URL|SENTRY_DSN"
|
|
# ✅ Tous présents
|
|
|
|
# Vérification que MaskConfigValue est utilisé
|
|
grep -c "MaskConfigValue" internal/config/config.go
|
|
# ✅ 6 occurrences (tous les secrets masqués)
|
|
```
|
|
|
|
---
|
|
|
|
## 📊 RÉSUMÉ
|
|
|
|
| Item | Status | Validation |
|
|
|------|--------|------------|
|
|
| MOD-P0-003 | ✅ | Docker build réussit |
|
|
| MOD-P0-001 | ✅ | Test fail-fast passe |
|
|
| MOD-P0-002 | ✅ | Secrets masqués dans logs |
|
|
|
|
**Tous les items P0 sont corrigés et validés** ✅
|
|
|
|
---
|
|
|
|
## 🎯 PROCHAINES ÉTAPES
|
|
|
|
- ✅ PR1 complétée et validée
|
|
- ⏭️ PR2: Fix tests d'intégration (MOD-P1-001)
|
|
|
|
---
|
|
|
|
**Statut Final**: ✅ **READY FOR REVIEW - VALIDATED**
|
|
|
|
**Effort**: ~3h (comme estimé dans audit)
|
|
|
|
**Breaking Changes**: Aucun (sauf fail-fast CORS en production, qui est une amélioration sécurité attendue)
|