@checkstack/backend 0.4.13 → 0.4.14

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @checkstack/backend
 
+## 0.4.14
+
+### Patch Changes
+
+- 0ebbe56: Security Vulnerability Remediation completed:
+  - Refactored core authorization to Fail-Closed architecture with secure defaults.
+  - Implemented `assertTeamManagementAccess` to resolve BOLA in Teams Management.
+  - Protected internal S2S capabilities via explicit wildcard `serviceScope` definitions.
+  - Disarmed OS Command Injection in DiskCollector via strict regex validation and bash escaping.
+  - Re-architected inline script processing executing scripts in sandboxed Web Worker contexts.
+  - Isolated subprocess environment scopes in PingStrategy limiting variable leakage.
+  - Enforced strict token/API Key parsing with URLSearchParams checking.
+  - Explicitly fail-fast on missing DATABASE_URL configuration across independent backend clusters.
+  - Activated strict HTTP Security Headers (HSTS, CSP, X-Frame-Options) across the API automatically.
+- Updated dependencies [0ebbe56]
+  - @checkstack/auth-common@0.5.6
+  - @checkstack/backend-api@0.8.1
+  - @checkstack/common@0.6.3
+  - @checkstack/queue-api@0.2.6
+  - @checkstack/signal-backend@0.1.12
+  - @checkstack/api-docs-common@0.1.7
+  - @checkstack/signal-common@0.1.7
+
 ## 0.4.13
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "type": "module",
   "scripts": {
     "dev": "bun --env-file=../../.env --watch src/index.ts",
@@ -12,11 +12,11 @@
   "dependencies": {
     "@checkstack/api-docs-common": "0.1.6",
     "@checkstack/auth-common": "0.5.5",
-    "@checkstack/backend-api": "0.7.0",
+    "@checkstack/backend-api": "0.8.0",
     "@checkstack/common": "0.6.2",
     "@checkstack/drizzle-helper": "0.0.3",
-    "@checkstack/queue-api": "0.2.4",
-    "@checkstack/signal-backend": "0.1.10",
+    "@checkstack/queue-api": "0.2.5",
+    "@checkstack/signal-backend": "0.1.11",
     "@checkstack/signal-common": "0.1.6",
     "@hono/zod-validator": "^0.7.6",
     "@orpc/client": "^1.13.2",
@@ -37,6 +37,6 @@
     "@types/bun": "latest",
     "@checkstack/tsconfig": "0.0.3",
     "@checkstack/scripts": "0.1.1",
-    "@checkstack/test-utils-backend": "0.1.10"
+    "@checkstack/test-utils-backend": "0.1.11"
   }
 }

package/src/index.ts

@@ -60,6 +60,15 @@ app.use(
 );
 app.use("*", logger());
 
+// SECURITY: Add missing standard security headers across all API responses
+app.use("/api/*", async (c, next) => {
+  await next();
+  c.res.headers.set("X-Content-Type-Options", "nosniff");
+  c.res.headers.set("X-Frame-Options", "DENY");
+  c.res.headers.set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+  c.res.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+});
+
 // Runtime config endpoint - returns BASE_URL for frontend
 app.get("/api/config", (c) => {
   const baseUrl = process.env.BASE_URL || "http://localhost:3000";

package/src/plugin-manager/core-services.ts

@@ -176,9 +176,12 @@ export function registerCoreServices({
           });
           const authClient = rpcClient.forPlugin(AuthApi);
           return await authClient.checkResourceTeamAccess(params);
-        } catch {
-          // Fall back to global access on error
-          return { hasAccess: params.hasGlobalAccess };
+        } catch (error) {
+          // SECURITY: Fail-Closed — deny access when auth service is unavailable
+          rootLogger.error(
+            `[auth] checkResourceTeamAccess: S2S call failed for resource ${params.resourceType}:${params.resourceId}. Denying access (Fail-Closed). Error: ${error}`,
+          );
+          return { hasAccess: false };
         }
       },
 
@@ -189,9 +192,12 @@ export function registerCoreServices({
           });
           const authClient = rpcClient.forPlugin(AuthApi);
           return await authClient.getAccessibleResourceIds(params);
-        } catch {
-          // Fall back to global access on error
-          return params.hasGlobalAccess ? params.resourceIds : [];
+        } catch (error) {
+          // SECURITY: Fail-Closed — return empty set when auth service is unavailable
+          rootLogger.error(
+            `[auth] getAccessibleResourceIds: S2S call failed for resource type ${params.resourceType}. Denying access (Fail-Closed). Error: ${error}`,
+          );
+          return [];
         }
       },
     };