@felloh-org/lambda-wrapper 1.11.214 → 1.11.216

package/SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| Latest  | :white_check_mark: |
+| < Latest | :x:               |
+
+Only the latest published version of `@felloh-org/lambda-wrapper` receives security updates. We recommend always upgrading to the latest version.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly. **Do not open a public GitHub issue.**
+
+Email **developers@felloh.com** with:
+
+- A description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Any potential impact assessment
+
+You should receive an acknowledgement within 48 hours. We will work with you to understand the issue and coordinate a fix and disclosure timeline.
+
+## Security Practices
+
+### Dependency Management
+
+- Production dependencies are audited for high and critical vulnerabilities on every push via the CI pipeline (`yarn audit:check`)
+- Dependabot is enabled for automated dependency update pull requests
+- Yarn resolutions are used to pin transitive dependencies to patched versions where upstream packages have not yet updated
+
+### Authentication and Authorisation
+
+- Bearer token authentication via AWS Cognito JWT claims
+- Role-based access control with organisation-scoped permissions
+- All authorisation failures return 401 responses without leaking internal details
+
+### Data Handling
+
+- Database credentials are fetched from AWS Secrets Manager at runtime (never hardcoded)
+- All Lambda responses include CORS headers configured for the Felloh API
+- Webhook payloads are signed with HMAC-SHA256 using per-organisation keys
+- Request validation is enforced via declarative constraints before processing
+
+### Logging
+
+- Axios errors are automatically sanitised to strip request headers and sensitive data before logging
+- IP addresses and user agent information are logged as silent metrics for incident tracing
+- No secrets, tokens, or credentials are written to logs
+
+## Disclosure Policy
+
+We follow coordinated disclosure. Once a fix is available, we will:
+
+1. Release a patched version to npm
+2. Publish a GitHub advisory if the vulnerability warrants it
+3. Credit the reporter unless they request anonymity

package/{ormconfig.js → data-source.js}

@@ -1,3 +1,4 @@
+const { DataSource } = require('typeorm');
 const DotEnv = require('dotenv');
 
 DotEnv.config();
@@ -12,9 +13,6 @@ const connectionParams = {
     `${__dirname}/dist/migration/**/*.ts`,
     `${__dirname}/dist/migration/**/*.js`,
   ],
-  cli: {
-    migrationsDir: `${__dirname}/src/migration`,
-  },
   synchronize: true,
   logging: false,
   schema: 'user',
@@ -35,4 +33,4 @@ if (process.env.WAREHOUSE_TYPE === 'postgres') {
   connectionParams.region = process.env.REGION;
 }
 
-module.exports = connectionParams;
+module.exports = new DataSource(connectionParams);