@felloh-org/lambda-wrapper 1.11.215 → 1.11.217

package/.concourse/pipeline.yml

@@ -7,12 +7,17 @@ resource_types:
     type: docker-image
     source:
       repository: teliaoss/github-pr-resource
+      tag: latest
+      username: ((docker.username))
+      password: ((docker.password))
 
   - name: slack-notification
-    type: docker-image
+    type: registry-image
     source:
       repository: mockersf/concourse-slack-notifier
       tag: latest
+      username: ((docker.username))
+      password: ((docker.password))
 
 # --------------------------------------------------------------------------------------------------
 # Resources
@@ -24,7 +29,6 @@ resources:
     source:
       uri: git@github.com:felloh-org/concourse-scripts.git
       branch: main
-      depth: 0
       private_key: ((git.private_key))
 
   - name: lambda-wrapper
@@ -32,7 +36,6 @@ resources:
     source:
       uri: git@github.com:felloh-org/lambda-wrapper.git
       branch: main
-      depth: 0
       private_key: ((git.private_key))
 
   - name: slack-alert-deploy
@@ -69,6 +72,22 @@ jobs:
               repository: lambda-wrapper
             params:
               NPM_COMMAND: 'audit:check'
+          - task: 'sast'
+            config:
+              platform: linux
+              image_resource:
+                type: docker-image
+                source:
+                  repository: semgrep/semgrep
+              inputs:
+                - name: lambda-wrapper
+              run:
+                path: sh
+                args:
+                  - -exc
+                  - |
+                    cd lambda-wrapper
+                    semgrep scan --config auto --config p/javascript --config p/nodejs --config p/sql-injection --config p/owasp-top-ten --error --exclude 'node_modules' --exclude 'dist' --exclude 'coverage' --exclude '*.test.js' src/
 
   - name: 'migrations.staging'
     serial: true

package/.github/workflows/release.yml

@@ -26,11 +26,8 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
 
-      - name: Build and publish release.
-        run: yarn install
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
 
       - run: yarn lint
         env:

package/.github/workflows/sast.yml

@@ -0,0 +1,20 @@
+name: sast
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  semgrep:
+    name: Semgrep SAST
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        run: semgrep scan --config auto --config p/javascript --config p/nodejs --config p/sql-injection --config p/owasp-top-ten --error --exclude 'node_modules' --exclude 'dist' --exclude 'coverage' --exclude '*.test.js' src/

package/README.md

@@ -135,7 +135,7 @@ class PaymentProcessor extends DependencyAwareClass {
 
     const connection = await warehouse.connect();
     const repo = connection.getRepository(TransactionEntity);
-    const transaction = await repo.findOne({ id: transactionId });
+    const transaction = await repo.findOne({ where: { id: transactionId } });
 
     logger.info(`Processing payment ${transactionId}`);
 

package/SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+|---------|--------------------|
+| Latest  | :white_check_mark: |
+| < Latest | :x:               |
+
+Only the latest published version of `@felloh-org/lambda-wrapper` receives security updates. We recommend always upgrading to the latest version.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly. **Do not open a public GitHub issue.**
+
+Email **developers@felloh.com** with:
+
+- A description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Any potential impact assessment
+
+You should receive an acknowledgement within 48 hours. We will work with you to understand the issue and coordinate a fix and disclosure timeline.
+
+## Security Practices
+
+### Dependency Management
+
+- Production dependencies are audited for high and critical vulnerabilities on every push via the CI pipeline (`yarn audit:check`)
+- Dependabot is enabled for automated dependency update pull requests
+- Yarn resolutions are used to pin transitive dependencies to patched versions where upstream packages have not yet updated
+
+### Authentication and Authorisation
+
+- Bearer token authentication via AWS Cognito JWT claims
+- Role-based access control with organisation-scoped permissions
+- All authorisation failures return 401 responses without leaking internal details
+
+### Data Handling
+
+- Database credentials are fetched from AWS Secrets Manager at runtime (never hardcoded)
+- All Lambda responses include CORS headers configured for the Felloh API
+- Webhook payloads are signed with HMAC-SHA256 using per-organisation keys
+- Request validation is enforced via declarative constraints before processing
+
+### Logging
+
+- Axios errors are automatically sanitised to strip request headers and sensitive data before logging
+- IP addresses and user agent information are logged as silent metrics for incident tracing
+- No secrets, tokens, or credentials are written to logs
+
+## Disclosure Policy
+
+We follow coordinated disclosure. Once a fix is available, we will:
+
+1. Release a patched version to npm
+2. Publish a GitHub advisory if the vulnerability warrants it
+3. Credit the reporter unless they request anonymity