@panguard-ai/threat-cloud 1.5.5 → 1.6.0

package/dist/server.js

@@ -27,11 +27,12 @@
  *
  * @module @panguard-ai/threat-cloud/server
  */
+import * as Sentry from '@sentry/node';
 import { createServer } from 'node:http';
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { createRequire } from 'node:module';
 // Read package.json version (for /api/version endpoint, deploy verification)
 const _require = createRequire(import.meta.url);
@@ -45,13 +46,43 @@ import { ThreatCloudDB } from './database.js';
 import { createBadgeRouter } from './badge-api.js';
 import { LLMReviewer } from './llm-reviewer.js';
 import { getAdminHTML } from './admin-dashboard.js';
+import { resolveTier, isTcTier, TIER_LIMITS, } from './auth/tier-resolver.js';
 import { tryValidateInput, ThreatDataSchema, RulePublishSchema, ATRProposalSchema, ATRFeedbackSchema, SkillThreatSchema, SkillWhitelistItemSchema, } from '@panguard-ai/core';
+import { parseATRRule, validateRuleMeetsStandard } from '@panguard-ai/atr/quality';
 import { z } from 'zod';
+// Sentry init — no-op when SENTRY_DSN is unset so paid customers can opt out.
+// Must run before request handlers register so early errors are captured.
+if (process.env['SENTRY_DSN']) {
+    Sentry.init({
+        dsn: process.env['SENTRY_DSN'],
+        tracesSampleRate: 0.1,
+        release: process.env['GIT_SHA'] ?? 'dev',
+        environment: process.env['NODE_ENV'] ?? 'production',
+    });
+}
+/**
+ * Grace window for vote weight of pre-migration anonymous client keys.
+ *
+ * Migration v15 introduced the trust-tier model and gave all NEW anonymous
+ * keys (`/api/clients/register` without GitHub binding) a vote weight of 0,
+ * which would have stalled every in-flight community proposal at the moment
+ * an operator deployed the upgrade. To smooth the transition, every key
+ * that existed when v15 ran was retagged as `anonymous_legacy` and counts
+ * for 0.25 weight per vote — until this date. After this date, legacy and
+ * new anonymous keys behave identically (weight 0).
+ *
+ * The window is 90 days from the v15 deploy date. After the window ends,
+ * removing this constant entirely is safe — the weight will already be 0.
+ */
+const LEGACY_ANONYMOUS_GRACE_END_ISO = '2026-08-19T00:00:00Z';
 /** Structured JSON logger for threat-cloud */
 const log = {
     info: (msg, extra) => {
         process.stdout.write(JSON.stringify({ ts: new Date().toISOString(), level: 'info', msg, ...extra }) + '\n');
     },
+    warn: (msg, extra) => {
+        process.stderr.write(JSON.stringify({ ts: new Date().toISOString(), level: 'warn', msg, ...extra }) + '\n');
+    },
     error: (msg, err, extra) => {
         process.stderr.write(JSON.stringify({
             ts: new Date().toISOString(),
@@ -128,6 +159,45 @@ export class ThreatCloudServer {
                 catch (err) {
                     log.error('Classification backfill failed', err);
                 }
+                // Reject malformed promoted proposals (one-time on startup, idempotent).
+                // 2026-05-26 the PR-back cron surfaced 14 promoted rows that didn't
+                // meet the Cisco-quality bar; subsequent measurement showed 41 such
+                // rows across the entire DB. They landed before the POST gate
+                // existed (339fd410). The GET filter (33dc2c56) already hides them
+                // from consumers; this pass marks the DB row as 'rejected' so the
+                // forensic record is preserved while keeping promoted/* clean.
+                //
+                // Uses the same parseATRRule + validateRuleMeetsStandard('experimental')
+                // gate POST and GET enforce — idempotent (re-running rejects 0).
+                // Wrapped in try/catch so a parse failure can't crash boot.
+                try {
+                    const promotedList = this.db.getConfirmedATRRules();
+                    let rejected = 0;
+                    const rejectedIds = [];
+                    for (const rule of promotedList) {
+                        try {
+                            const metadata = parseATRRule(rule.ruleContent);
+                            const gate = validateRuleMeetsStandard(metadata, 'experimental');
+                            if (!gate.passed) {
+                                this.db.rejectATRProposal(rule.ruleId);
+                                rejected += 1;
+                                rejectedIds.push(rule.ruleId);
+                            }
+                        }
+                        catch {
+                            // Unparseable YAML — same outcome as failing the gate.
+                            this.db.rejectATRProposal(rule.ruleId);
+                            rejected += 1;
+                            rejectedIds.push(rule.ruleId);
+                        }
+                    }
+                    if (rejected > 0) {
+                        log.info(`Malformed-proposal cleanup: rejected ${rejected} of ${promotedList.length} promoted row(s)`, { sampleIds: rejectedIds.slice(0, 10) });
+                    }
+                }
+                catch (err) {
+                    log.error('Malformed-proposal cleanup failed', err);
+                }
                 // Start promotion + review cron (every 15 minutes)
                 this.promotionTimer = setInterval(() => {
                     try {
@@ -219,19 +289,6 @@ export class ThreatCloudServer {
         res.setHeader('Content-Type', 'application/json');
         res.setHeader('X-Request-Id', requestId);
         const clientIP = req.socket.remoteAddress ?? 'unknown';
-        // Rate limiting
-        if (!this.checkRateLimit(clientIP)) {
-            this.sendJson(res, 429, { ok: false, error: 'Rate limit exceeded', request_id: requestId });
-            log.info('request', {
-                method: req.method,
-                path: req.url,
-                status: 429,
-                duration_ms: Date.now() - startTime,
-                client_ip: clientIP,
-                request_id: requestId,
-            });
-            return;
-        }
         // API key verification (skip for health check)
         const url = req.url ?? '/';
         const rawPathname = url.split('?')[0] ?? '/';
@@ -244,17 +301,27 @@ export class ThreatCloudServer {
         // Public endpoints that don't require API key authentication.
         // Read-only data endpoints are public. Write endpoints require auth.
         // GET /api/rules is public so Guard can pull open-source ATR rules without a key.
-        const publicPaths = new Set(['/health', '/api/stats', '/api/metrics', '/api/clients/register']);
+        const publicPaths = new Set([
+            '/health',
+            '/api/stats',
+            '/api/metrics',
+            '/api/clients/register',
+            '/api/clients/register-github',
+        ]);
         const isPublicRead = publicPaths.has(pathname) || (pathname === '/api/rules' && req.method === 'GET');
         // Track the role that authenticated this request so route handlers can
         // enforce scope (e.g. L5 partner endpoints only accept role=partner|admin).
         let authRole = 'anonymous';
+        // Per-token rate-limit key. For authenticated requests, this is the bearer
+        // token so each key (and thereby each workspace) has its own bucket.
+        // Anonymous/public-read requests fall back to the historical per-IP key.
+        let rateLimitKey = `ip:${clientIP}`;
+        let clientKeyInfo = null;
         if (!isPublicRead && this.config.apiKeyRequired) {
             const authHeader = req.headers.authorization ?? '';
             const token = authHeader.replace('Bearer ', '');
             const isValidApiKey = this.config.apiKeys.includes(token);
             const isAdminKey = this.config.adminApiKey ? token === this.config.adminApiKey : false;
-            let clientKeyInfo = null;
             if (!isValidApiKey && !isAdminKey && token.length > 0) {
                 clientKeyInfo = this.db.getClientKeyInfo(token);
                 if (clientKeyInfo)
@@ -279,6 +346,40 @@ export class ThreatCloudServer {
                     : clientKeyInfo?.role === 'partner'
                         ? 'client-partner'
                         : 'client-guard';
+            // Authenticated requests are rate-limited per token, not per IP.
+            // Falling back to `ip:<addr>` only here would defeat tier quotas:
+            // every shared NAT egress would collide. token is unique per key.
+            rateLimitKey = `token:${token}`;
+        }
+        // Rate limiting (tier-aware). Run AFTER auth so we know which tier this
+        // request belongs to. Anonymous public reads still go through the per-IP
+        // limiter at the community budget (120/min) — same as before this change.
+        const tier = resolveTier(authRole, clientKeyInfo);
+        const rl = this.checkRateLimit(rateLimitKey, tier);
+        res.setHeader('X-RateLimit-Tier', tier);
+        res.setHeader('X-RateLimit-Limit', String(rl.limit));
+        res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+        res.setHeader('X-RateLimit-Reset', String(rl.resetAt));
+        if (!rl.allowed) {
+            res.setHeader('Retry-After', String(Math.ceil((rl.resetAt - Date.now()) / 1000)));
+            this.sendJson(res, 429, {
+                ok: false,
+                error: 'rate_limited',
+                tier,
+                limit: rl.limit,
+                retry_after_ms: Math.max(0, rl.resetAt - Date.now()),
+                request_id: requestId,
+            });
+            log.info('request', {
+                method: req.method,
+                path: req.url,
+                status: 429,
+                duration_ms: Date.now() - startTime,
+                client_ip: clientIP,
+                request_id: requestId,
+                rate_limit_tier: tier,
+            });
+            return;
         }
         // L5 partner-sync: /api/atr-rules/live is role-gated. Only admin or
         // partner-tier client keys can reach it. Guard auto-provisioned keys
@@ -503,6 +604,14 @@ export class ThreatCloudServer {
                         this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
                     }
                     break;
+                case '/api/clients/register-github':
+                    if (req.method === 'POST') {
+                        await this.handleClientRegisterGitHub(req, res, clientIP);
+                    }
+                    else {
+                        this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                    }
+                    break;
                 case '/api/admin/client-keys':
                     if (!this.checkAdminAuth(req)) {
                         this.sendJson(res, 403, { ok: false, error: 'Admin API key required' });
@@ -829,6 +938,53 @@ export class ThreatCloudServer {
                     }
                     break;
                 default: {
+                    // Admin tier-management endpoint: change workspace tier for a
+                    // client key. Drives the per-token rate limiter. Admin-only;
+                    // path param is the clientId (the same value returned by
+                    // /api/admin/client-keys). Tier change takes effect on the NEXT
+                    // 60-second rate-limit window for that token.
+                    const tierMatch = pathname.match(/^\/api\/admin\/client-keys\/([^/]+)\/tier$/);
+                    if (tierMatch) {
+                        if (!this.checkAdminAuth(req)) {
+                            this.sendJson(res, 401, { ok: false, error: 'Admin API key required' });
+                            break;
+                        }
+                        if (req.method !== 'POST') {
+                            this.sendJson(res, 405, { ok: false, error: 'Method not allowed' });
+                            break;
+                        }
+                        const clientId = decodeURIComponent(tierMatch[1]);
+                        const body = await this.readBody(req);
+                        let parsed;
+                        try {
+                            parsed = JSON.parse(body);
+                        }
+                        catch {
+                            this.sendJson(res, 400, { ok: false, error: 'Invalid JSON' });
+                            break;
+                        }
+                        if (!isTcTier(parsed.tier)) {
+                            this.sendJson(res, 400, {
+                                ok: false,
+                                error: 'tier must be one of community|pilot|enterprise',
+                            });
+                            break;
+                        }
+                        const updated = this.db.setClientKeyTier(clientId, parsed.tier);
+                        if (updated === 0) {
+                            this.sendJson(res, 404, {
+                                ok: false,
+                                error: 'No active client keys found for clientId',
+                            });
+                            break;
+                        }
+                        this.db.audit.logAction('admin', 'client_key.tier_update', 'client_key', clientId, { tier: parsed.tier, updated }, clientIP);
+                        this.sendJson(res, 200, {
+                            ok: true,
+                            data: { clientId, tier: parsed.tier, updated },
+                        });
+                        break;
+                    }
                     // Org fleet/policy routes with path params
                     // Threat Model: Fleet view (#6), Policy engine (#1, #6)
                     const orgDevicesMatch = pathname.match(/^\/api\/orgs\/([^/]+)\/devices$/);
@@ -897,6 +1053,12 @@ export class ThreatCloudServer {
         }
         catch (err) {
             log.error('Request failed', err, { request_id: requestId, path: rawPathname });
+            // Additive Sentry capture — keeps existing logger intact.
+            if (process.env['SENTRY_DSN']) {
+                Sentry.captureException(err, {
+                    tags: { route: req.url ?? 'unknown', requestId },
+                });
+            }
             this.sendJson(res, 500, { ok: false, error: 'Internal server error', request_id: requestId });
         }
         // Request logging
@@ -1408,12 +1570,93 @@ export class ThreatCloudServer {
             },
         });
     }
-    /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
+    /**
+     * POST /api/atr-proposals - Submit or confirm an ATR rule proposal.
+     *
+     * Vote weighting (defends the corpus against Sybil promotion attacks):
+     *   - anonymous client (legacy /api/clients/register)   → weight 0.0
+     *   - github_new (< 30 days since OAuth registration)   → weight 0.5
+     *   - github_verified (>= 30 days)                       → weight 1.0
+     *
+     * Promotion threshold: cumulative `confirmation_weight >= 3.0`. Anonymous
+     * submissions are still accepted (the corpus stays community-friendly) but
+     * they cannot single-handedly promote a proposal.
+     *
+     * GitHub-bound clients additionally face a per-user daily submission cap
+     * (default 10) so a single compromised contributor account cannot flood
+     * the queue.
+     */
     async handlePostATRProposal(req, res) {
         const data = await this.parseAndValidate(req, res, ATRProposalSchema);
         if (!data)
             return;
+        // Structural quality gate — the same one the internal LLM crystallization
+        // paths (analyzeSkills, draftRuleFromPayload) apply before storing into
+        // atr_proposals. Without this, external POSTs can stuff arbitrary strings
+        // into the rule_content field; they pass the 24h canary trivially
+        // (malformed rules can't trigger anything, so accrue zero negative
+        // feedback) and graduate to "promoted", then flood the PR-back pipeline.
+        // Observed 2026-05-26: PR-back fetched 14 promoted rules, all 14 skipped
+        // for missing every required top-level field. Root cause was this gap.
+        // Reject at submission so garbage never enters the pipeline.
+        try {
+            const metadata = parseATRRule(data.ruleContent);
+            const gateResult = validateRuleMeetsStandard(metadata, 'experimental');
+            if (!gateResult.passed) {
+                this.sendJson(res, 400, {
+                    ok: false,
+                    error: 'rule_quality_gate_failed',
+                    message: 'Proposed rule does not meet the experimental quality bar. ' +
+                        'See https://agentthreatrule.org/spec for required structure.',
+                    issues: gateResult.issues,
+                });
+                return;
+            }
+        }
+        catch (parseErr) {
+            this.sendJson(res, 400, {
+                ok: false,
+                error: 'rule_parse_failed',
+                message: 'Proposed rule_content failed to parse as a valid ATR YAML rule. ' +
+                    'See https://agentthreatrule.org/spec for required structure.',
+                detail: parseErr instanceof Error ? parseErr.message : String(parseErr),
+            });
+            return;
+        }
         const clientId = req.headers['x-panguard-client-id'] ?? undefined;
+        // Look up the caller's trust tier from the client key (if any). The
+        // bearer token is already authenticated upstream — we only need its
+        // trust attributes here.
+        const rawKey = this.extractClientKey(req);
+        const trustInfo = rawKey ? this.db.getClientKeyTrustInfo(rawKey) : null;
+        const trustTier = trustInfo?.trustTier ?? 'anonymous';
+        const githubUserId = trustInfo?.githubUserId ?? null;
+        // Per-github-user daily submission cap. Skipped for anonymous keys
+        // (those already contribute weight 0 so flooding is less attractive
+        // but still useful to prevent corpus inflation).
+        if (githubUserId !== null && this.db.hasGitHubProposalCapReached(githubUserId)) {
+            this.sendJson(res, 429, {
+                ok: false,
+                error: 'Daily proposal submission cap reached for this GitHub user',
+            });
+            return;
+        }
+        // Vote weight by trust tier. anonymous_legacy gets a non-zero weight
+        // during the grace window so pre-migration community votes don't all
+        // stall; after the grace end, it collapses to the same weight as
+        // anonymous (zero). Constant is module-scoped — see top of file.
+        let voteWeight;
+        if (trustTier === 'github_verified')
+            voteWeight = 1.0;
+        else if (trustTier === 'github_new')
+            voteWeight = 0.5;
+        else if (trustTier === 'anonymous_legacy') {
+            const now = Date.now();
+            const graceEnd = Date.parse(LEGACY_ANONYMOUS_GRACE_END_ISO);
+            voteWeight = now < graceEnd ? 0.25 : 0.0;
+        }
+        else
+            voteWeight = 0.0;
         const { patternHash, ruleContent } = data;
         // Check if a proposal with the same patternHash already exists
         const existing = this.db.getATRProposalByHash(patternHash);
@@ -1426,16 +1669,31 @@ export class ThreatCloudServer {
                         message: 'Already submitted',
                         patternHash,
                         confirmations: existing.confirmations,
+                        trustTier,
+                        voteWeight,
                     },
                 });
                 return;
             }
-            // Different client_id: increment confirmation counter
-            this.db.confirmATRProposal(patternHash);
-            const updatedConfirmations = existing.confirmations + 1;
+            // Different client_id: confirm with weight derived from trust tier.
+            // Anonymous confirmations still increment the raw `confirmations`
+            // counter for visibility but contribute 0 to `confirmation_weight`
+            // so they cannot reach the promotion threshold on their own.
+            const newWeight = this.db.confirmATRProposalWeighted(patternHash, voteWeight);
+            if (githubUserId !== null)
+                this.db.recordGitHubProposalSubmission(githubUserId);
             this.sendJson(res, 200, {
                 ok: true,
-                data: { message: 'Proposal confirmed', patternHash, confirmations: updatedConfirmations },
+                data: {
+                    message: trustTier === 'anonymous'
+                        ? 'Proposal acknowledged (anonymous vote — weight 0, will not promote)'
+                        : 'Proposal confirmed',
+                    patternHash,
+                    confirmations: existing.confirmations + 1,
+                    confirmationWeight: newWeight,
+                    trustTier,
+                    voteWeight,
+                },
             });
         }
         else {
@@ -1444,6 +1702,8 @@ export class ThreatCloudServer {
                 clientId,
             };
             this.db.insertATRProposal(proposal);
+            if (githubUserId !== null)
+                this.db.recordGitHubProposalSubmission(githubUserId);
             // Fire-and-forget LLM review on first submission only
             if (this.llmReviewer?.isAvailable()) {
                 void this.llmReviewer.reviewProposal(patternHash, ruleContent).catch((err) => {
@@ -1452,10 +1712,26 @@ export class ThreatCloudServer {
             }
             this.sendJson(res, 201, {
                 ok: true,
-                data: { message: 'Proposal submitted', patternHash },
+                data: {
+                    message: 'Proposal submitted',
+                    patternHash,
+                    trustTier,
+                    voteWeight,
+                },
             });
         }
     }
+    /**
+     * Extract the raw client key from the Authorization header. Returns null
+     * when no bearer token is present.
+     */
+    extractClientKey(req) {
+        const auth = req.headers['authorization'];
+        if (typeof auth !== 'string')
+            return null;
+        const match = auth.match(/^Bearer\s+(\S+)\s*$/i);
+        return match?.[1] ?? null;
+    }
     /** POST /api/atr-feedback - Submit feedback on an ATR rule */
     async handlePostATRFeedback(req, res) {
         const data = await this.parseAndValidate(req, res, ATRFeedbackSchema);
@@ -1546,6 +1822,124 @@ export class ThreatCloudServer {
         this.db.audit.logAction('system', 'client_key.register', 'client_key', clientId, { ip: clientIP }, clientIP);
         this.sendJson(res, 201, { ok: true, data: { clientKey: result.clientKey } });
     }
+    /**
+     * POST /api/clients/register-github — issue a client key bound to a verified
+     * GitHub identity. Used to defend the ATR proposal corpus against Sybil
+     * attacks via anonymous registration spam.
+     *
+     * Flow:
+     *   1. Client sends `{ githubToken: "ghp_..." | "gho_..." }` in body
+     *   2. Server calls GitHub API `GET /user` with that token to verify
+     *   3. On success, issues a client key tied to the numeric GitHub user ID
+     *
+     * The github_user_id is GitHub's stable numeric identifier — `login` can be
+     * renamed, so we key trust off the ID. Trust tier starts at 'github_new'
+     * and matures to 'github_verified' 30 days after first registration (see
+     * promoteMatureGitHubClients).
+     *
+     * Vote weighting at ATR proposal time:
+     *   - anonymous (legacy /api/clients/register key)  → 0   (can submit, can't promote)
+     *   - github_new (< 30 days)                         → 0.5
+     *   - github_verified (>= 30 days)                   → 1.0
+     * Promotion threshold: cumulative weight >= 3.0
+     */
+    async handleClientRegisterGitHub(req, res, clientIP) {
+        // Reuse the same per-IP registration rate limit as the anonymous endpoint
+        // to avoid Sybil registration via rotated tokens from a single IP.
+        const entry = this.registrationRateLimits.get(clientIP);
+        const now = Date.now();
+        if (entry && now < entry.resetAt) {
+            if (entry.count >= 10) {
+                this.sendJson(res, 429, {
+                    ok: false,
+                    error: 'Registration rate limit exceeded. Try again later.',
+                });
+                return;
+            }
+            entry.count++;
+        }
+        else {
+            this.registrationRateLimits.set(clientIP, { count: 1, resetAt: now + 3_600_000 });
+        }
+        const body = await this.readBody(req);
+        if (!body) {
+            this.sendJson(res, 400, { ok: false, error: 'Request body required' });
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            this.sendJson(res, 400, { ok: false, error: 'Invalid JSON' });
+            return;
+        }
+        const githubToken = parsed.githubToken;
+        if (!githubToken ||
+            typeof githubToken !== 'string' ||
+            githubToken.length < 20 ||
+            githubToken.length > 300) {
+            this.sendJson(res, 400, {
+                ok: false,
+                error: 'githubToken must be a GitHub access token (20-300 chars)',
+            });
+            return;
+        }
+        // Verify the token by calling GitHub's /user endpoint. Use a short
+        // timeout so a slow/unreachable GitHub does not pin a TC connection.
+        let githubUser = null;
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5_000);
+            const ghRes = await fetch('https://api.github.com/user', {
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${githubToken}`,
+                    Accept: 'application/vnd.github+json',
+                    'User-Agent': 'panguard-threat-cloud',
+                },
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (!ghRes.ok) {
+                this.sendJson(res, 401, {
+                    ok: false,
+                    error: `GitHub token rejected (HTTP ${ghRes.status})`,
+                });
+                return;
+            }
+            const data = (await ghRes.json());
+            if (typeof data.id !== 'number' ||
+                typeof data.login !== 'string' ||
+                data.login.length === 0) {
+                this.sendJson(res, 502, {
+                    ok: false,
+                    error: 'GitHub /user response missing required fields',
+                });
+                return;
+            }
+            githubUser = { id: data.id, login: data.login };
+        }
+        catch (err) {
+            log.error(`GitHub token verification failed`, err);
+            this.sendJson(res, 502, {
+                ok: false,
+                error: 'Failed to verify GitHub token (timeout or upstream error)',
+            });
+            return;
+        }
+        const result = this.db.registerGitHubClientKey(githubUser.id, githubUser.login, clientIP);
+        this.db.audit.logAction('system', 'client_key.register_github', 'client_key', result.clientId, { ip: clientIP, github_user_id: githubUser.id, github_login: githubUser.login }, clientIP);
+        this.sendJson(res, 201, {
+            ok: true,
+            data: {
+                clientKey: result.clientKey,
+                clientId: result.clientId,
+                trustTier: result.trustTier,
+                githubLogin: githubUser.login,
+            },
+        });
+    }
     /** POST /api/admin/client-keys/revoke — revoke client keys */
     async handleClientKeyRevoke(req, res) {
         const body = await this.readBody(req);
@@ -1727,10 +2121,45 @@ export class ThreatCloudServer {
             const canaryRules = this.db.getCanaryATRRules();
             ruleList.push(...canaryRules);
         }
+        // Defense-in-depth: re-validate every rule against the same structural
+        // quality gate POST /api/atr-proposals enforces (added 2026-05-27 in
+        // 339fd410). The DB may contain malformed rows that landed BEFORE the
+        // gate was in place — filtering at read time hides them from all
+        // consumers (notably the PR-back cron job, which previously processed
+        // 14 garbage rows every 6h). Dropped rule IDs are logged so they can
+        // be hard-deleted via admin endpoint later if desired.
+        const droppedIds = [];
+        const validRules = ruleList.filter((rule) => {
+            try {
+                const metadata = parseATRRule(rule.ruleContent);
+                const gateResult = validateRuleMeetsStandard(metadata, 'experimental');
+                if (!gateResult.passed) {
+                    droppedIds.push(rule.ruleId);
+                    return false;
+                }
+                return true;
+            }
+            catch {
+                droppedIds.push(rule.ruleId);
+                return false;
+            }
+        });
+        if (droppedIds.length > 0) {
+            // Use log.info — this logger object exports only .info and .error.
+            // The malformed-rule case is operational (something old in the DB),
+            // not an error path, so info is the right level.
+            log.info(`[atr-rules] dropped ${droppedIds.length} malformed rule(s) from response`, {
+                ruleIds: droppedIds.slice(0, 20),
+            });
+        }
         this.sendJson(res, 200, {
             ok: true,
-            data: ruleList,
-            meta: { total: ruleList.length, includesCanary: includeCanary },
+            data: validRules,
+            meta: {
+                total: validRules.length,
+                includesCanary: includeCanary,
+                droppedMalformed: droppedIds.length,
+            },
         });
     }
     /** GET /api/feeds/ip-blocklist?minReputation=70 - IP blocklist feed (plain text) */
@@ -2204,11 +2633,21 @@ export class ThreatCloudServer {
         // Admin HTML is safe to serve publicly — it contains no sensitive data.
         // Authentication happens client-side: the login form collects the API key,
         // which is then sent as Authorization header on every API call.
+        const nonce = randomBytes(16).toString('base64');
         res.setHeader('Content-Type', 'text/html; charset=utf-8');
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+        res.setHeader('Content-Security-Policy', `default-src 'self'; ` +
+            `script-src 'nonce-${nonce}' 'strict-dynamic'; ` +
+            `style-src 'self' 'unsafe-inline'; ` +
+            `object-src 'none'; ` +
+            `frame-ancestors 'none'; ` +
+            `base-uri 'self'`);
         res.writeHead(200);
-        res.end(getAdminHTML());
+        res.end(getAdminHTML(nonce));
     }
     /** Check admin API key for write-protected endpoints / 檢查管理員 API 金鑰 */
     checkAdminAuth(req) {
@@ -2223,21 +2662,56 @@ export class ThreatCloudServer {
         }
         const authHeader = req.headers.authorization ?? '';
         const token = authHeader.replace('Bearer ', '');
-        // Use timing-safe comparison to prevent timing attacks
-        if (token.length !== this.config.adminApiKey.length)
-            return false;
-        return timingSafeEqual(Buffer.from(token, 'utf-8'), Buffer.from(this.config.adminApiKey, 'utf-8'));
+        const expected = this.config.adminApiKey;
+        // Pad both sides to a fixed 128-byte buffer before comparing so the
+        // early-return branch that leaks key length via timing is eliminated.
+        const a = Buffer.alloc(128);
+        const b = Buffer.alloc(128);
+        Buffer.from(token, 'utf-8').copy(a, 0, 0, Math.min(token.length, 128));
+        Buffer.from(expected, 'utf-8').copy(b, 0, 0, Math.min(expected.length, 128));
+        // timingSafeEqual guards byte content; the explicit length check is kept
+        // separate so both sides always go through the constant-time comparison
+        // regardless of length difference.
+        return timingSafeEqual(a, b) && token.length === expected.length;
     }
-    /** Rate limit check / 速率限制檢查 */
-    checkRateLimit(ip) {
+    /**
+     * Tier-aware rate-limit check / 階層感知的速率限制檢查
+     *
+     * @param key   Bucket key — `token:<bearer>` for authenticated requests
+     *              or `ip:<addr>` for anonymous/public reads.
+     * @param tier  Workspace tier resolved from the auth gate. Drives the
+     *              requests-per-minute budget via TIER_LIMITS.
+     *
+     * Returns the bucket state for header emission + allow/deny decision.
+     * `limit` is captured at window-init time; mid-window tier changes only
+     * take effect on the next window.
+     */
+    checkRateLimit(key, tier) {
         const now = Date.now();
-        const entry = this.rateLimits.get(ip);
-        if (!entry || now > entry.resetAt) {
-            this.rateLimits.set(ip, { count: 1, resetAt: now + 60_000 });
-            return true;
+        const tierLimit = TIER_LIMITS[tier];
+        const entry = this.rateLimits.get(key);
+        if (!entry || now >= entry.resetAt) {
+            const resetAt = now + 60_000;
+            this.rateLimits.set(key, { count: 1, resetAt, limit: tierLimit });
+            return { allowed: true, limit: tierLimit, remaining: tierLimit - 1, resetAt };
+        }
+        if (entry.count >= entry.limit) {
+            // Bucket exhausted — do not increment further (avoids unbounded growth
+            // when a misbehaving client keeps hammering after 429).
+            return {
+                allowed: false,
+                limit: entry.limit,
+                remaining: 0,
+                resetAt: entry.resetAt,
+            };
         }
         entry.count++;
-        return entry.count <= this.config.rateLimitPerMinute;
+        return {
+            allowed: true,
+            limit: entry.limit,
+            remaining: Math.max(0, entry.limit - entry.count),
+            resetAt: entry.resetAt,
+        };
     }
     /**
      * Parse JSON body and validate against a Zod schema.