@tenantegroup/ai-rules-mcp 1.0.0

package/rules/cloudflare/security.md

@@ -0,0 +1,162 @@
+# Security Standards
+
+## Minimum Security Baseline for Production
+Implement these before launching:
+- [ ] HTTP-only cookies for session management
+- [ ] Secure cookies in production environment
+- [ ] CSRF protection for all forms (`SameSite=Strict` or explicit CSRF token on state-changing endpoints)
+- [ ] Input validation using Zod at every API boundary
+- [ ] Rate limiting on authentication endpoints (KV-backed, IP-based, applied before session exists)
+- [ ] Role-based access control (RBAC) enforced server-side
+- [ ] Sanitized error responses (no internal details, stack traces, or third-party API responses leaked)
+- [ ] Dependency updates via Dependabot + CI audit step (`pnpm audit` / `npm audit`) on every push
+- [ ] Migration review process before production deployment (no auto-apply on deploy)
+- [ ] Removal of development seed data
+- [ ] `workers_dev = false` on any Worker not intended to be publicly reachable
+- [ ] `Content-Disposition: attachment` on all endpoints returning binary files (Excel, R2 downloads)
+- [ ] CORS posture explicitly documented and locked to specific trusted origin(s)
+
+---
+
+## Authentication & Session Management *(OWASP A07)*
+
+- Delegate authentication to an Identity Provider (Entra ID, Google, GitHub) — do not store passwords locally
+- Use sealed encrypted session cookies, not just signed cookies — sealed sessions cannot be forged or tampered with
+- Set `HttpOnly` and `Secure` on all session cookies; enforce `SameSite=Lax` at minimum
+- Destroy sessions server-side on logout; do not rely on client-side cookie deletion alone
+- Rate-limit the OAuth callback endpoint by client IP **before** any session or user lookup exists
+- Deploy internal-only Workers with `workers_dev = false` — no `.workers.dev` public URL; access only through Service Bindings
+
+
+## Authorization & Access Control *(OWASP A01)*
+
+- Enforce all authorization checks server-side — no role logic in frontend code
+- Use `requirePermission()` / `requireAdmin()` helpers called at the top of every protected API handler — no ad-hoc conditional checks buried inside business logic
+- Apply least-privilege to OAuth app registrations: scope each registration to only the permissions it actually needs; a leaked credential for one registration must not grant access to another service's capabilities
+- Admin impersonation (if implemented): attribute audit log entries to the real admin's identity, not the impersonated user
+
+
+## Input Validation & Injection Prevention *(OWASP A03)*
+
+- Validate all request bodies and query params with Zod schemas at the API boundary before any processing; reject malformed payloads immediately with safe error messages
+- Use Drizzle ORM parameterized queries only — no raw SQL string interpolation anywhere
+- Escape and `encodeURIComponent`-encode external API query values before forwarding (e.g., OData `$search` params in Microsoft Graph calls)
+- Spreadsheet/Excel output: write cells with explicit type (`t: 's'` string or `t: 'n'` number); never derive the formula property (`f`) from external input — `=CMD`-style payloads must render as plain text
+- HTML from user input: sanitize at write time server-side (strip `<script>`, event handler attributes, `javascript:` URIs); apply a second client-side DOMPurify pass on any `v-html` render
+
+
+## File Upload Security *(OWASP A08)*
+
+- Validate file magic bytes before passing a buffer to any parser — file extension and MIME type alone are insufficient:
+  - OOXML / `.xlsx`: `PK\x03\x04` (ZIP local file header)
+  - Legacy OLE2 / `.xls`: `\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1`
+- Reject files that fail magic-byte validation at the API boundary, before reaching SheetJS or any other file parser
+- Encapsulate validation in a dedicated utility (e.g., `server/utils/fileValidation.ts`) reused across all upload endpoints
+
+
+## Security Headers *(OWASP A05)*
+
+**Nuxt applications:**
+- Use the `nuxt-security` module as the single source of truth for all response headers — remove any conflicting `public/_headers` definitions
+- CSP: set a per-request cryptographic nonce on `script-src` using `'nonce-{{nonce}}'` + `'strict-dynamic'`; remove `'unsafe-inline'` and `'unsafe-eval'` from script sources
+- `style-src 'unsafe-inline'` may only be retained when a UI component library sets dynamic inline `style=""` attributes that cannot carry nonces; document the tradeoff explicitly
+
+**All surfaces (Nuxt and API-only Workers):**
+- `Strict-Transport-Security: max-age=31536000; includeSubDomains`
+- `X-Frame-Options: DENY`
+- `X-Content-Type-Options: nosniff`
+- `Referrer-Policy: strict-origin-when-cross-origin`
+- `Permissions-Policy` — disable camera, microphone, geolocation, and payment APIs
+- `form-action: 'self'`
+
+**API-only Workers:**
+- Use Nitro middleware (`server/middleware/00-security-headers.ts`) — not `_headers`
+- Add `default-src 'none'; frame-ancestors 'none'` appropriate for headless services
+
+
+## Secrets & Credentials Management *(OWASP A02)*
+
+- Store all secrets as Cloudflare encrypted secrets — never in `[vars]` (plaintext) or committed to the repository
+- Exclude `.dev.vars` and `.env` files from git
+- Service-to-service secrets: fail closed — if a required secret is unset in production, throw immediately rather than silently falling back to an unauthenticated request; log a startup `console.warn` when the Worker detects its own secret is missing
+- Externalize all environment-specific values (email recipients, org IDs, fleet IDs) to env config or D1 `app_settings` — no hardcoded constants in source code
+
+
+## Rate Limiting *(OWASP A07)*
+
+- Use KV-backed distributed rate limiting — in-memory counters reset per isolate and are trivially bypassed in a multi-instance Workers environment
+- Define named tiers with explicit request limits in a single utility (`server/utils/rateLimit.ts`); examples: AUTH (pre-auth, IP-based), STRICT (post-auth sensitive endpoints), MODERATE (general API)
+- Apply the strictest tier to the OAuth/auth callback endpoint **before** any session exists
+- For internal-only tools on constrained plans: fail open on KV unavailability — availability outweighs protection when the blast radius is limited to internal users
+
+
+## Audit Logging *(OWASP A09)*
+
+- Centralize all audit writes in a single `logAuditAction()` utility writing to a dedicated D1 `audit_logs` table — no ad-hoc logging to separate stores
+- Required fields per entry: actor identity (email or user ID), action type (machine-readable slug), timestamp, target resource ID
+- For state-changing operations: capture before and after values
+- Minimum event taxonomy:
+  - `auth.login_success`, `auth.login_failure`, `auth.logout`
+  - `<resource>.create`, `<resource>.update`, `<resource>.delete` for all sensitive resources
+  - `admin.impersonate_start`, `admin.impersonate_end` (if applicable)
+  - Permission escalation and feature flag changes
+- Define and enforce a retention period for the `audit_logs` table (e.g., 1 year minimum)
+- If `logAuditAction()` throws: emit `console.error` at minimum — never silently swallow audit failures
+
+
+## Error Handling & Information Disclosure *(OWASP A04)*
+
+- Never serialize internal error details, stack traces, or third-party API error responses into client-facing responses
+- Log full error detail server-side; return only a generic safe message to callers
+- Zod parse failures: return structured field-level validation messages — not raw Zod output with internal type paths
+- Queue message parse failures: log full detail server-side and ack the message immediately — do not burn retry attempts on a payload that is guaranteed to fail
+
+
+## Service-to-Service Authentication
+
+- Apply dual-layer authentication on every cross-service boundary:
+  - **Outer layer**: Cloudflare Access service token or Service Binding (edge-level; no public URL exposed)
+  - **Inner layer**: Application-level bearer token validated in the Worker handler
+  - Neither credential alone should be sufficient
+- Workers not intended for public access: deploy with `workers_dev = false`; route all traffic through Service Bindings
+- API key comparison: use constant-time comparison (XOR-accumulator over `TextEncoder`-encoded bytes) — never `!==` — to eliminate timing side-channel attacks
+
+
+## Data Integrity & Sensitive Data Lifecycle *(OWASP A08)*
+
+- Validate queue message payloads at the handler boundary using a Zod discriminated-union schema; ack malformed messages immediately rather than retrying guaranteed-to-fail payloads
+- Implement idempotency guards to prevent duplicate side effects on queue retries (e.g., check a flag in D1 before sending an email or triggering a workflow)
+- Auto-purge sensitive short-lived credentials (e.g., generated passwords, temporary tokens) immediately on workflow completion or cancellation — do not retain them in backups
+- Define explicit retention limits for any stored user-generated content; enforce via scheduled cleanup jobs
+
+
+## CORS & Content Security
+
+- Workers do not add CORS headers by default — treat this as secure-by-default; do not add permissive CORS without a specific requirement
+- When CORS is required, lock `Access-Control-Allow-Origin` to specific trusted origin(s); never emit `*` on authenticated endpoints
+- Document CORS posture explicitly in every API-only service — even when the answer is "no CORS headers needed"
+- Set `Content-Disposition: attachment` on all endpoints that return binary file content to prevent inline browser rendering
+
+
+## Dependency & Supply Chain Security *(OWASP A06)*
+
+- Configure Dependabot (`.github/dependabot.yml`) for weekly PRs covering npm packages and GitHub Actions in all projects
+- Add `pnpm audit` / `npm audit` as a required CI step on every push; surface known vulnerabilities before merge
+- Review D1 migrations before every production apply — no auto-apply on deploy
+
+
+## Advanced Security (When Scaling)
+
+Add these as the project matures:
+- [ ] Cloudflare WAF Managed Rules — Pro+ plan enables OWASP Core Rule Set coverage at the edge
+- [ ] Bot Protection — Cloudflare Bot Fight Mode (free) or Bot Management (paid); low priority while internal-only, higher if any public-facing surface is added
+- [ ] Subresource Integrity (SRI) — add `integrity=` hashes on any scripts or stylesheets loaded from external CDNs
+- [ ] SSRF prevention — if any endpoint begins accepting a user-supplied URL to fetch, blocklist private IP ranges (`10.x`, `172.16.x`, `192.168.x`, `169.254.x`, `::1`) before making the outbound `fetch()`
+- [ ] Workers Logpush — ship Worker logs to an external destination (R2, Datadog, Splunk) for long-term retention and forensic capability; Cloudflare live log tail is ephemeral
+- [ ] `/.well-known/security.txt` — define a responsible disclosure contact; minimal effort, signals security posture to external researchers
+- [ ] Quarterly access review — audit which users hold which permissions and which app registrations are still active and correctly scoped
+- [ ] Incident response playbook — documented procedures for: suspected credential leak, unauthorized access in audit logs, pipeline breach, IdP account compromise
+
+
+## Security Philosophy
+Ship MVPs fast, but never ship carelessly. Security is non-negotiable. The baseline checklist above is the minimum gate for every production deployment; the sections above it are the depth and reasoning behind each control.

package/rules/cloudflare/seeding.md

@@ -0,0 +1,27 @@
+# Seeding Policy
+
+## Seeding Standards
+- Create seed file at `/server/db/seed.ts`
+- Seed only essential baseline data required for application function
+- Implement idempotent insert logic (check before inserting)
+- Run seeds in development and staging environments only
+- Never seed large dummy datasets
+- Never run seeds in production unless explicitly required for initial setup
+
+## What to Seed
+Seed only:
+- Default user roles
+- Initial admin accounts
+- Required configuration data
+- Essential lookup tables
+
+## What NOT to Seed
+- Test data (belongs in test setup)
+- Large sample datasets
+- User-generated content
+- Environment-specific production data
+
+## Execution
+- Ensure seeds can be run multiple times safely
+- Log seed operations for visibility
+- Keep seed scripts minimal and maintainable