csrd-utils 0.5.2__tar.gz → 0.5.3__tar.gz

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.5.2
+Version: 0.5.3
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.5.2"
+version = "0.5.3"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/src/csrd_utils/audit.py

@@ -39,6 +39,13 @@ class AuditReport:
 
 _WEAK_PASSWORDS = r"(?:change_me|change_me_root|app|sandbox|password|root)"
 _WEAK_IDENTIFIERS = r"(?:service_user|service_db|app|sandbox)"
+_WEAK_JWT_SECRETS = r"(?:changeme[^\s]*|secret|test|jwt[_-]?secret|please[_-]?change)"
+
+# Infra ports that should not be host-bound in production
+_INFRA_PORT_PATTERNS = re.compile(
+    r'"(?:0\.0\.0\.0:)?(\d+):(\d+)"',
+)
+_SENSITIVE_INFRA_PORTS = {"5432", "3306", "6379", "5672", "15672", "27017"}
 
 
 def _scan_file(path: Path, root: Path) -> list[AuditFinding]:
@@ -150,6 +157,114 @@ def _scan_file(path: Path, root: Path) -> list[AuditFinding]:
             )
         )
 
+    # ── New rules (M3 expansion) ──────────────────────────────────────
+
+    # Weak JWT secret
+    jwt_hits = re.findall(
+        rf"JWT_SECRET\s*[:=]\s*['\"]?({_WEAK_JWT_SECRETS})['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if jwt_hits:
+        findings.append(
+            AuditFinding(
+                rule="weak-jwt-secret",
+                severity="high",
+                message="JWT signing secret uses a weak or default value.",
+                file=rel,
+                evidence=jwt_hits[0],
+                remediation='Generate a strong random secret: python -c "import secrets; print(secrets.token_urlsafe(48))"',
+            )
+        )
+
+    # Weak RabbitMQ password
+    rabbit_pw_hits = re.findall(
+        rf"RABBITMQ_(?:DEFAULT_)?PASS(?:WORD)?\s*[:=]\s*['\"]?({_WEAK_PASSWORDS})['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if rabbit_pw_hits:
+        findings.append(
+            AuditFinding(
+                rule="weak-rabbitmq-password",
+                severity="high",
+                message="RabbitMQ password uses a weak default.",
+                file=rel,
+                evidence=rabbit_pw_hits[0],
+                remediation="Set a strong RABBITMQ_PASSWORD via environment configuration.",
+            )
+        )
+
+    # Redis URL without authentication
+    redis_no_auth = re.findall(
+        r"(?:REDIS_URL|BROKER_URL|CELERY_BROKER_URL|RESULT_BACKEND)\s*[:=]\s*['\"]?(redis://[^:@\s]*:\d+)",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if redis_no_auth:
+        findings.append(
+            AuditFinding(
+                rule="redis-no-auth",
+                severity="medium",
+                message="Redis URL has no password — any network client can read/write data.",
+                file=rel,
+                evidence=redis_no_auth[0],
+                remediation="Add requirepass to Redis and use redis://:PASSWORD@host:port in URLs.",
+            )
+        )
+
+    # Exposed infra ports in docker-compose (only scan compose files)
+    if path.name in ("docker-compose.yml", "docker-compose.yaml"):
+        for match in _INFRA_PORT_PATTERNS.finditer(text):
+            host_port = match.group(1)
+            if host_port in _SENSITIVE_INFRA_PORTS:
+                # Check if bound to 127.0.0.1 — that's acceptable
+                full_match = match.group(0)
+                if "127.0.0.1" not in full_match:
+                    findings.append(
+                        AuditFinding(
+                            rule="exposed-infra-port",
+                            severity="medium",
+                            message=f"Infrastructure port {host_port} is bound to all interfaces.",
+                            file=rel,
+                            evidence=full_match,
+                            remediation="Bind to 127.0.0.1 for dev or remove host mapping for prod.",
+                        )
+                    )
+
+    # Debug mode enabled
+    debug_hits = re.findall(
+        r"(?:^|\n)\s*DEBUG\s*[:=]\s*['\"]?(?:true|1|yes)['\"]?",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if debug_hits:
+        findings.append(
+            AuditFinding(
+                rule="debug-mode-enabled",
+                severity="medium",
+                message="Debug mode is enabled — may expose stack traces and internal state.",
+                file=rel,
+                evidence="DEBUG=true",
+                remediation="Set DEBUG=false in production environments.",
+            )
+        )
+
+    # Shell-form CMD in Dockerfiles (no signal forwarding)
+    if path.name.startswith("Dockerfile"):
+        cmd_hits = re.findall(r"^CMD\s+(?!exec\b)(?!\[)(.+)$", text, flags=re.MULTILINE)
+        if cmd_hits:
+            findings.append(
+                AuditFinding(
+                    rule="shell-form-cmd",
+                    severity="medium",
+                    message="Dockerfile CMD uses shell form without exec — no signal forwarding.",
+                    file=rel,
+                    evidence=f"CMD {cmd_hits[0][:60]}",
+                    remediation="Use 'CMD exec ...' or CMD in JSON array form for proper signal handling.",
+                )
+            )
+
     return findings
 
 
@@ -172,12 +287,23 @@ def run_audit(service_root: Path) -> AuditReport:
         return AuditReport(ok=False, findings=findings)
 
     candidates: list[Path] = []
-    include_names = {"docker-compose.yml", ".env", ".env.example", "README.md", "settings.py"}
+    include_names = {
+        "docker-compose.yml",
+        "docker-compose.yaml",
+        ".env",
+        ".env.example",
+        "README.md",
+        "settings.py",
+    }
 
     for path in root.rglob("*"):
         if not path.is_file():
             continue
-        if path.name in include_names or path.suffix in {".py", ".yml", ".yaml", ".env", ".md"}:
+        if (
+            path.name in include_names
+            or path.name.startswith("Dockerfile")
+            or path.suffix in {".py", ".yml", ".yaml", ".env", ".md"}
+        ):
             candidates.append(path)
 
     seen: set[tuple[str, str, str]] = set()

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/src/csrd_utils/compose/operations.py

@@ -72,11 +72,12 @@ def render_workspace(output_dir: Path, *, git_init: bool = False) -> Path:
     env_example_content = _render_env_example(spec)
     (output_dir / ".env.example").write_text(env_example_content, encoding="utf-8")
 
-    # Seed .env from .env.example so services can start immediately.
-    # Always overwritten to stay in sync — user overrides belong in
-    # docker-compose overrides or a .env.local (not tracked).
+    # Seed .env from .env.example only on first render so services can
+    # start immediately.  On subsequent renders the user may have set
+    # strong passwords or API keys — never overwrite those.
     env_path = output_dir / ".env"
-    env_path.write_text(env_example_content, encoding="utf-8")
+    if not env_path.exists():
+        env_path.write_text(env_example_content, encoding="utf-8")
     (output_dir / "README.md").write_text(_render_readme(spec), encoding="utf-8")
     (output_dir / ".gitignore").write_text(_render_gitignore(), encoding="utf-8")
     (output_dir / ".dockerignore").write_text(_render_dockerignore(), encoding="utf-8")

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/src/csrd_utils/compose/renderer.py

@@ -614,7 +614,16 @@ def _render_gateway_routes(spec: ComposeSpec) -> str | None:
     if not routes:
         return None
 
+    gateway = next(s for s in spec.services if s.role == "gateway")
+
     lines = ["# Gateway route table — auto-generated, but safe to edit manually.", "routes:"]
+
+    # Health probe must bypass the JWT guard so Docker HEALTHCHECK and
+    # external load balancers can reach it without credentials.
+    lines.append('  - prefix: "/_info/health"')
+    lines.append(f'    target: "http://{gateway.name}:{gateway.port}"')
+    lines.append("    public: true")
+
     for route in routes:
         lines.append(f'  - prefix: "{route["prefix"]}"')
         lines.append(f'    target: "{route["target"]}"')

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/src/csrd_utils/templates/augments/gateway/middleware/auth_guard.py.template

@@ -60,9 +60,6 @@ class GatewayAuthMiddleware(BaseHTTPMiddleware):
             if path.startswith(prefix):
                 return await call_next(request)
 
-        # Allow health/actuator endpoints on the gateway itself
-        if path in ("/health", "/actuator/health", "/actuator/info"):
-            return await call_next(request)
 
         # Validate JWT
         auth_header = request.headers.get("authorization", "")

csrd_utils-0.5.3/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/Dockerfile

@@ -0,0 +1,11 @@
+FROM python:3.12-slim AS base
+WORKDIR /app
+COPY ./src/{{cookiecutter.__service_name_snake}}/requirements.txt /app/requirements.txt
+RUN pip install --no-cache-dir -r /app/requirements.txt
+COPY ./src/{{cookiecutter.__service_name_snake}} /app/{{cookiecutter.__service_name_snake}}
+RUN adduser --system --no-create-home appuser
+USER appuser
+ENV PORT={{ cookiecutter.port }}
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:${PORT}/_info/health')" || exit 1
+CMD exec uvicorn {{cookiecutter.__service_name_snake}}:build_app --factory --host 0.0.0.0 --port ${PORT}

{csrd_utils-0.5.2 → csrd_utils-0.5.3}/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/views/__init__.py

@@ -1,9 +1,6 @@
 from fastapi import FastAPI
 
-from . import health_view
-
 app = FastAPI(title="{{ cookiecutter.service_name }}")
 
-app.include_router(health_view.router)
 
 __all__ = ("app",)

csrd_utils-0.5.2/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/Dockerfile

@@ -1,7 +0,0 @@
-FROM python:3.12-slim
-WORKDIR /app
-COPY ./src/{{cookiecutter.__service_name_snake}}/requirements.txt /app/requirements.txt
-RUN pip install --no-cache-dir -r /app/requirements.txt
-COPY ./src/{{cookiecutter.__service_name_snake}} /app/{{cookiecutter.__service_name_snake}}
-ENV PORT={{ cookiecutter.port }}
-CMD uvicorn {{cookiecutter.__service_name_snake}}:build_app --factory --host 0.0.0.0 --port ${PORT}

csrd_utils-0.5.2/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/models/health.py

@@ -1,10 +0,0 @@
-"""Health check models."""
-
-from csrd.models import BaseModel
-
-
-class HealthResponse(BaseModel):
-    """Health check response."""
-
-    status: str
-    service: str

csrd_utils-0.5.2/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/tests/test_health.py

@@ -1,7 +0,0 @@
-"""Health endpoint tests for {{ cookiecutter.service_name }}."""
-
-
-def test_health(client):
-    response = client.get("/health")
-    assert response.status_code == 200
-    assert response.json() == {"status": "ok", "service": "{{ cookiecutter.service_name }}"}

csrd_utils-0.5.2/src/csrd_utils/templates/service/{{cookiecutter.__service_name_snake}}/views/health_view.py

@@ -1,11 +0,0 @@
-from fastapi import APIRouter
-
-from ..models.health import HealthResponse
-
-router = APIRouter(tags=["Health"])
-
-
-
-@router.get("/health", response_model=HealthResponse)
-def health() -> HealthResponse:
-    return HealthResponse(status="ok", service="{{ cookiecutter.service_name }}")