shancheas
44b0ef0168
- Added a new `api.md` file detailing the TrackGo HTTP API, including agent rules, authentication mechanisms, and global HTTP contracts. - Established a new RBAC (Role-Based Access Control) framework in `web-rbac.mdc` to ensure all product modules in `apps/web` are gated by permissions from `GET /auth/me`. - Updated security and web module architecture rules to incorporate RBAC requirements, ensuring consistent application of permissions across modules. This commit enhances the project's API clarity and security by providing a structured approach to user permissions and interactions.
59 lines
2.1 KiB
Plaintext
59 lines
2.1 KiB
Plaintext
---
|
|
description: Mandatory security checks for this SPA/Electron frontend
|
|
alwaysApply: true
|
|
---
|
|
|
|
# Security Guidelines
|
|
|
|
## Mandatory Security Checks
|
|
|
|
Before ANY commit:
|
|
|
|
- [ ] No hardcoded secrets (API keys, passwords, tokens)
|
|
- [ ] All user inputs validated (Zod + `@repo/ui/validators`)
|
|
- [ ] XSS prevention — React text nodes by default; never unsanitized `dangerouslySetInnerHTML`
|
|
- [ ] Auth tokens only via `src/core/lib/auth.helper` and the shared `apiClient` interceptors
|
|
- [ ] Product modules in `apps/web` wire RBAC (`moduleKey` + menu `moduleKey`); see `web-rbac.mdc`
|
|
- [ ] No secrets in client bundles; env files only under `apps/*/.env*`
|
|
- [ ] Error messages shown to users do not leak tokens or stack traces
|
|
|
|
This is a browser/Electron client. Do not invent SQL injection, CSRF-on-API-endpoints, or API rate-limiting checks here — those belong to the backend.
|
|
|
|
## Secret Management
|
|
|
|
```typescript
|
|
// NEVER: Hardcoded secrets
|
|
const apiKey = "sk-proj-xxxxx"
|
|
|
|
// ALWAYS: App env wrapper (apps/web)
|
|
import { ENV } from '../environment'
|
|
|
|
if (!ENV.API_BASE_URL) {
|
|
throw new Error('VITE_API_BASE_URL is not configured')
|
|
}
|
|
```
|
|
|
|
- Env files: `apps/web/.env*` (see `apps/web/.env.example`). Never at monorepo root.
|
|
- Components read `ENV` from `src/core/environment`, not `import.meta.env` directly.
|
|
- `VITE_*` values are public to the client. Do not put private credentials in Vite env except documented local-dev CouchDB fields.
|
|
|
|
## Auth and storage
|
|
|
|
- HTTP: singleton `apiClient` from `src/core/lib/api-client` — never raw axios.
|
|
- Session teardown: `terminateAuthSession` in `auth.helper`.
|
|
- Do not store tokens in source. Do not log access tokens.
|
|
|
|
## Electron
|
|
|
|
When touching `apps/desktop/`: keep `contextIsolation: true`, `nodeIntegration: false`, `sandbox: true`. Do not expose Node APIs on `window` outside the existing preload bridge.
|
|
|
|
## Security Response Protocol
|
|
|
|
If a security issue is found:
|
|
|
|
1. STOP immediately
|
|
2. Use **security-reviewer** agent
|
|
3. Fix CRITICAL issues before continuing
|
|
4. Rotate any exposed secrets
|
|
5. Review the rest of the codebase for the same pattern
|