351b14a78c
CRITICAL fixes: - Restrict X-View-Tenant impersonation to global admin only (was any admin) - Add authorization to subscription endpoints (was open to any user) - Make webhook signature verification mandatory (was skippable) - Remove databaseName from JWT payload (resolve server-side with cache) - Reduce body size limit from 1GB to 10MB (50MB for bulk CFDI) - Restrict .env file permissions to 600 HIGH fixes: - Add authorization to SAT cron endpoints (global admin only) - Add Content-Security-Policy and Permissions-Policy headers - Centralize isGlobalAdmin() utility with caching - Add rate limiting on auth endpoints (express-rate-limit) - Require authentication on logout endpoint MEDIUM fixes: - Replace Math.random() with crypto.randomBytes for temp passwords - Remove console.log of temporary passwords in production - Remove DB credentials from admin notification email - Add escapeHtml() to email templates (prevent HTML injection) - Add file size validation on FIEL upload (50KB max) - Require TLS for SMTP connections - Normalize email to lowercase before uniqueness check - Remove hardcoded default for FIEL_ENCRYPTION_KEY Also includes: - Complete production deployment documentation - API reference documentation - Security audit report with remediation details - Updated README with v0.5.0 changelog - New client admin email template - Utility scripts (create-carlos, test-emails) - PM2 ecosystem config updates Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
55 lines
1.4 KiB
JSON
55 lines
1.4 KiB
JSON
{
|
|
"name": "@horux/api",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "tsx watch src/index.ts",
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"lint": "eslint src/",
|
|
"typecheck": "tsc --noEmit",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:seed": "tsx prisma/seed.ts"
|
|
},
|
|
"dependencies": {
|
|
"@horux/shared": "workspace:*",
|
|
"@nodecfdi/cfdi-core": "^1.0.1",
|
|
"@nodecfdi/credentials": "^3.2.0",
|
|
"@nodecfdi/sat-ws-descarga-masiva": "^2.0.0",
|
|
"@prisma/client": "^5.22.0",
|
|
"adm-zip": "^0.5.16",
|
|
"bcryptjs": "^2.4.3",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^17.2.3",
|
|
"exceljs": "^4.4.0",
|
|
"express": "^4.21.0",
|
|
"fast-xml-parser": "^5.3.3",
|
|
"helmet": "^8.0.0",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"mercadopago": "^2.12.0",
|
|
"node-cron": "^4.2.1",
|
|
"node-forge": "^1.3.3",
|
|
"nodemailer": "^8.0.2",
|
|
"pg": "^8.18.0",
|
|
"zod": "^3.23.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/adm-zip": "^0.5.7",
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/cors": "^2.8.17",
|
|
"@types/express": "^5.0.0",
|
|
"@types/jsonwebtoken": "^9.0.7",
|
|
"@types/node": "^22.0.0",
|
|
"@types/node-cron": "^3.0.11",
|
|
"@types/node-forge": "^1.3.14",
|
|
"@types/nodemailer": "^7.0.11",
|
|
"@types/pg": "^8.18.0",
|
|
"express-rate-limit": "^8.3.1",
|
|
"prisma": "^5.22.0",
|
|
"tsx": "^4.19.0",
|
|
"typescript": "^5.3.0"
|
|
}
|
|
}
|