351b14a78c
CRITICAL fixes: - Restrict X-View-Tenant impersonation to global admin only (was any admin) - Add authorization to subscription endpoints (was open to any user) - Make webhook signature verification mandatory (was skippable) - Remove databaseName from JWT payload (resolve server-side with cache) - Reduce body size limit from 1GB to 10MB (50MB for bulk CFDI) - Restrict .env file permissions to 600 HIGH fixes: - Add authorization to SAT cron endpoints (global admin only) - Add Content-Security-Policy and Permissions-Policy headers - Centralize isGlobalAdmin() utility with caching - Add rate limiting on auth endpoints (express-rate-limit) - Require authentication on logout endpoint MEDIUM fixes: - Replace Math.random() with crypto.randomBytes for temp passwords - Remove console.log of temporary passwords in production - Remove DB credentials from admin notification email - Add escapeHtml() to email templates (prevent HTML injection) - Add file size validation on FIEL upload (50KB max) - Require TLS for SMTP connections - Normalize email to lowercase before uniqueness check - Remove hardcoded default for FIEL_ENCRYPTION_KEY Also includes: - Complete production deployment documentation - API reference documentation - Security audit report with remediation details - Updated README with v0.5.0 changelog - New client admin email template - Utility scripts (create-carlos, test-emails) - PM2 ecosystem config updates Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
832 B
JavaScript
37 lines
832 B
JavaScript
module.exports = {
|
|
apps: [
|
|
{
|
|
name: 'horux-api',
|
|
interpreter: 'node',
|
|
script: '/root/Horux/node_modules/.pnpm/tsx@4.21.0/node_modules/tsx/dist/cli.mjs',
|
|
args: 'src/index.ts',
|
|
cwd: '/root/Horux/apps/api',
|
|
instances: 1,
|
|
exec_mode: 'fork',
|
|
autorestart: true,
|
|
max_memory_restart: '1G',
|
|
kill_timeout: 5000,
|
|
listen_timeout: 10000,
|
|
env: {
|
|
NODE_ENV: 'production',
|
|
PORT: 4000,
|
|
},
|
|
},
|
|
{
|
|
name: 'horux-web',
|
|
script: 'node_modules/next/dist/bin/next',
|
|
args: 'start',
|
|
cwd: '/root/Horux/apps/web',
|
|
instances: 1,
|
|
exec_mode: 'fork',
|
|
autorestart: true,
|
|
max_memory_restart: '512M',
|
|
kill_timeout: 5000,
|
|
env: {
|
|
NODE_ENV: 'production',
|
|
PORT: 3000,
|
|
},
|
|
},
|
|
],
|
|
};
|