Mike Swanson
bfcdbb5379
SPEC-002 Phase 1 Task 4 (the final keystone task), code-reviewed APPROVED. Closes the audit's reusable-code HIGH and rate-limiting-disabled HIGH. - Rebuilt rate limiting as a self-contained in-memory per-IP limiter (replaces the non-compiling tower_governor; removed that dep). Fixed-window caps wired to login (8/min), change-password (5/min), code-validate (15/min) -> 429; per-IP lockout after 10 consecutive failed code validations (15-min cooldown). - Single-use support codes: atomic consume on first agent bind (in-memory Pending->Connected under write lock + DB conditional UPDATE), rejecting a second presenter; validate/preview does not consume. - Widened code format: XXX-XXX-XXX, 31-char unambiguous alphabet (no 0/O/1/I/L), CSPRNG + rejection sampling, ~44.6 bits (replaces 6-digit numeric); migration 006 widens the code columns to TEXT. Completes the keystone (Tasks 1-4): every audit CRITICAL + HIGH in the secure auth/session core is now addressed. Known follow-up todos (not blocking): (1) trusted-proxy client-IP extraction (NPM-on-loopback collapses clients to 127.0.0.1); (2) multi-instance fail-closed DB single-use gate. Not cargo-check-verified locally - build-host/CI verification follows this commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
65 lines
1.4 KiB
TOML
65 lines
1.4 KiB
TOML
[package]
|
|
name = "guruconnect-server"
|
|
version = "0.2.0"
|
|
edition = "2021"
|
|
authors = ["AZ Computer Guru"]
|
|
description = "GuruConnect Remote Desktop Relay Server"
|
|
|
|
[dependencies]
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full", "sync", "time", "rt-multi-thread", "macros"] }
|
|
|
|
# Web framework
|
|
axum = { version = "0.7", features = ["ws", "macros"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace", "compression-gzip", "fs"] }
|
|
# NOTE: tower_governor removed in Task 4 — its rate-limit layer never compiled in
|
|
# this codebase (the GovernorLayer generic signature it required is not in the
|
|
# crate's public API). Replaced by the in-memory limiter in middleware/rate_limit.rs.
|
|
|
|
# WebSocket
|
|
futures-util = "0.3"
|
|
|
|
# Database
|
|
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "uuid", "chrono", "json"] }
|
|
|
|
# Protocol (protobuf)
|
|
prost = "0.13"
|
|
prost-types = "0.13"
|
|
bytes = "1"
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# Error handling
|
|
anyhow = "1"
|
|
thiserror = "1"
|
|
|
|
# Configuration
|
|
toml = "0.8"
|
|
|
|
# Auth
|
|
jsonwebtoken = "9"
|
|
argon2 = "0.5"
|
|
|
|
# Crypto
|
|
ring = "0.17"
|
|
|
|
# UUID
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
|
|
# Time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
rand = "0.8"
|
|
|
|
# Monitoring
|
|
prometheus-client = "0.22"
|
|
|
|
[build-dependencies]
|
|
prost-build = "0.13"
|