maaz519
f2d590b04d
Applies the context-attestation verifier at the request boundary via a guard, so a stolen/forged/replayed attestation is rejected before IIOS acts — while staying safe to roll out. - ContextAttestationGuard: if an X-Context-Attestation header is present, verify it (its app_id must match the actor token's app_id) → 403 on any failure; if absent, allow only when IIOS_REQUIRE_ATTESTATION != 1 (dev/zero-trust), else 403. The flag is read per-request and defaults OFF, so existing callers keep working until AppShell/ be-crm start forwarding attestations. - AttestationModule (@Global): provides the verifier + Prisma stores + guard, and dev-seeds the crm-support-widget client so locally minted attestations verify. - Guard applied to ThreadsController + SupportController. - Tests (5 pass, no DB): not-required-allows, required-rejects, valid, forged, replayed. Workload/mTLS (proof #2) stays a mesh concern. Next: SDK header passthrough + demote be-crm IiosClient to forward an attestation, then flip the flag to prove end-to-end. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
54 lines
2.0 KiB
TypeScript
54 lines
2.0 KiB
TypeScript
import { Module } from '@nestjs/common';
|
|
import { PrismaModule } from './prisma/prisma.module';
|
|
import { PlatformModule } from './platform/platform.module';
|
|
import { AttestationModule } from './platform/attestation.module';
|
|
import { IdentityModule } from './identity/identity.module';
|
|
import { InteractionsModule } from './interactions/interactions.module';
|
|
import { IdempotencyModule } from './idempotency/idempotency.module';
|
|
import { ProjectionModule } from './projection/projection.module';
|
|
import { OutboxModule } from './outbox/outbox.module';
|
|
import { ThreadsModule } from './threads/threads.module';
|
|
import { MessageModule } from './messaging/message.module';
|
|
import { InboxModule } from './inbox/inbox.module';
|
|
import { MediaModule } from './media/media.module';
|
|
import { NotificationModule } from './notifications/notification.module';
|
|
import { SupportModule } from './support/support.module';
|
|
import { AdaptersModule } from './adapters/adapters.module';
|
|
import { RoutingModule } from './routing/routing.module';
|
|
import { AiModule } from './ai/ai.module';
|
|
import { CalendarModule } from './calendar/calendar.module';
|
|
import { CapabilityModule } from './capability/capability.module';
|
|
import { DsrModule } from './dsr/dsr.module';
|
|
import { RetentionModule } from './retention/retention.module';
|
|
import { HealthController } from './health.controller';
|
|
import { MetricsController } from './observability/metrics.controller';
|
|
import { DevController } from './dev/dev.controller';
|
|
|
|
@Module({
|
|
imports: [
|
|
PrismaModule,
|
|
PlatformModule,
|
|
AttestationModule,
|
|
IdentityModule,
|
|
InteractionsModule,
|
|
IdempotencyModule,
|
|
ProjectionModule,
|
|
OutboxModule,
|
|
ThreadsModule,
|
|
MessageModule,
|
|
InboxModule,
|
|
MediaModule,
|
|
NotificationModule,
|
|
SupportModule,
|
|
AdaptersModule,
|
|
RoutingModule,
|
|
AiModule,
|
|
CalendarModule,
|
|
CapabilityModule,
|
|
DsrModule,
|
|
RetentionModule,
|
|
],
|
|
controllers: [HealthController, MetricsController, DevController],
|
|
})
|
|
export class AppModule {}
|