maaz519
f2d590b04d
Applies the context-attestation verifier at the request boundary via a guard, so a stolen/forged/replayed attestation is rejected before IIOS acts — while staying safe to roll out. - ContextAttestationGuard: if an X-Context-Attestation header is present, verify it (its app_id must match the actor token's app_id) → 403 on any failure; if absent, allow only when IIOS_REQUIRE_ATTESTATION != 1 (dev/zero-trust), else 403. The flag is read per-request and defaults OFF, so existing callers keep working until AppShell/ be-crm start forwarding attestations. - AttestationModule (@Global): provides the verifier + Prisma stores + guard, and dev-seeds the crm-support-widget client so locally minted attestations verify. - Guard applied to ThreadsController + SupportController. - Tests (5 pass, no DB): not-required-allows, required-rejects, valid, forged, replayed. Workload/mTLS (proof #2) stays a mesh concern. Next: SDK header passthrough + demote be-crm IiosClient to forward an attestation, then flip the flag to prove end-to-end. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
62 lines
4.7 KiB
Bash
62 lines
4.7 KiB
Bash
# ─────────────────────────────────────────────────────────────────────────────
|
|
# iios-service configuration contract.
|
|
# Copy to `.env` for local dev; in prod, inject via your secrets manager / orchestrator.
|
|
# 🔒 = secret (never commit a real value). ⚠️ = must be set correctly for prod safety.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# ── Core ─────────────────────────────────────────────────────────────────────
|
|
DATABASE_URL=postgresql://iios:iios@localhost:5434/iios?schema=public # 🔒 Postgres connection
|
|
PORT=3200
|
|
# NODE_ENV=production # set by the Docker image
|
|
# Realtime fan-out across replicas (socket.io Redis adapter). REQUIRED when running
|
|
# more than one instance with live chat; omit for a single instance (in-memory adapter).
|
|
# REDIS_URL=redis://localhost:6379 # 🔒
|
|
|
|
# ── Secrets ──────────────────────────────────────────────────────────────────
|
|
# JSON map of appId → HS256 signing secret used to verify session JWTs (SessionVerifier).
|
|
APP_SECRETS={"portal-demo":"dev-secret"} # 🔒
|
|
# JSON map of channelType → inbound webhook HMAC secret (adapter signature check).
|
|
ADAPTER_SECRETS={"WEBHOOK":"dev-adapter-secret"} # 🔒
|
|
# Default scope an unauthenticated adapter webhook ingests into.
|
|
ADAPTER_APP=portal-demo
|
|
ADAPTER_ORG=org_demo
|
|
|
|
# ── ⚠️ Production-safety flags ────────────────────────────────────────────────
|
|
# Enables /v1/dev/* (token mint, webhook inject, chaos, retention sweep). MUST be unset
|
|
# or 0 in production — leaving it on exposes unauthenticated token minting.
|
|
IIOS_DEV_TOKENS=0
|
|
# Skip `prisma migrate deploy` at boot (set to 1 when a separate migration job runs).
|
|
IIOS_SKIP_MIGRATE=0
|
|
|
|
# ── Tenant isolation ─────────────────────────────────────────────────────────
|
|
IIOS_CELL_ID=cell-default # physical cell this instance serves (blast-radius partition)
|
|
|
|
# ── Background workers ───────────────────────────────────────────────────────
|
|
IIOS_RELAY_INTERVAL_MS=500 # outbox relay tick; 0 disables the timer
|
|
IIOS_OUTBOX_MAX_ATTEMPTS=5 # relay dead-letters an event after N failed publishes
|
|
IIOS_RETENTION_SWEEP_INTERVAL_MS=0 # retention sweep tick; 0 disables (run via job instead)
|
|
IIOS_RETENTION_POLICY_VERSION=v1
|
|
IIOS_RETENTION_ARCHIVE_DAYS=90 # default archive window (per-class override: _INTERNAL/_RESTRICTED/_CONFIDENTIAL/_REGULATED)
|
|
IIOS_RETENTION_DELETE_DAYS=365 # default delete (redact) window; same per-class overrides
|
|
|
|
# ── Rate limits / quotas / budgets ───────────────────────────────────────────
|
|
IIOS_OUTBOUND_LIMIT=5 # per-(channel,target) sends per window
|
|
IIOS_OUTBOUND_WINDOW_MS=60000
|
|
IIOS_TENANT_OUTBOUND_LIMIT=10000 # per-tenant egress cap per window (noisy-neighbor guard)
|
|
IIOS_TENANT_OUTBOUND_WINDOW_MS=60000
|
|
IIOS_AI_BUDGET_UNITS=100000 # per-scope AI cost-unit budget (KG-12)
|
|
|
|
# ── Capability providers (governed egress targets) ───────────────────────────
|
|
# Per-channel provider endpoint the CapabilityBroker calls, e.g.:
|
|
# IIOS_PROVIDER_URL_EMAIL=https://provider.internal/email
|
|
|
|
# ── Context attestation (July 12 trust layer) ──
|
|
# Audience IIOS requires on attestations addressed to it.
|
|
IIOS_ATTESTATION_AUDIENCE=iios-core
|
|
# Dev only: shared HS256 secret AppShell's stand-in signs attestations with (seeds the
|
|
# crm-support-widget client into the registry when IIOS_DEV_TOKENS=1).
|
|
# IIOS_ATTESTATION_DEV_SECRET=appshell-dev-signing-key
|
|
# When '1', every guarded request MUST carry a valid X-Context-Attestation (else 403).
|
|
# Leave OFF until callers (AppShell/be-crm) forward attestations. Verified-if-present regardless.
|
|
IIOS_REQUIRE_ATTESTATION=0
|