247ea45408
Audit de securitate executat pe Backend (FastAPI) si Frontend (Next.js/Dexie). 12 vulnerabilitati identificate (4 CRITICE, 4 HIGH, 3 MEDIUM, 1 LOW). Patch-uri aplicate direct: - [C-02] Eliminat bypass autentificare pentru useri fara parola (users.py) - [C-03] Parola default Admin inlocuita cu secrets.token_urlsafe(16) (users.py) - [H-01] LDAP injection fix: escape_filter_chars pe username (users.py) - [H-03] Validare MIME + limita 10MB pe /items/extract-label (items.py) - [M-01] CORS fix: allow_origins din env ALLOWED_ORIGINS, nu wildcard (main.py) - [M-03] Toate print() LDAP inlocuite cu log.debug() (users.py) Raport complet: dev_docs/SECURITY_REPORT.md Actiuni arhitecturale ramase (JWT enforcement, rate limiting): SESSION_STATE.md Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
import os
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from . import models
|
|
from .database import engine
|
|
from .routers import items, operations, users, categories
|
|
from .logger import log
|
|
|
|
# Create the database tables
|
|
models.Base.metadata.create_all(bind=engine)
|
|
log.info("Database tables verified.")
|
|
|
|
app = FastAPI(title="TFM aInventory API", version="1.1.0")
|
|
log.info("TFM aInventory API process started.")
|
|
|
|
# [SECURITY FIX M-01] CORS: allow_origins=["*"] + allow_credentials=True este invalid per spec.
|
|
# Originile permise se configurează via variabila de mediu ALLOWED_ORIGINS (comma-separated).
|
|
# Fallback sigur: doar localhost pentru development.
|
|
_raw_origins = os.environ.get("ALLOWED_ORIGINS", "http://localhost:3000,http://localhost:3002")
|
|
ALLOWED_ORIGINS = [o.strip() for o in _raw_origins.split(",") if o.strip()]
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=ALLOWED_ORIGINS,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
app.include_router(items.router)
|
|
app.include_router(operations.router)
|
|
app.include_router(users.router)
|
|
app.include_router(categories.router)
|
|
|
|
@app.get("/")
|
|
def read_root():
|
|
return {"message": "Inventory API is running"}
|