mirror of
https://github.com/makeplane/plane.git
synced 2026-06-14 03:30:00 +00:00
sriram veeraghanta
edf2475413
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
120 lines
1.2 KiB
Plaintext
120 lines
1.2 KiB
Plaintext
node_modules
|
|
.next
|
|
.yarn
|
|
|
|
### NextJS ###
|
|
# Dependencies
|
|
/node_modules
|
|
/.pnp
|
|
.pnp.js
|
|
|
|
# Testing
|
|
/coverage
|
|
|
|
# Next.js
|
|
/.next/
|
|
/out/
|
|
|
|
# Production
|
|
dist/
|
|
out/
|
|
build/
|
|
.react-router/
|
|
|
|
# Misc
|
|
.DS_Store
|
|
*.pem
|
|
.history
|
|
tsconfig.tsbuildinfo
|
|
|
|
# Debug
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
pnpm-debug.log*
|
|
.pnpm-debug.log*
|
|
|
|
# Local env files
|
|
.env
|
|
.env.local
|
|
.env.development.local
|
|
.env.test.local
|
|
.env.production.local
|
|
|
|
# Vercel
|
|
.vercel
|
|
|
|
# Turborepo
|
|
.turbo
|
|
|
|
## Django ##
|
|
venv
|
|
.venv
|
|
*.pyc
|
|
staticfiles
|
|
mediafiles
|
|
.env
|
|
.DS_Store
|
|
logs/
|
|
htmlcov/
|
|
.coverage
|
|
|
|
node_modules/
|
|
assets/dist/
|
|
npm-debug.log
|
|
yarn-error.log
|
|
pnpm-debug.log
|
|
|
|
# Editor directories and files
|
|
.idea
|
|
*.suo
|
|
*.ntvs*
|
|
*.njsproj
|
|
*.sln
|
|
package-lock.json
|
|
.vscode
|
|
|
|
# Sentry
|
|
.sentryclirc
|
|
|
|
# lock files
|
|
package-lock.json
|
|
|
|
|
|
|
|
.secrets
|
|
tmp/
|
|
|
|
## packages
|
|
dist
|
|
.temp/
|
|
deploy/selfhost/plane-app/
|
|
|
|
## Storybook
|
|
*storybook.log
|
|
output.css
|
|
|
|
dev-editor
|
|
# Redis
|
|
*.rdb
|
|
*.rdb.gz
|
|
|
|
storybook-static
|
|
|
|
CLAUDE.md
|
|
|
|
build/
|
|
.react-router/
|
|
|
|
build/
|
|
.react-router/
|
|
temp/
|
|
scripts/
|
|
!packages/i18n/scripts/
|
|
|
|
# i18n auto-generated types (regenerated on every build)
|
|
packages/i18n/src/types/keys.generated.ts
|
|
|
|
# Local security advisory notes (not for version control)
|
|
/advisories.md
|