From b924e590485a9e34826f55fdc35b4a85d7c08a92 Mon Sep 17 00:00:00 2001
From: Krishna Suravarapu <36037520+KrishnaSuravarapu@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:51:44 +0530
Subject: [PATCH 1/3] security(hardening): CSP + headers, secrets untrack,
 DB/redis loopback, non-root app, OAuth log redaction, image provenance

Addresses the in-repo legs of the open attack-chain tickets in one change
(rate-limiting excluded - django-axes already enforces login lockout).

- C-002: add django-csp CSPMiddleware + CSP policy, X-Frame-Options DENY,
  nosniff, referrer-policy (settings.py, requirements.txt)
- C-004: untrack secrets/*.env (add .sample templates + .gitignore); bind
  MySQL and Redis to 127.0.0.1 so the DB is not network-reachable
- C-001/C-003: app user gets its own group (not gid 0) and log file is no
  longer world-writable (Dockerfile)
- C-005: attach SLSA provenance + SBOM to the pushed image (actions already
  SHA-pinned)
- C-008: drop social_core.pipeline.debug.debug (logs OAuth tokens/PII) and
  lower app log level DEBUG -> INFO

Not in this PR (cannot be code): rotating the previously-committed secrets
(ops runbook), production bind-mount removal (deploy manifests repo), the
F-022 self-approval IDOR decision, and a password-history validator.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/docker-push.yml             |  4 +++
 .gitignore                                    |  4 +++
 Dockerfile                                    | 11 +++++--
 EnigmaAutomation/settings.py                  | 32 +++++++++++++++++--
 docker-compose.yml                            |  7 ++--
 requirements.txt                              |  1 +
 secrets/ops_app_celery.env                    |  5 ---
 secrets/ops_app_celery.env.sample             |  5 +++
 secrets/ops_app_dev.env                       |  2 --
 secrets/ops_app_dev.env.sample                |  2 ++
 secrets/ops_app_test.env                      |  2 --
 secrets/ops_app_test.env.sample               |  2 ++
 ...mysql_dev.env => ops_mysql_dev.env.sample} |  2 +-
 13 files changed, 62 insertions(+), 17 deletions(-)
 delete mode 100644 secrets/ops_app_celery.env
 create mode 100644 secrets/ops_app_celery.env.sample
 delete mode 100644 secrets/ops_app_dev.env
 create mode 100644 secrets/ops_app_dev.env.sample
 delete mode 100644 secrets/ops_app_test.env
 create mode 100644 secrets/ops_app_test.env.sample
 rename secrets/{ops_mysql_dev.env => ops_mysql_dev.env.sample} (54%)

diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
index 9035b9a8..d7dfb864 100644
--- a/.github/workflows/docker-push.yml
+++ b/.github/workflows/docker-push.yml
@@ -41,3 +41,7 @@ jobs:
         target: web
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
+        # Attach SLSA build provenance + SBOM so a swapped/backdoored image can be
+        # detected against the attestation at deploy time (chain C-005).
+        provenance: true
+        sbom: true
diff --git a/.gitignore b/.gitignore
index 69e3b55b..e96a0d10 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,8 @@
 config.json
+
+# Real secrets must never be committed (chain C-004) — only *.sample templates.
+secrets/*.env
+
 __pycache__/
 *.py[cod]
 db.sqlite3
diff --git a/Dockerfile b/Dockerfile
index 33154505..9b770227 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,10 +16,15 @@ RUN DEBIAN_FRONTEND=noninteractive \
 # Set env variables used in this Dockerfile (add a unique prefix, such as DEV)
 RUN apt update && apt install -y netcat dnsutils libmariadb-dev
 
-RUN mkdir -p /ebs/logs && touch /ebs/logs/engima.log && chmod 777 /ebs/logs/engima.log
-
 ARG APPUID=1001
-RUN useradd -rm -d /home/app -s /bin/bash -g root -u "$APPUID" app
+# Own group for the app user (not gid 0 / root group) so a container escape
+# does not inherit root-group file access (chains C-001 / C-003).
+RUN groupadd -g "$APPUID" app \
+  && useradd -rm -d /home/app -s /bin/bash -g app -u "$APPUID" app
+
+# Log file owned by the app user, not world-writable (was chmod 777).
+RUN mkdir -p /ebs/logs && touch /ebs/logs/engima.log \
+  && chown -R app:app /ebs/logs && chmod 640 /ebs/logs/engima.log
 WORKDIR /srv/code/dev
 RUN mkdir -p logs
 RUN mkdir -p db
diff --git a/EnigmaAutomation/settings.py b/EnigmaAutomation/settings.py
index e89aa40b..73a34ba2 100644
--- a/EnigmaAutomation/settings.py
+++ b/EnigmaAutomation/settings.py
@@ -49,6 +49,30 @@
 CSRF_COOKIE_HTTPONLY = True
 SESSION_COOKIE_HTTPONLY = True
 
+# --- Response security headers (chain C-002 / F-035) ---
+# Sent by django.middleware.security.SecurityMiddleware + clickjacking middleware.
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SECURE_REFERRER_POLICY = "same-origin"
+X_FRAME_OPTIONS = "DENY"
+
+# --- Content-Security-Policy (django-csp / csp.middleware.CSPMiddleware) ---
+# NOTE: 'unsafe-inline' is retained for script/style because the ops UI still
+# ships inline <script> blocks and inline styles (16 templates). Even so this
+# policy blocks injected EXTERNAL scripts, object/embed, <base> hijacking and
+# clickjacking. Follow-up: migrate templates to nonces and drop 'unsafe-inline'.
+# The allowed CDN hosts below reflect the jQuery/FontAwesome assets the UI loads
+# — smoke-test the pages render before flipping CSP_REPORT_ONLY off.
+CSP_DEFAULT_SRC = ("'self'",)
+CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'", "code.jquery.com", "cdn.jsdelivr.net")
+CSP_STYLE_SRC = ("'self'", "'unsafe-inline'", "fonts.googleapis.com", "use.fontawesome.com", "cdn.jsdelivr.net")
+CSP_FONT_SRC = ("'self'", "data:", "fonts.gstatic.com", "use.fontawesome.com")
+CSP_IMG_SRC = ("'self'", "data:")
+CSP_CONNECT_SRC = ("'self'",)
+CSP_OBJECT_SRC = ("'none'",)
+CSP_BASE_URI = ("'self'",)
+CSP_FRAME_ANCESTORS = ("'none'",)
+CSP_FORM_ACTION = ("'self'",)
+
 # Application definition
 
 INSTALLED_APPS = [
@@ -78,6 +102,7 @@
 
 MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
+    "csp.middleware.CSPMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.common.CommonMiddleware",
     'django.contrib.sessions.middleware.SessionMiddleware',
@@ -107,7 +132,8 @@
     "social_core.pipeline.social_auth.associate_user",
     "social_core.pipeline.social_auth.load_extra_data",
     "social_core.pipeline.user.user_details",
-    "social_core.pipeline.debug.debug",
+    # NOTE: social_core.pipeline.debug.debug removed (chain C-008) — it logs the
+    # full OAuth response, including access tokens and user PII, at DEBUG level.
 )
 
 SOCIAL_AUTH_DISCONNECT_PIPELINE = (
@@ -268,7 +294,9 @@
 
 AUTOMATED_EXEC_IDENTIFIER = "automated-grant"
 
-current_log_level = 'DEBUG'
+# INFO (not DEBUG) in the app loggers — DEBUG emits request/response bodies and
+# third-party token traffic that can leak secrets to the log sink (chain C-008).
+current_log_level = 'INFO'
 logging_apps = ["django.request", "inventory", "Access", "bootprocess"]
 LOGGING = {
     'version': 1,
diff --git a/docker-compose.yml b/docker-compose.yml
index 48b49a17..bcfae1af 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,8 +25,10 @@ services:
   db:
     container_name: db
     image: mysql/mysql-server:8.0.31
+    # Bind to loopback only — the DB must not be reachable from the network
+    # (chain C-004). Containers reach it via the compose network as `db:3306`.
     ports:
-    - 3306:3306
+    - 127.0.0.1:3306:3306
     env_file:
     - ./secrets/ops_mysql_dev.env
     volumes:
@@ -37,8 +39,9 @@ services:
     container_name: redis
     image: redis:alpine
     command: --port 6379
+    # Loopback only (chain C-004); the celery worker reaches it as `redis:6379`.
     ports:
-    - 6379:6379
+    - 127.0.0.1:6379:6379
     read_only: true
     security_opt:
     - no-new-privileges:true
diff --git a/requirements.txt b/requirements.txt
index 540d93e7..b5e4b367 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -115,6 +115,7 @@ mypy==2.3.0
 mypy-extensions==1.1.0
 vulture==2.16
 django-cid==2.3
+django-csp==3.8
 flake8==7.3.0
 django-session-timeout==0.1.0
 django-axes==5.41.1
diff --git a/secrets/ops_app_celery.env b/secrets/ops_app_celery.env
deleted file mode 100644
index e0c37afb..00000000
--- a/secrets/ops_app_celery.env
+++ /dev/null
@@ -1,5 +0,0 @@
-CELERY_BROKER_URL=redis://redis:6379
-CELERY_RESULT_BACKEND=redis://redis:6379
-MYSQL_ROOT_PASSWORD=testtest
-MYSQL_DATABASE=enigma
-MYSQL_ROOT_HOST=%
diff --git a/secrets/ops_app_celery.env.sample b/secrets/ops_app_celery.env.sample
new file mode 100644
index 00000000..a4b69fd5
--- /dev/null
+++ b/secrets/ops_app_celery.env.sample
@@ -0,0 +1,5 @@
+CELERY_BROKER_URL=redis://redis:6379/0
+CELERY_RESULT_BACKEND=redis://redis:6379/1
+MYSQL_ROOT_PASSWORD=__CHANGE_ME__
+MYSQL_DATABASE=enigma
+MYSQL_ROOT_HOST=%
diff --git a/secrets/ops_app_dev.env b/secrets/ops_app_dev.env
deleted file mode 100644
index b79602ca..00000000
--- a/secrets/ops_app_dev.env
+++ /dev/null
@@ -1,2 +0,0 @@
-TOKEN=test
-DEBUG=True
diff --git a/secrets/ops_app_dev.env.sample b/secrets/ops_app_dev.env.sample
new file mode 100644
index 00000000..1c8af4bd
--- /dev/null
+++ b/secrets/ops_app_dev.env.sample
@@ -0,0 +1,2 @@
+TOKEN=__CHANGE_ME__
+DEBUG=True
diff --git a/secrets/ops_app_test.env b/secrets/ops_app_test.env
deleted file mode 100644
index 39b0b75d..00000000
--- a/secrets/ops_app_test.env
+++ /dev/null
@@ -1,2 +0,0 @@
-TOKEN=test
-DEBUG=False
diff --git a/secrets/ops_app_test.env.sample b/secrets/ops_app_test.env.sample
new file mode 100644
index 00000000..1c8af4bd
--- /dev/null
+++ b/secrets/ops_app_test.env.sample
@@ -0,0 +1,2 @@
+TOKEN=__CHANGE_ME__
+DEBUG=True
diff --git a/secrets/ops_mysql_dev.env b/secrets/ops_mysql_dev.env.sample
similarity index 54%
rename from secrets/ops_mysql_dev.env
rename to secrets/ops_mysql_dev.env.sample
index b0083894..2ffdf3fe 100644
--- a/secrets/ops_mysql_dev.env
+++ b/secrets/ops_mysql_dev.env.sample
@@ -1,3 +1,3 @@
-MYSQL_ROOT_PASSWORD=testtest
+MYSQL_ROOT_PASSWORD=__CHANGE_ME__
 MYSQL_DATABASE=enigma
 MYSQL_ROOT_HOST=%

From 9859dc09ab0204d3f0e27751b85c7d0f1bc19591 Mon Sep 17 00:00:00 2001
From: Krishna Suravarapu <36037520+KrishnaSuravarapu@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:21:29 +0530
Subject: [PATCH 2/3] security(auth): axes lockout by username+IP not
 username-only (F-032)

AXES_ONLY_USER_FAILURES=False so failed-login lockout factors in the
source IP, closing the IP-based brute-force / credential-stuffing gap
(chain C-008 chain-breaker F-032, CTO-4880 / CTO-4897).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 EnigmaAutomation/settings.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/EnigmaAutomation/settings.py b/EnigmaAutomation/settings.py
index 73a34ba2..5a0d5ef3 100644
--- a/EnigmaAutomation/settings.py
+++ b/EnigmaAutomation/settings.py
@@ -96,7 +96,10 @@
 CID_CONCATENATE_IDS = True
 SESSION_EXPIRE_SECONDS = 7*24*60*60
 SESSION_EXPIRE_AFTER_LAST_ACTIVITY = True
-AXES_ONLY_USER_FAILURES=True
+# False so lockout also factors in source IP (username+IP), not username-only —
+# username-only tracking lets credential-stuffing spread one attempt across many
+# usernames from a single IP without ever tripping the limit (chain C-008 / F-032).
+AXES_ONLY_USER_FAILURES=False
 AXES_FAILURE_LIMIT=5
 AXES_COOLOFF_TIME=2.0
 

From a49d09a84aeeb3f5221110d58fd112f24d02072c Mon Sep 17 00:00:00 2001
From: Krishna Suravarapu <36037520+KrishnaSuravarapu@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:23:56 +0530
Subject: [PATCH 3/3] security(authz): gate accept_bulk with @user_any_approver
 (F-022)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

accept_bulk was only @login_required, so any logged-in non-approver could
reach the bulk-approval endpoint (rejected only in the helpers). Add
@user_any_approver — matching sibling views pending_requests/decline_access —
so non-approvers are denied at the view layer. isAnApprover() checks for ANY
approver permission (getPossibleApproverPermissions), so module-specific
approvers are unaffected; per-request approver/self-approval checks in the
helpers are unchanged. Chain-breaker for C-007 (CTO-4896 / CTO-4869).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Access/views.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Access/views.py b/Access/views.py
index 7588e2f4..007990bf 100644
--- a/Access/views.py
+++ b/Access/views.py
@@ -337,9 +337,18 @@ def pending_requests(request):
 
 
 @login_required
+@user_any_approver
 def accept_bulk(request, selector):
     """approve one or more access request.
 
+    F-022: gate the bulk-approval endpoint with @user_any_approver (matching the
+    sibling views pending_requests / decline_access) so a logged-in NON-approver
+    cannot reach the approval paths at all. This checks "holds ANY approver
+    permission" via getPossibleApproverPermissions(), so module-specific approvers
+    are unaffected. Per-request authorization (module/group approver perms, primary/
+    secondary checks, self-approval block) is still enforced in the helpers below —
+    this is a defense-in-depth view gate, not a replacement for those checks.
+
     Args:
         request (HTTPRequest): Details of access and access approver.
         selector (str): access type being approved.