Senior Engineer
91e4985a8e
FRE-4474 Phase 5: Verify and resolve security review findings for SpamShield and Cross-Service Correlation
...
- FRE-4499 (SpamShield): Verified 6 security fixes (2 High, 4 Medium)
- S01: Pre-compiled regex in RuleEngine (ReDoS fix)
- S02: SmsClassifier accepts senderPhoneNumber context
- S03: AlertServer JWT auth + origin validation
- S04: SHA-256 phone hashing (PII protection)
- S05: DecisionEngine timeout enforcement via Promise.race
- S06: CarrierFactory.getAllCarriers properly async/await
- FRE-4500 (Correlation): Verified 7 security fixes (2 Critical, 2 High, 2 Medium, 1 Low)
- C1: Ingest endpoints auth via request.user.id
- C2: IDOR protection on group endpoints (userId filter)
- H3: JWT middleware registered in server.ts
- H4: Fastify schema validation on all routes
- M6: Payload sanitization with depth limit and circular ref detection
- L7: CORS origin restricted to env var
- Resolved liveness incidents FRE-4652 and FRE-4654
- All Phase 5 child issues now complete
2026-05-02 18:36:29 -04:00
Senior Engineer
574bcf2264
FRE-4521 Implement Redis integration for rate limiting and deduplication
...
- Add ioredis dependency for Redis connection pooling
- Create RedisService singleton with connection management
- Add Redis config (url, dedupWindowSeconds) to notification.config.ts
- Implement NotificationService.checkRateLimit using Redis INCR+EXPIRE
- Implement NotificationService.deduplicateNotification using Redis SET/NX
- Add configurable rate limit windows and thresholds via env vars
- Add 29 unit tests covering Redis operations, rate limiting, and dedup
- All tests pass, TypeScript compiles cleanly for new files
2026-05-01 16:13:17 -04:00
7aed2d8b2b
FRE-4520: Add unit tests for notification template system
...
- 25 tests covering template resolution, localization fallback, variable substitution, caching, custom template registration, and edge cases
- Update package.json to use vitest for test execution
- All 25 tests passing
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-01 10:08:48 -04:00
9fb5379b7a
Add tier-based scan scheduler and webhook triggers (FRE-4498)
...
- ScanScheduler: tier-based scheduling (BASIC=24h, PLUS=6h, PREMIUM=1h)
- WebhookHandler: HMAC-verified webhook ingestion with SCAN_TRIGGER support
- API routes: /scheduler and /webhooks endpoints under /api/v1/darkwatch
- Jobs: scheduled scan checker + webhook retry processor via BullMQ
- Schema: ScanSchedule, WebhookEvent models; ScanJob.scheduledBy field
- Types: ScheduleStatus, WebhookEventType, WebhookTriggerInput
- Tests: scheduler lifecycle + webhook signature/processing tests
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-04-30 10:57:56 -04:00
