bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)

Browse Source 
- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 01:34:51 +02:00
parent 72120969c6
commit 1028498705
30 changed files with 235 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
api/app/Http/Controllers/Api/V1/LoginController.php
View File

@@ -9,12 +9,19 @@ use App\Http\Requests\Api\V1\LoginRequest;
use App\Http\Resources\Api\V1\UserResource;
use Illuminate\Http\JsonResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Log;
final class LoginController extends Controller
{
public function __invoke(LoginRequest $request): JsonResponse
{
if (!Auth::attempt($request->only('email', 'password'))) {
Log::warning('Failed login attempt', [
'email' => $request->validated('email'),
'ip' => $request->ip(),
'user_agent' => $request->userAgent(),
]);
return $this->unauthorized('Invalid credentials');
}

4
api/app/Http/Controllers/Api/V1/PasswordResetController.php
View File

@@ -9,6 +9,7 @@ use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Password;
use Illuminate\Validation\Rules\Password as PasswordRule;
final class PasswordResetController extends Controller
{
@@ -29,13 +30,14 @@ final class PasswordResetController extends Controller
$request->validate([
'token' => 'required',
'email' => 'required|email',
'password' => 'required|min:8|confirmed',
'password' => ['required', 'confirmed', PasswordRule::min(8)->mixedCase()->numbers()],
]);
$status = Password::reset(
$request->only('email', 'password', 'password_confirmation', 'token'),
function ($user, $password) {
$user->forceFill(['password' => Hash::make($password)])->save();
$user->tokens()->delete();
}
);

29
api/app/Http/Middleware/SecurityHeaders.php Normal file
View File

@@ -0,0 +1,29 @@
<?php
declare(strict_types=1);
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
final class SecurityHeaders
{
public function handle(Request $request, Closure $next): Response
{
$response = $next($request);
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-Frame-Options', 'DENY');
$response->headers->set('X-XSS-Protection', '0');
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
$response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
if ($request->isSecure() || app()->environment('production')) {
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
}
return $response;
}
}

3
api/app/Http/Requests/Api/V1/AcceptInvitationRequest.php
View File

@@ -7,6 +7,7 @@ namespace App\Http\Requests\Api\V1;
use App\Models\User;
use App\Models\UserInvitation;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rules\Password;
final class AcceptInvitationRequest extends FormRequest
{
@@ -24,7 +25,7 @@ final class AcceptInvitationRequest extends FormRequest
return [
'first_name' => [$userExists ? 'nullable' : 'required', 'string', 'max:255'],
'last_name' => [$userExists ? 'nullable' : 'required', 'string', 'max:255'],
'password' => [$userExists ? 'nullable' : 'required', 'string', 'min:8', 'confirmed'],
'password' => [$userExists ? 'nullable' : 'required', 'string', 'confirmed', Password::min(8)->mixedCase()->numbers()],
];
}
}

1
api/app/Http/Requests/Api/V1/UpdateOrganisationRequest.php
View File

@@ -23,7 +23,6 @@ final class UpdateOrganisationRequest extends FormRequest
'sometimes', 'string', 'max:255', 'regex:/^[a-z0-9-]+$/',
Rule::unique('organisations', 'slug')->ignore($this->route('organisation')),
],
'billing_status' => ['sometimes', 'string', 'in:active,trial,suspended'],
'settings' => ['sometimes', 'array'],
'email_logo_url' => ['nullable', 'url', 'max:500'],
'email_primary_color' => ['nullable', 'string', 'regex:/^#[0-9A-Fa-f]{6}$/'],

3
api/app/Http/Requests/Api/V1/VolunteerRegistrationRequest.php
View File

@@ -5,6 +5,7 @@ declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rules\Password;
final class VolunteerRegistrationRequest extends FormRequest
{
@@ -60,7 +61,7 @@ final class VolunteerRegistrationRequest extends FormRequest
// Password required for unauthenticated registrations
if ($user === null) {
$rules['password'] = ['required', 'string', 'min:8'];
$rules['password'] = ['required', 'string', Password::min(8)->mixedCase()->numbers()];
$rules['password_confirmation'] = ['nullable', 'same:password'];
}

1
api/app/Models/Person.php
View File

@@ -24,7 +24,6 @@ final class Person extends Model
protected $table = 'persons';
protected $fillable = [
'user_id',
'event_id',
'crowd_type_id',
'company_id',

10
api/app/Models/ShiftAssignment.php
View File

@@ -24,19 +24,9 @@ final class ShiftAssignment extends Model
'person_id',
'time_slot_id',
'status',
'auto_approved',
'assigned_by',
'assigned_at',
'approved_by',
'approved_at',
'rejection_reason',
'cancelled_by',
'cancellation_source',
'cancelled_at',
'hours_expected',
'hours_completed',
'checked_in_at',
'checked_out_at',
];
protected function casts(): array

12
api/app/Models/UserInvitation.php
View File

@@ -17,13 +17,7 @@ final class UserInvitation extends Model
protected $fillable = [
'email',
'invited_by_user_id',
'organisation_id',
'event_id',
'role',
'token',
'status',
'expires_at',
];
protected function casts(): array
@@ -60,12 +54,14 @@ final class UserInvitation extends Model
public function markAsAccepted(): void
{
$this->update(['status' => 'accepted']);
$this->status = 'accepted';
$this->save();
}
public function markAsExpired(): void
{
$this->update(['status' => 'expired']);
$this->status = 'expired';
$this->save();
}
public function scopePending(Builder $query): Builder

17
api/app/Services/InvitationService.php
View File

@@ -37,15 +37,14 @@ final class InvitationService
]);
}
$invitation = UserInvitation::create([
'email' => $email,
'invited_by_user_id' => $invitedBy->id,
'organisation_id' => $org->id,
'role' => $role,
'token' => strtolower((string) Str::ulid()),
'status' => 'pending',
'expires_at' => now()->addDays(7),
]);
$invitation = new UserInvitation(['email' => $email]);
$invitation->invited_by_user_id = $invitedBy->id;
$invitation->organisation_id = $org->id;
$invitation->role = $role;
$invitation->token = strtolower((string) Str::ulid());
$invitation->status = 'pending';
$invitation->expires_at = now()->addDays(7);
$invitation->save();
Mail::to($email)->queue(new InvitationMail($invitation));

6
api/app/Services/PersonIdentityService.php
View File

@@ -181,9 +181,9 @@ final class PersonIdentityService
'resolved_at' => now(),
]);
$person->update([
'user_id' => $match->matched_user_id,
]);
// Set user_id explicitly (not mass-assignable)
$person->user_id = $match->matched_user_id;
$person->save();
});
activity('identity')

77
api/app/Services/ShiftAssignmentService.php
View File

@@ -36,11 +36,13 @@ final class ShiftAssignmentService
'person_id' => $person->id,
'time_slot_id' => $shift->time_slot_id,
'status' => $status,
'auto_approved' => $autoApprove,
'assigned_at' => now(),
'approved_at' => $autoApprove ? now() : null,
]);
$assignment->auto_approved = $autoApprove;
$assignment->assigned_at = now();
$assignment->approved_at = $autoApprove ? now() : null;
$assignment->save();
$this->updateShiftStatusIfFull($shift);
activity('shift_assignment')
@@ -85,17 +87,16 @@ final class ShiftAssignmentService
if ($existing) {
$previousStatus = $existing->status->value;
$existing->update([
'status' => ShiftAssignmentStatus::APPROVED,
'assigned_by' => $assignedBy->id,
'assigned_at' => now(),
'approved_by' => $assignedBy->id,
'approved_at' => now(),
'rejection_reason' => null,
'cancelled_by' => null,
'cancellation_source' => null,
'cancelled_at' => null,
]);
$existing->status = ShiftAssignmentStatus::APPROVED;
$existing->assigned_by = $assignedBy->id;
$existing->assigned_at = now();
$existing->approved_by = $assignedBy->id;
$existing->approved_at = now();
$existing->rejection_reason = null;
$existing->cancelled_by = null;
$existing->cancellation_source = null;
$existing->cancelled_at = null;
$existing->save();
activity('shift_assignment')
->causedBy($assignedBy)
@@ -133,13 +134,15 @@ final class ShiftAssignmentService
'person_id' => $person->id,
'time_slot_id' => $shift->time_slot_id,
'status' => ShiftAssignmentStatus::APPROVED,
'auto_approved' => false,
'assigned_by' => $assignedBy->id,
'assigned_at' => now(),
'approved_by' => $assignedBy->id,
'approved_at' => now(),
]);
$assignment->auto_approved = false;
$assignment->assigned_by = $assignedBy->id;
$assignment->assigned_at = now();
$assignment->approved_by = $assignedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);
activity('shift_assignment')
@@ -177,11 +180,10 @@ final class ShiftAssignmentService
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::APPROVED,
'approved_by' => $approvedBy->id,
'approved_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::APPROVED;
$assignment->approved_by = $approvedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);
@@ -207,10 +209,9 @@ final class ShiftAssignmentService
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::REJECTED,
'rejection_reason' => $reason,
]);
$assignment->status = ShiftAssignmentStatus::REJECTED;
$assignment->rejection_reason = $reason;
$assignment->save();
activity('shift_assignment')
->causedBy($rejectedBy)
@@ -239,12 +240,11 @@ final class ShiftAssignmentService
$wasApproved = $assignment->status === ShiftAssignmentStatus::APPROVED;
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::CANCELLED,
'cancelled_by' => $cancelledBy->id,
'cancellation_source' => $source,
'cancelled_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::CANCELLED;
$assignment->cancelled_by = $cancelledBy->id;
$assignment->cancellation_source = $source;
$assignment->cancelled_at = now();
$assignment->save();
if ($wasApproved) {
$this->updateShiftStatusAfterCancellation($assignment->shift);
@@ -292,11 +292,10 @@ final class ShiftAssignmentService
];
}
$assignment->update([
'status' => ShiftAssignmentStatus::APPROVED,
'approved_by' => $approvedBy->id,
'approved_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::APPROVED;
$assignment->approved_by = $approvedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);

5
api/app/Services/VolunteerRegistrationService.php
View File

@@ -57,7 +57,6 @@ final class VolunteerRegistrationService
'email' => $email,
],
[
'user_id' => $user->id,
'crowd_type_id' => $volunteerCrowdType->id,
'first_name' => $validated['first_name'] ?? $user->first_name,
'last_name' => $validated['last_name'] ?? $user->last_name,
@@ -75,6 +74,10 @@ final class VolunteerRegistrationService
]
);
// Set user_id explicitly (not mass-assignable)
$person->user_id = $user->id;
$person->save();
$this->syncAvailabilities($person, $festivalEvent, $validated['availabilities'] ?? []);
if (!empty($validated['field_values'])) {