edf2475413
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
99 lines
2.9 KiB
Python
99 lines
2.9 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
"""Production settings"""
|
|
|
|
import os
|
|
|
|
from .common import * # noqa
|
|
|
|
# SECURITY WARNING: don't run with debug turned on in production!
|
|
DEBUG = int(os.environ.get("DEBUG", 0)) == 1
|
|
|
|
# Honor the 'X-Forwarded-Proto' header for request.is_secure()
|
|
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
|
|
|
|
INSTALLED_APPS += ("scout_apm.django",) # noqa
|
|
|
|
|
|
# Scout Settings
|
|
SCOUT_MONITOR = os.environ.get("SCOUT_MONITOR", False)
|
|
SCOUT_KEY = os.environ.get("SCOUT_KEY", "")
|
|
SCOUT_NAME = "Plane"
|
|
|
|
LOG_DIR = os.path.join(BASE_DIR, "logs") # noqa
|
|
|
|
if not os.path.exists(LOG_DIR):
|
|
os.makedirs(LOG_DIR)
|
|
|
|
# Logging configuration
|
|
LOGGING = {
|
|
"version": 1,
|
|
"disable_existing_loggers": True,
|
|
"formatters": {
|
|
"verbose": {"format": "%(asctime)s [%(process)d] %(levelname)s %(name)s: %(message)s"},
|
|
"json": {
|
|
"()": "pythonjsonlogger.json.JsonFormatter",
|
|
"fmt": "%(levelname)s %(asctime)s %(module)s %(name)s %(message)s",
|
|
},
|
|
},
|
|
"handlers": {
|
|
"console": {
|
|
"class": "logging.StreamHandler",
|
|
"formatter": "json",
|
|
"level": "INFO",
|
|
},
|
|
"file": {
|
|
"class": "plane.utils.logging.SizedTimedRotatingFileHandler",
|
|
"filename": (
|
|
os.path.join(BASE_DIR, "logs", "plane-debug.log") # noqa
|
|
if DEBUG
|
|
else os.path.join(BASE_DIR, "logs", "plane-error.log") # noqa
|
|
),
|
|
"when": "s",
|
|
"maxBytes": 1024 * 1024 * 1,
|
|
"interval": 1,
|
|
"backupCount": 5,
|
|
"formatter": "json",
|
|
"level": "DEBUG" if DEBUG else "ERROR",
|
|
},
|
|
},
|
|
"loggers": {
|
|
"plane.api.request": {
|
|
"level": "DEBUG" if DEBUG else "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
"plane.api": {
|
|
"level": "DEBUG" if DEBUG else "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
"plane.worker": {
|
|
"level": "DEBUG" if DEBUG else "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
"plane.exception": {
|
|
"level": "DEBUG" if DEBUG else "ERROR",
|
|
"handlers": ["console", "file"],
|
|
"propagate": False,
|
|
},
|
|
"plane.external": {
|
|
"level": "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
"plane.authentication": {
|
|
"level": "DEBUG" if DEBUG else "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
"plane.migrations": {
|
|
"level": "DEBUG" if DEBUG else "INFO",
|
|
"handlers": ["console"],
|
|
"propagate": False,
|
|
},
|
|
},
|
|
}
|