131868bdca
Major security, observability, and configuration improvements:
## Security Hardening
- Implemented configurable CORS (no more wildcards)
- Added comprehensive auth middleware for admin endpoints
- Enhanced webhook HMAC validation
- Added input validation and rate limiting
- Security headers and CSP policies
## Configuration Management
- Made N8N webhook URL configurable (WHOOSH_N8N_BASE_URL)
- Replaced all hardcoded endpoints with environment variables
- Added feature flags for LLM vs heuristic composition
- Gitea fetch hardening with EAGER_FILTER and FULL_RESCAN options
## API Completeness
- Implemented GetCouncilComposition function
- Added GET /api/v1/councils/{id} endpoint
- Council artifacts API (POST/GET /api/v1/councils/{id}/artifacts)
- /admin/health/details endpoint with component status
- Database lookup for repository URLs (no hardcoded fallbacks)
## Observability & Performance
- Added OpenTelemetry distributed tracing with goal/pulse correlation
- Performance optimization database indexes
- Comprehensive health monitoring
- Enhanced logging and error handling
## Infrastructure
- Production-ready P2P discovery (replaces mock implementation)
- Removed unused Redis configuration
- Enhanced Docker Swarm integration
- Added migration files for performance indexes
## Code Quality
- Comprehensive input validation
- Graceful error handling and failsafe fallbacks
- Backwards compatibility maintained
- Following security best practices
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
81 lines
2.0 KiB
Go
81 lines
2.0 KiB
Go
// Copyright 2016 Google Inc. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package uuid
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
// A Domain represents a Version 2 domain
|
|
type Domain byte
|
|
|
|
// Domain constants for DCE Security (Version 2) UUIDs.
|
|
const (
|
|
Person = Domain(0)
|
|
Group = Domain(1)
|
|
Org = Domain(2)
|
|
)
|
|
|
|
// NewDCESecurity returns a DCE Security (Version 2) UUID.
|
|
//
|
|
// The domain should be one of Person, Group or Org.
|
|
// On a POSIX system the id should be the users UID for the Person
|
|
// domain and the users GID for the Group. The meaning of id for
|
|
// the domain Org or on non-POSIX systems is site defined.
|
|
//
|
|
// For a given domain/id pair the same token may be returned for up to
|
|
// 7 minutes and 10 seconds.
|
|
func NewDCESecurity(domain Domain, id uint32) (UUID, error) {
|
|
uuid, err := NewUUID()
|
|
if err == nil {
|
|
uuid[6] = (uuid[6] & 0x0f) | 0x20 // Version 2
|
|
uuid[9] = byte(domain)
|
|
binary.BigEndian.PutUint32(uuid[0:], id)
|
|
}
|
|
return uuid, err
|
|
}
|
|
|
|
// NewDCEPerson returns a DCE Security (Version 2) UUID in the person
|
|
// domain with the id returned by os.Getuid.
|
|
//
|
|
// NewDCESecurity(Person, uint32(os.Getuid()))
|
|
func NewDCEPerson() (UUID, error) {
|
|
return NewDCESecurity(Person, uint32(os.Getuid()))
|
|
}
|
|
|
|
// NewDCEGroup returns a DCE Security (Version 2) UUID in the group
|
|
// domain with the id returned by os.Getgid.
|
|
//
|
|
// NewDCESecurity(Group, uint32(os.Getgid()))
|
|
func NewDCEGroup() (UUID, error) {
|
|
return NewDCESecurity(Group, uint32(os.Getgid()))
|
|
}
|
|
|
|
// Domain returns the domain for a Version 2 UUID. Domains are only defined
|
|
// for Version 2 UUIDs.
|
|
func (uuid UUID) Domain() Domain {
|
|
return Domain(uuid[9])
|
|
}
|
|
|
|
// ID returns the id for a Version 2 UUID. IDs are only defined for Version 2
|
|
// UUIDs.
|
|
func (uuid UUID) ID() uint32 {
|
|
return binary.BigEndian.Uint32(uuid[0:4])
|
|
}
|
|
|
|
func (d Domain) String() string {
|
|
switch d {
|
|
case Person:
|
|
return "Person"
|
|
case Group:
|
|
return "Group"
|
|
case Org:
|
|
return "Org"
|
|
}
|
|
return fmt.Sprintf("Domain%d", int(d))
|
|
}
|