security: harden production configuration and routes

docs/security/2026-07-22-security-audit-report.md

@@ -0,0 +1,132 @@
+# FarmaFinder Security Audit Report
+
+**Audit date:** 2026-07-22
+**Scope:** repository source, configuration, environment files present on disk, Docker Compose files, Git history, Node lockfiles, and Python dependency declarations.
+**Status:** **Not ready for an unrestricted production deployment.**
+
+## Executive summary
+
+The most urgent risks are configuration and access-control issues, not evidence of a secret committed to Git:
+
+1. Local ignored `.env` files contain credential-shaped production values. The values must be treated as exposed if they were ever copied to a server, shared, or used in a public environment. Rotate the Expo access token and VAPID private key immediately, and rotate any database, session, n8n, or webhook credentials that may have shared the same deployment.
+2. Production Docker Compose has known-secret fallbacks such as `change-me-in-production`, `change-me`, and `pip-secret`. A deployment can therefore start with predictable credentials when variables are missing.
+3. The parapharmacy API exposes product create, bulk upsert, update, delete, and scraper-trigger endpoints without authentication. This is a direct integrity and availability risk.
+4. The backend silently falls back to a hard-coded session secret. A missing secret must fail closed in production.
+5. The verified npm audit reports 79 advisories in the workspace, including 3 critical and 13 high. The most important direct production-adjacent findings include vulnerable OpenTelemetry packages, `bcrypt`/`tar` transitive issues, and the vulnerable `ws`/`brace-expansion` chains. The frontend test toolchain includes a critical Vitest advisory; it must not be exposed as a server in any environment.
+
+## Findings
+
+### F-01 — Secrets present in local environment files
+
+**Severity:** Critical
+**Evidence:** `apps/backend/.env` and `apps/parapharmacy-api/.env` exist locally and are ignored by Git. The backend file contains a non-empty Expo access token and VAPID private key; it also contains database/session/ingest credential fields. Values are intentionally not reproduced here.
+
+**Impact:** Push credentials, session signing, database access, or workflow ingestion may be compromised. A VAPID private key can impersonate the application for web push; an Expo token can send notifications through the project account.
+
+**Action:** Rotate the Expo token and VAPID key now. Rotate all non-development credentials in those files. Review CI, deployment hosts, shell history, password managers, and logs for copies. Keep secrets in the deployment secret store only.
+
+### F-02 — Predictable production secret fallbacks
+
+**Severity:** Critical
+**Evidence:** `docker-compose.yml:12,34,41,89,137,141,147,176,178` uses defaults including `change-me-in-production`, `change-me`, and a derived PostgreSQL URL. `apps/backend/server.js:83-85` falls back to `farma-clic-secret-key-change-in-production`. `apps/pip-platform/src/infrastructure/config/settings.py:16,24,26` contains default database, broker, and JWT credentials. The PIP Compose files also default `JWT_SECRET_KEY` at `apps/pip-platform/docker-compose.yml:13` and `docker-compose.runtime.yml:13`.
+
+**Impact:** Missing environment injection can enable session forgery, JWT forgery, database access, or n8n takeover.
+
+**Action:** Remove secret defaults. Add startup validation that rejects `NODE_ENV=production`/production deployments when required secrets are absent or match known placeholders. Use `${VAR:?VAR must be set}` in Compose for required values.
+
+### F-03 — Unauthenticated parapharmacy write/delete/scrape APIs
+
+**Severity:** Critical
+**Evidence:** `apps/parapharmacy-api/src/routes/products.js:280-320,340-390` exposes bulk write, update, and delete routes without auth. `apps/parapharmacy-api/src/routes/scraper.js:7-24` exposes a scraper trigger without auth. `apps/parapharmacy-api/src/server.js:55-70` applies only global CORS, JSON parsing, logging, and rate limiting.
+
+**Impact:** An unauthenticated caller can poison or delete the catalog, trigger expensive Puppeteer scraping, and cause resource exhaustion.
+
+**Action:** Protect write/delete/scrape routes with a dedicated ingestion/admin API key or service-to-service authentication. Apply a strict body/item limit and a separate low-rate limiter to scraper execution. Return generic errors without echoing scraper exception messages.
+
+### F-04 — Hard-coded backend session secret fallback
+
+**Severity:** High
+**Evidence:** `apps/backend/server.js:83-85` uses a fixed fallback secret. The session cookie is HTTP-only and SameSite=Lax (`:87-91`), which is good, but `secure` is opt-in at `COOKIE_SECURE=true`.
+
+**Impact:** Anyone who knows the repository can forge sessions when the deployment omits `SESSION_SECRET`; if `COOKIE_SECURE` is omitted in HTTPS production, cookies may be sent over an accidental HTTP path.
+
+**Action:** Fail startup when production lacks a strong `SESSION_SECRET`; force secure cookies in production and set `app.set('trust proxy', ...)` only to the known proxy topology.
+
+### F-05 — Public infrastructure ports and unauthenticated observability/admin surfaces
+
+**Severity:** High
+**Evidence:** `docker-compose.yml:29-30,66-67,75-76,86-89,102-103,122-123,131-132` publishes backend, frontend, exporters, parapharmacy API, MongoDB, and n8n ports. Swagger is mounted at `/api/docs` in `apps/parapharmacy-api/src/server.js:64-69` without an environment guard.
+
+**Impact:** Databases, exporters, n8n, and internal APIs may be reachable from the host network or internet. Swagger reveals mutation endpoints and operational details.
+
+**Action:** Bind internal services to the Docker network or loopback only. Publish only the reverse proxy/frontend. Restrict n8n and Swagger to an authenticated admin network or disable them in production.
+
+### F-06 — Verified npm dependency advisories
+
+**Severity:** Critical/High/Moderate by package and exposure
+**Evidence:** `npm audit --json` completed with network access on 2026-07-22.
+
+| Lockfile / scope | Critical | High | Moderate | Low | Total |
+|---|---:|---:|---:|---:|---:|
+| Workspace root | 3 | 13 | 60 | 3 | 79 |
+| Backend | 1 | 11 | 41 | 3 | 56 |
+| Frontend | 1 | 3 | 18 | 0 | 22 |
+| Parapharmacy API | 0 | 2 | 0 | 1 | 3 |
+| Scraper | 0 | 1 | 0 | 0 | 1 |
+
+Notable verified chains include:
+
+- backend: `@opentelemetry/auto-instrumentations-node` high-severity Prometheus exporter crash advisory; `bcrypt` through `@mapbox/node-pre-gyp`/`tar`; vulnerable `ws` and `uuid` transitive chains;
+- frontend: critical `vitest` advisory when its UI server is exposed, plus vulnerable Vite/esbuild/Rollup and Grafana Faro/OpenTelemetry chains;
+- parapharmacy API: `fast-uri`, `brace-expansion`, and `body-parser` advisories;
+- scraper: `brace-expansion` high-severity DoS advisory.
+
+**Action:** Apply targeted non-breaking patches first where available, then upgrade major-version families in isolated branches with tests. Do not use `npm audit fix --force` blindly; the audit indicates major-version changes for several fixes.
+
+### F-07 — Dependency hygiene and likely-unused candidates
+
+**Severity:** Medium (maintenance/security surface)
+**Evidence:** A static repository scan found direct dependencies with no source import/reference outside manifests/lockfiles:
+
+- backend: `barcode-detector`, `@opentelemetry/exporter-logs-otlp-grpc`, `@opentelemetry/sdk-logs`, `@opentelemetry/sdk-trace-base`;
+- frontend: `@grafana/faro-web-sdk`;
+- mobile: `expo-dev-client`, `expo-linking`, `react-native-screens`, `react-native-worklets` (some may be required by Expo/native autolinking);
+- parapharmacy API: `jest`, `supertest` (test tooling is declared but no tests were found in that package).
+
+This scan is not proof of unused status because Expo, native autolinking, configuration, and instrumentation can consume packages indirectly. Confirm each candidate with package-manager dependency tracing and a clean build before removal. No package was removed during this audit.
+
+### F-08 — Build/runtime supply-chain hygiene
+
+**Severity:** High
+**Evidence:** `docker-compose.yml:22,57,73,84,95,120,129,169` uses mutable `:latest` image tags. `apps/parapharmacy-api/Dockerfile` uses `npm install --omit=dev` instead of `npm ci`; `apps/backend/Dockerfile` uses `npm ci`.
+
+**Impact:** Rebuilds are not reproducible and can silently pull changed or compromised images/dependency resolutions.
+
+**Action:** Pin images by version and digest, use lockfile-enforced `npm ci` for every Node image, and add image/dependency scanning to CI.
+
+### F-09 — Mobile/API keys and telemetry endpoints need restriction
+
+**Severity:** Medium
+**Evidence:** `apps/frontend-mobile/google-services.json:18` contains a Firebase API key. This type of key is normally public, but must be restricted by package/bundle identity and API scope in Google Cloud/Firebase. Mobile and frontend env examples point telemetry at public or host endpoints.
+
+**Action:** Verify Firebase key restrictions, avoid treating public client configuration as a secret, and enforce collector authentication/rate limits so telemetry endpoints cannot be abused.
+
+## Positive controls observed
+
+- Git status was clean before this audit.
+- `.gitignore` excludes `.env`, dependency directories, build output, and Android signing material.
+- Git history inspection found environment examples and placeholder values, but no tracked actual `.env` file or the local Expo/VAPID values.
+- Backend uses parameterized SQL for the inspected user/session paths, bcrypt password hashing, HTTP-only cookies, admin middleware, and route-specific rate limiting.
+- Production backend and frontend use container builds, and backend uses `npm ci --omit=dev`.
+
+## Verification and limitations
+
+- Source/configuration and Git-history checks were read-only.
+- Online npm audit was executed with network access on 2026-07-22; advisory counts are a point-in-time result and should be rerun in CI.
+- No production host, running container, database, secret manager, cloud account, or external firewall was inspected.
+- No Python lockfile exists for `apps/pip-platform`; the Python audit therefore covered declarations and defaults, not resolved CVEs. Add a lockfile and run `pip-audit`/`uv audit` in CI.
+- The audit did not prove that every endpoint is unreachable externally; exposure depends on deployment networking.
+
+## Recommended deployment decision
+
+Do not deploy the current configuration publicly until F-01 through F-05 are addressed. Dependency upgrades and supply-chain pinning should follow immediately. The implementation sequence is documented in [the hotfix plan](../superpowers/plans/2026-07-22-security-hotfixes.md).