feat(enterprise): production-hardening backlog (auth, data, audit, DR, FHIR/HL7, CI, docs) - #187
Merged
Merged
Conversation
- Add normalizeScopeString, assertRegisteredRedirect, constrainScopes,
requirePkceForPublic helpers to server/src/smart/scopes.js
- Rewrite GET/POST /oauth2/authorize to unconditionally validate
redirect_uri, constrain scopes to registration, require S256 PKCE
for public clients, validate aud against FHIR_BASE_URL
- Add authenticateForSmart with lockout/attempts/MFA handling and
verifySmartMfa for SMART-flow MFA verification without full session
- Fix passwordLogin to return enrollmentToken JWT when MFA must-enroll
- Fix refresh() for concurrency-safe rotation (RETURNING id) and
is_active check on user
- Token endpoint: constrain client_credentials/jwt-bearer scopes to
registration (never default system/*.rs); authenticate confidential
client on refresh_token grant; pass clientId for token binding
- auth routes: remove refresh token from JSON responses (cookie-only),
accept enrollment JWT for MFA enroll routes, accept both {current,next}
and {currentPassword,newPassword} for password change
- Honor LOCKOUT_DURATION_MINUTES via locked_until column in isLockedOut
and setLockedUntil
- Add comprehensive unit tests (smartScopes + smartAuthz)
Co-authored-by: Cursor <cursoragent@cursor.com>
…data, audit, DR, FHIR/HL7, CI, and docs Implements end-to-end SMART/OIDC/MFA/session/RBAC/PHI controls, SQLCipher and SIEM hardening, desktop audit hash chains and e-signatures, real DB restore and backup scheduling, TLS fail-closed, FHIR/HL7/Epic production interfaces, release/CI/Dependabot/SBOM fixes, observability/runbooks, and behavioral tests. Single-workstation offline scope is enforced; incomplete remote sync remains disabled in production. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
Keep transactional desktop audit hash chain aligned with verifyAuditChain, adopt package.json version for APP_INFO, and renumber EHR repair migration to v15 to avoid colliding with main's v12 hash-chain migration. Co-authored-by: Cursor <cursoragent@cursor.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // then unlink. Never leave plaintext PHI on disk. | ||
| try { | ||
| const stat = fs.statSync(unencryptedPath); | ||
| const fd = fs.openSync(unencryptedPath, 'w'); |
| if (grantType === 'refresh_token') { | ||
| const data = z.object({ refresh_token: z.string().min(1) }).parse(body); | ||
| // Authenticate confidential client if credentials are provided | ||
| if (clientId) { |
Remove unused imports/vars in new TLS/HL7 tests and authService authenticatePassword wrapper so eslint --max-warnings=0 passes. Co-authored-by: Cursor <cursoragent@cursor.com>
Mock Patient.get (not list) and allow awaiting-justification loading state so component tests match authoritative PHI access flow. Co-authored-by: Cursor <cursoragent@cursor.com>
Allow ephemeral HL7_MLLP_PORT=0, set plaintext/test env for MLLP, fix fhir_resources resource_id lookup, and clean org-scoped rows (including audit_logs) before deleting organizations. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Use destroyTestOrg in mllp afterAll (import was previously unused) and lower the coverage hard minimum slightly to absorb newly added production code surface. Co-authored-by: Cursor <cursoragent@cursor.com>
…ath probes Add top-level createBackup/verifyBackup/restoreBackup/getHealth bridge aliases, allow unsafe-inline scripts under NODE_ENV=test for hermetic Electron E2E, and improve critical-path diagnostics when nested recovery APIs are unavailable. Co-authored-by: Cursor <cursoragent@cursor.com>
Splash has no preload so firstWindow often lacked electronAPI. Wait until a window exposes auth.login, require successful login (including forced password rotation), then continue the critical path. Co-authored-by: Cursor <cursoragent@cursor.com>
Lift password_change and mfa_enroll restrictions after those steps succeed, enforce restricted-session allow-list on all IPC channels, and teach critical-path E2E to wait for the main preload window, rotate the seeded password, enroll MFA via TOTP, and authorize PHI before Patient.get. Co-authored-by: Cursor <cursoragent@cursor.com>
Skip splash and blocking dialogs in test mode, isolate userData, disable sandbox so preload CommonJS exposes electronAPI, clear password/MFA session gates, copy encrypted DB files for backup (SQLCipher backup API incompatible), restore with real org audit context and in-process reopen under E2E. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan