25f68781ad
SEC-C-01: Replace Neon PostgreSQL credentials (npg_Ssfy6HKO0cXI) with local dev connection strings in all 19 appsettings.json files. Production credentials must be injected via ConnectionStrings__DefaultConnection env var. Add appsettings.Production.json and appsettings.Staging.json to .gitignore. SEC-C-02: Add services/goodgo-mcp-server/.env to root .gitignore. Create .env.example with safe placeholder values documenting required variables. SEC-C-03: Wrap AddDeveloperSigningCredential() in env check — development only. Non-development environments must provide X.509 certificate via IdentityServer:SigningCertificatePath and IdentityServer:SigningCertificatePassword. SEC-C-04: Remove 4 unauthenticated debug endpoints from StaffController: GET debug/all, POST debug/seed, POST debug/update-userid, POST debug/update-merchant. These endpoints allowed privilege escalation and data exfiltration without auth. SEC-C-05: Removed endpoints containing SQL injection via string interpolation (lines 307, 367 in StaffController). Also removed [AllowAnonymous] from GET lookup endpoint — inherits class-level [Authorize]. BREAKING: debug/* endpoints are permanently removed. BFF lookup endpoint now requires authentication. Co-Authored-By: Paperclip <noreply@paperclip.ing>
81 lines
2.2 KiB
JSON
81 lines
2.2 KiB
JSON
{
|
|
"Logging": {
|
|
"LogLevel": {
|
|
"Default": "Information",
|
|
"Microsoft.AspNetCore": "Warning",
|
|
"Microsoft.EntityFrameworkCore": "Warning"
|
|
}
|
|
},
|
|
"Serilog": {
|
|
"MinimumLevel": {
|
|
"Default": "Information",
|
|
"Override": {
|
|
"Microsoft": "Warning",
|
|
"Microsoft.EntityFrameworkCore": "Warning",
|
|
"System": "Warning"
|
|
}
|
|
},
|
|
"WriteTo": [
|
|
{
|
|
"Name": "Console",
|
|
"Args": {
|
|
"outputTemplate": "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} {Properties:j}{NewLine}{Exception}"
|
|
}
|
|
}
|
|
],
|
|
"Enrich": [
|
|
"FromLogContext",
|
|
"WithMachineName",
|
|
"WithThreadId"
|
|
]
|
|
},
|
|
"ConnectionStrings": {
|
|
"DefaultConnection": "Host=localhost;Database=iam_service;Username=goodgo;Password=goodgo-local-2024"
|
|
},
|
|
"Redis": {
|
|
"Host": "167.114.174.113",
|
|
"Port": 6379,
|
|
"Password": "Velik@2026",
|
|
"Database": 0,
|
|
"ConnectTimeout": 5000,
|
|
"SyncTimeout": 5000
|
|
},
|
|
"Jwt": {
|
|
"Secret": "goodgo-iam-service-secret-key-32chars!",
|
|
"Issuer": "goodgo-platform",
|
|
"Audience": "goodgo-services",
|
|
"AccessTokenExpiryMinutes": 15,
|
|
"RefreshTokenExpiryDays": 7
|
|
},
|
|
"Email": {
|
|
"SmtpServer": "smtp.mailgun.org",
|
|
"SmtpPort": 587,
|
|
"SmtpLogin": "admin@mail.goodgo.us",
|
|
"SmtpPassword": "a469e9333580ef5dbb141f01e33864ef-51afd2db-6c014754",
|
|
"SenderEmail": "verify@mail.goodgo.us",
|
|
"SenderName": "GoodGo IAM Service",
|
|
"BaseUrl": "http://localhost:5001"
|
|
},
|
|
"TwoFactor": {
|
|
"Issuer": "IAM Service",
|
|
"CodeLength": 6,
|
|
"ValidityPeriodSeconds": 30
|
|
},
|
|
"SocialLogin": {
|
|
"Google": {
|
|
"ClientId": "",
|
|
"ClientSecret": ""
|
|
},
|
|
"Facebook": {
|
|
"AppId": "",
|
|
"AppSecret": ""
|
|
},
|
|
"CallbackUrl": "/api/auth/external-callback"
|
|
},
|
|
"IdentityServer": {
|
|
"Authority": "http://localhost:5001",
|
|
"IssuerUri": "http://iam-service"
|
|
},
|
|
"AllowedHosts": "*"
|
|
}
|