mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 15:21:30 +02:00
Yogesh OjhaandClaude Opus 5
d8122ae9c1
A stored secret that failed to decrypt was used as if it were plaintext. unseal_headers handed the Fernet token back, so every run whose context carried auth sent `Authorization: gAAAAAB...` to the target and reported success. EncryptedJSON returned None, so a scan context's auth silently vanished and the run went out unauthenticated. load_proxy_endpoints returned an empty list, so a scan configured to go through a proxy went direct instead. Rotating SECRET_KEY was enough to trigger all three. decrypt_stored() now separates the two cases a lenient decrypt conflated. A value that carries no Fernet token was written before sealing shipped (2026-09-06) and is returned as it is. A value that carries one and will not open raises SecretDecryptionError, naming the header, the column or the proxy and what to do about it. A stage turns that into a failed activity with the message on it; the api answers 503 through a handler beside the existing DBAPIError one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ
107 lines
3.0 KiB
Python
107 lines
3.0 KiB
Python
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.exceptions import RequestValidationError
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.openapi.utils import get_openapi
|
|
from fastapi_pagination import add_pagination
|
|
from sqlalchemy.exc import DBAPIError
|
|
|
|
from app.api.router import router as api_router
|
|
from app.config import settings
|
|
from app.core.crypto import SecretDecryptionError
|
|
from app.core.database import check_capacity
|
|
from app.core.db_errors import data_exception_handler
|
|
from app.core.redis_sse_bridge import RedisSSEBridge
|
|
from app.core.sanitize import RejectNulMiddleware
|
|
from app.core.secret_errors import secret_decryption_handler
|
|
from app.core.throttle import GlobalRateLimitMiddleware
|
|
from app.core.validation_errors import validation_error_handler
|
|
from app.utils.helpers import create_initial_admin
|
|
from shared.logging import get_logger
|
|
|
|
logger = get_logger(__name__)
|
|
redis_sse_bridge = RedisSSEBridge(settings.redis_url)
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(_app: FastAPI):
|
|
logger.info("Starting Backend...")
|
|
try:
|
|
await create_initial_admin()
|
|
await check_capacity()
|
|
await redis_sse_bridge.start()
|
|
except Exception as e:
|
|
logger.exception("Failed to initialize the application: %s", e)
|
|
raise e
|
|
yield
|
|
logger.info("Shutting down reNgine Backend...")
|
|
await redis_sse_bridge.stop()
|
|
|
|
|
|
app = FastAPI(
|
|
title=settings.APP_NAME,
|
|
version=settings.APP_VERSION,
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
|
|
add_pagination(app)
|
|
|
|
|
|
def custom_openapi():
|
|
if app.openapi_schema:
|
|
return app.openapi_schema
|
|
|
|
openapi_schema = get_openapi(
|
|
title=settings.APP_NAME,
|
|
version=settings.APP_VERSION,
|
|
description="reNgine 3.0 - Attack Surface Management Platform",
|
|
routes=app.routes,
|
|
)
|
|
|
|
openapi_schema["components"]["securitySchemes"] = {
|
|
"BearerAuth": {
|
|
"type": "http",
|
|
"scheme": "bearer",
|
|
"bearerFormat": "JWT",
|
|
"description": "JWT from /auth/login",
|
|
}
|
|
}
|
|
|
|
app.openapi_schema = openapi_schema
|
|
return app.openapi_schema
|
|
|
|
|
|
app.openapi = custom_openapi
|
|
|
|
if "*" in settings.CORS_ORIGINS:
|
|
msg = "CORS_ORIGINS must be an explicit allowlist (no '*') when credentials are enabled"
|
|
raise ValueError(msg)
|
|
|
|
app.add_exception_handler(DBAPIError, data_exception_handler)
|
|
app.add_exception_handler(SecretDecryptionError, secret_decryption_handler)
|
|
app.add_exception_handler(RequestValidationError, validation_error_handler)
|
|
|
|
app.add_middleware(GlobalRateLimitMiddleware)
|
|
app.add_middleware(RejectNulMiddleware)
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.CORS_ORIGINS,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
app.include_router(api_router, prefix=settings.API_V1_PREFIX)
|
|
|
|
|
|
@app.get("/")
|
|
async def root():
|
|
logger.debug("Root endpoint accessed")
|
|
return {
|
|
"message": "reNgine API",
|
|
"version": settings.APP_VERSION,
|
|
"docs": "/docs",
|
|
}
|