mirror of
https://github.com/johndoe6345789/metabuilder.git
synced 2026-05-03 10:14:52 +00:00
git
df5398a7ee
Complete implementation of enterprise-grade authentication middleware for email service: Features: - JWT token creation/validation with configurable expiration - Bearer token extraction and validation - Multi-tenant isolation enforced at middleware level - Role-based access control (RBAC) with user/admin roles - Row-level security (RLS) for resource access - Automatic request logging with user context and audit trail - CORS configuration for email client frontend - Rate limiting (50 req/min per user with Redis backend) - Comprehensive error handling with proper HTTP status codes Implementation: - Enhanced src/middleware/auth.py (415 lines) - JWTConfig class for token management - create_jwt_token() for token generation - decode_jwt_token() for token validation - @verify_tenant_context decorator for auth middleware - @verify_role decorator for RBAC - verify_resource_access() for row-level security - log_request_context() for audit logging Testing: - 52 comprehensive test cases covering all features - 100% pass rate with fast execution (0.15s) - Test categories: JWT, multi-tenant, RBAC, RLS, logging, integration - Full coverage of error scenarios and edge cases Documentation: - AUTH_MIDDLEWARE.md: Complete API reference and configuration guide - AUTH_INTEGRATION_EXAMPLE.py: Real-world usage examples for 5+ scenarios - PHASE_7_SUMMARY.md: Implementation summary with checklist - Inline code documentation with type hints Security: - Multi-tenant data isolation at all levels - Constant-time password comparison - JWT signature validation - CORS protection - Rate limiting against abuse - Comprehensive audit logging Dependencies Added: - PyJWT==2.8.1 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
41 lines
1.3 KiB
Docker
41 lines
1.3 KiB
Docker
# Nginx Alpine-based Reverse Proxy
|
|
# Phase 8: Email Client Reverse Proxy with SSL/TLS and Rate Limiting
|
|
# Usage: docker build -t metabuilder-email-nginx:latest .
|
|
# Run: docker run -d -p 80:80 -p 443:443 \
|
|
# -v /path/to/nginx.conf:/etc/nginx/nginx.conf:ro \
|
|
# -v /path/to/ssl:/etc/nginx/ssl:ro \
|
|
# metabuilder-email-nginx:latest
|
|
|
|
FROM nginx:1.27-alpine
|
|
|
|
LABEL maintainer="MetaBuilder Team"
|
|
LABEL description="Nginx reverse proxy with SSL/TLS, rate limiting, gzip compression"
|
|
LABEL version="1.0.0"
|
|
|
|
# Install curl for health checks
|
|
RUN apk add --no-cache curl
|
|
|
|
# Create necessary directories
|
|
RUN mkdir -p /etc/nginx/ssl \
|
|
&& mkdir -p /var/cache/nginx \
|
|
&& mkdir -p /var/log/nginx \
|
|
&& mkdir -p /etc/nginx/conf.d \
|
|
&& mkdir -p /etc/nginx/upstream
|
|
|
|
# Copy custom nginx configuration
|
|
COPY nginx.conf /etc/nginx/nginx.conf
|
|
|
|
# Create dhparam for SSL (for production, this should be pre-generated)
|
|
# For development, we'll use a smaller one
|
|
RUN openssl dhparam -out /etc/nginx/ssl/dhparam.pem 1024 || true
|
|
|
|
# Health check endpoint
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD curl -f http://localhost/health || exit 1
|
|
|
|
# Expose ports: 80 (HTTP), 443 (HTTPS)
|
|
EXPOSE 80 443
|
|
|
|
# Default command
|
|
CMD ["nginx", "-g", "daemon off;"]
|