Cache and log hardening - phase 0 of the #189 data-minimization track #313

Merged

robbertbos merged 1 commit from phase-0-leak-hygiene into main 2026-08-15 20:39:55 +00:00

Conversation 0 Commits 1 Files changed 46 +1016 -212

robbertbos commented 2026-08-15 12:42:20 +00:00

Owner

Copy link

Research for #189 identified twelve cache/log leak surfaces that are independent of any architecture choice. This PR closes them (phase 0); the direction itself (refs-only cards, content on demand) stays in #189.

At the transport edge:

• Every /api response defaults to Cache-Control: no-store; the byte-proxy caches only inline raster images, for an hour; avatars and emoji keep their cache.
• Typed text no longer travels in request lines: mention-candidates (card + channel), resolve-mentions and people search are POST with the text in the body (resolve-mentions and people now take real lists). Accepted exception: the PDF preview keeps the real filename as its path segment, because the browser viewer titles itself after it (see security.md).
• The production image runs uvicorn with --no-access-log; the ZAD ingress keeps the single copy of request lines. The pod writes its own scrubbed request log instead (status, duration, pseudonymous user/session ids; no IPs or query strings), and oidc_sessions.last_seen_at marks session liveness once a minute.

In the application:

• SQLAlchemy errors stringify without bind parameters (hide_parameters), so a failed card insert cannot put message text in a traceback.
• 422 responses carry type/loc/msg but never the submitted input; import validation details name field paths, not values.
• The rate limiter refusal log carries ip: instead of a raw client IP (same treatment as audit_events).
• sync_logs rows age out after 90 days (WAGGLE_SYNC_LOG_RETENTION_DAYS), pruned on the audit-purge tick.

In the browser:

• Logout sends Clear-Site-Data: "cache", "storage" (theme rehydrates from the settings table) and sweeps localStorage traces; the 401 path sweeps too.

Docs: security.md gains a section on response caching, browser storage, access logs and the shared-workstation scenario; deployment.md gains WAGGLE_LOG_LEVEL (never DEBUG in production) and WAGGLE_SYNC_LOG_RETENTION_DAYS.

Gates: 1970 backend tests at 100% coverage, 1177 vitest, vue-tsc + build, pinned pre-commit across all files, full e2e suite locally green after rebase.

Research for #189 identified twelve cache/log leak surfaces that are independent of any architecture choice. This PR closes them (phase 0); the direction itself (refs-only cards, content on demand) stays in #189. At the transport edge: - Every /api response defaults to Cache-Control: no-store; the byte-proxy caches only inline raster images, for an hour; avatars and emoji keep their cache. - Typed text no longer travels in request lines: mention-candidates (card + channel), resolve-mentions and people search are POST with the text in the body (resolve-mentions and people now take real lists). Accepted exception: the PDF preview keeps the real filename as its path segment, because the browser viewer titles itself after it (see security.md). - The production image runs uvicorn with --no-access-log; the ZAD ingress keeps the single copy of request lines. The pod writes its own scrubbed request log instead (status, duration, pseudonymous user/session ids; no IPs or query strings), and oidc_sessions.last_seen_at marks session liveness once a minute. In the application: - SQLAlchemy errors stringify without bind parameters (hide_parameters), so a failed card insert cannot put message text in a traceback. - 422 responses carry type/loc/msg but never the submitted input; import validation details name field paths, not values. - The rate limiter refusal log carries ip:<hash> instead of a raw client IP (same treatment as audit_events). - sync_logs rows age out after 90 days (WAGGLE_SYNC_LOG_RETENTION_DAYS), pruned on the audit-purge tick. In the browser: - Logout sends Clear-Site-Data: "cache", "storage" (theme rehydrates from the settings table) and sweeps localStorage traces; the 401 path sweeps too. Docs: security.md gains a section on response caching, browser storage, access logs and the shared-workstation scenario; deployment.md gains WAGGLE_LOG_LEVEL (never DEBUG in production) and WAGGLE_SYNC_LOG_RETENTION_DAYS. Gates: 1970 backend tests at 100% coverage, 1177 vitest, vue-tsc + build, pinned pre-commit across all files, full e2e suite locally green after rebase.

robbertbos force-pushed phase-0-leak-hygiene from 04d7582faa to 746cd3c0fe 2026-08-15 12:53:56 +00:00 Compare

robbertbos force-pushed phase-0-leak-hygiene from 746cd3c0fe to 65cda0de63 2026-08-15 13:07:54 +00:00 Compare

robbertbos force-pushed phase-0-leak-hygiene from 65cda0de63 to 44367ba486 2026-08-15 20:01:27 +00:00 Compare

robbertbos referenced this pull request 2026-08-15 20:07:52 +00:00

Cut v2026.8.15 #319

robbertbos force-pushed phase-0-leak-hygiene from 44367ba486 to bc7fea65c7 2026-08-15 20:24:50 +00:00 Compare

robbertbos force-pushed phase-0-leak-hygiene from bc7fea65c7 to 53f612b964 2026-08-15 20:30:29 +00:00 Compare

robbertbos force-pushed phase-0-leak-hygiene from 53f612b964 to ff2ceeabfa 2026-08-15 20:36:00 +00:00 Compare

robbertbos merged commit ff2ceeabfa into main 2026-08-15 20:39:55 +00:00

robbertbos deleted branch phase-0-leak-hygiene 2026-08-15 20:39:55 +00:00

robbertbos referenced this pull request from a commit 2026-08-15 21:25:26 +00:00

Channel typeahead: ~ links a channel

robbertbos referenced this pull request 2026-08-15 21:32:54 +00:00

Channel typeahead: ~ links a channel #320

robbertbos referenced this pull request from a commit 2026-08-15 21:47:35 +00:00

Channel typeahead: ~ links a channel

robbertbos referenced this pull request 2026-08-16 12:47:37 +00:00

Explore: fetch Mattermost data directly from the frontend (backend data minimization) #189

robbertbos referenced this pull request from a commit 2026-08-16 13:16:46 +00:00

Channel typeahead: ~ links a channel

robbertbos referenced this pull request from a commit 2026-08-16 13:57:29 +00:00

Channel typeahead: ~ links a channel

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

nldd ds

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

nldd ds

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

robbertbos/waggle!313

No description provided.