-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
176 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| # NodeLocker TODO List | ||
|
|
||
| ## Security Improvements | ||
| - [ ] Replace SHA1 password hashing with bcrypt or Argon2 | ||
| - Priority: High | ||
| - Impact: Critical for password security | ||
| - Details: Current implementation uses static salts and SHA1 | ||
|
|
||
| - [ ] Move TLS certificates to secure storage | ||
| - Priority: High | ||
| - Impact: Production security | ||
| - Details: Current `/dev/shm` storage is temporary and insecure | ||
|
|
||
| - [ ] Implement rate limiting for API endpoints | ||
| - Priority: High | ||
| - Impact: Protection against brute force attacks | ||
| - Details: Add rate limiting middleware using token bucket algorithm | ||
|
|
||
| - [ ] Add secure headers | ||
| - Priority: Medium | ||
| - Impact: Improved security posture | ||
| - Details: Implement security headers (HSTS, CSP, etc.) | ||
|
|
||
| ## Code Quality | ||
| - [ ] Implement proper error handling | ||
| - Priority: High | ||
| - Impact: Reliability and debugging | ||
| - Details: Remove `trunk-ignore` directives and handle all errors | ||
|
|
||
| - [ ] Add structured logging | ||
| - Priority: Medium | ||
| - Impact: Observability | ||
| - Details: Replace fmt.Println with proper logging framework | ||
|
|
||
| - [ ] Refactor long functions | ||
| - Priority: Medium | ||
| - Impact: Maintainability | ||
| - Details: Split `adminHandler` and similar large functions | ||
|
|
||
| - [ ] Implement configuration management | ||
| - Priority: High | ||
| - Impact: Deployment flexibility | ||
| - Details: Add support for config files and environment variables | ||
|
|
||
| - [ ] Update HTTP methods | ||
| - Priority: Medium | ||
| - Impact: REST compliance | ||
| - Details: Use proper POST/PUT/DELETE methods instead of GET | ||
|
|
||
| ## Documentation | ||
| - [ ] Add API documentation | ||
| - Priority: High | ||
| - Impact: Developer experience | ||
| - Details: Implement Swagger/OpenAPI documentation | ||
|
|
||
| - [ ] Improve code documentation | ||
| - Priority: Medium | ||
| - Impact: Maintainability | ||
| - Details: Add godoc comments for all exported functions | ||
|
|
||
| - [ ] Create deployment guide | ||
| - Priority: Medium | ||
| - Impact: Operations | ||
| - Details: Document production deployment steps | ||
|
|
||
| - [ ] Add architecture documentation | ||
| - Priority: Medium | ||
| - Impact: System understanding | ||
| - Details: Document system design and component interaction | ||
|
|
||
| ## Testing | ||
| - [ ] Add unit tests for core functionality | ||
| - Priority: High | ||
| - Impact: Code reliability | ||
| - Details: Test all core business logic functions | ||
|
|
||
| - [ ] Implement integration tests | ||
| - Priority: High | ||
| - Impact: System reliability | ||
| - Details: Add Redis integration tests | ||
|
|
||
| - [ ] Add API endpoint tests | ||
| - Priority: Medium | ||
| - Impact: API reliability | ||
| - Details: Test all HTTP endpoints | ||
|
|
||
| - [ ] Create test environment | ||
| - Priority: Medium | ||
| - Impact: Testing reliability | ||
| - Details: Setup isolated test environment with Docker | ||
|
|
||
| ## Future Enhancements | ||
| - [ ] Add metrics collection | ||
| - Priority: Low | ||
| - Impact: Monitoring | ||
| - Details: Implement Prometheus metrics | ||
|
|
||
| - [ ] Add health check endpoints | ||
| - Priority: Medium | ||
| - Impact: Operations | ||
| - Details: Implement readiness and liveness probes | ||
|
|
||
| - [ ] Implement Redis connection pooling | ||
| - Priority: Low | ||
| - Impact: Performance | ||
| - Details: Configure and optimize Redis connection pool |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package x | ||
|
|
||
| import ( | ||
| "crypto/sha1" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "golang.org/x/crypto/bcrypt" | ||
| ) | ||
|
|
||
| const ( | ||
| // BcryptCost for bcrypt hashing (between 10 and 14 recommended for production) | ||
| BcryptCost = 12 | ||
|
|
||
| // Hash version prefixes | ||
| bcryptPrefix = "$2a$" | ||
| sha1Prefix = "sha1$" | ||
|
|
||
| // Legacy SHA1 salts | ||
| preSalt = "68947b1f416c3a5655e1ff9e7c7935f6" | ||
| postSalt = "5f09dd9c81596ea3cc93ce0df58e26d8" | ||
| ) | ||
|
|
||
| // HashPassword creates a bcrypt hash of the password with version prefix | ||
| func HashPassword(password string) (string, error) { | ||
| bytes, err := bcrypt.GenerateFromPassword([]byte(password), BcryptCost) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return string(bytes), nil | ||
| } | ||
|
|
||
| // CheckPassword compares a password against a hashed password, handling both old and new formats | ||
| func CheckPassword(password, hashedPassword string) bool { | ||
| // Check if it's a bcrypt hash | ||
| if strings.HasPrefix(hashedPassword, bcryptPrefix) { | ||
| err := bcrypt.CompareHashAndPassword([]byte(hashedPassword), []byte(password)) | ||
| return err == nil | ||
| } | ||
|
|
||
| // Fall back to SHA1 for legacy passwords | ||
| h := sha1.New() | ||
| h.Write([]byte(preSalt + password + postSalt)) | ||
| sha1Hash := fmt.Sprintf("%x", h.Sum(nil)) | ||
| return sha1Hash == hashedPassword | ||
| } | ||
|
|
||
| // NeedsUpgrade checks if the password hash needs to be upgraded | ||
| func NeedsUpgrade(hashedPassword string) bool { | ||
| return !strings.HasPrefix(hashedPassword, bcryptPrefix) | ||
| } |