twothatit
72bad11129
Fix #1 - SECRET_KEY startup validation (config.py, .env): - App refuses to start if SECRET_KEY is missing, shorter than 32 chars, or matches a known insecure default value - .env: replaced hardcoded test key with placeholder + generation hint Fix #2 - Docker socket proxy (docker-compose.yml): - Add tecnativa/docker-socket-proxy sidecar - Only expose required Docker API endpoints (CONTAINERS, IMAGES, NETWORKS, POST, EXEC); dangerous endpoints explicitly blocked - Remove direct /var/run/docker.sock mount from main container - Route Docker API via DOCKER_HOST=tcp://docker-socket-proxy:2375 Fix #3 - Azure AD group whitelist (auth.py, models.py, validators.py): - New azure_allowed_group_id field in SystemConfig - After token exchange, verify group membership via Graph API /me/memberOf - Deny login with HTTP 403 if user is not in the required group - New Azure AD users now get role 'viewer' instead of 'admin' Fix #4 - Rate limiting on login (main.py, auth.py, requirements.txt): - Add slowapi==0.1.9 dependency - Initialize SlowAPI limiter in main.py with 429 exception handler - Apply 10 requests/minute limit per IP on /login and /mfa/verify
27 lines
496 B
Plaintext
27 lines
496 B
Plaintext
# NetBird MSP Appliance - Python Dependencies
|
|
fastapi==0.104.1
|
|
uvicorn[standard]==0.24.0
|
|
sqlalchemy==2.0.23
|
|
aiosqlite==0.19.0
|
|
pydantic==2.5.2
|
|
pydantic-settings==2.1.0
|
|
python-jose[cryptography]==3.3.0
|
|
passlib[bcrypt]==1.7.4
|
|
bcrypt==4.1.2
|
|
cryptography==41.0.7
|
|
python-multipart==0.0.6
|
|
httpx==0.26.0
|
|
jinja2==3.1.2
|
|
docker==7.0.0
|
|
requests<2.32.0
|
|
urllib3<2
|
|
psutil==5.9.7
|
|
pyyaml==6.0.1
|
|
msal==1.28.0
|
|
pyotp==2.9.0
|
|
qrcode[pil]==7.4.2
|
|
slowapi==0.1.9
|
|
pytest==7.4.3
|
|
pytest-asyncio==0.23.2
|
|
pytest-httpx==0.28.0
|