Rodrigo Rodriguez (Pragmatismo)
c67aaa677a
SECURITY MODULES ADDED: - security/auth.rs: Full RBAC with roles (Anonymous, User, Moderator, Admin, SuperAdmin, Service, Bot, BotOwner, BotOperator, BotViewer) and permissions - security/cors.rs: Hardened CORS (no wildcard in production, env-based config) - security/panic_handler.rs: Panic catching middleware with safe 500 responses - security/path_guard.rs: Path traversal protection, null byte prevention - security/request_id.rs: UUID request tracking with correlation IDs - security/error_sanitizer.rs: Sensitive data redaction from responses - security/zitadel_auth.rs: Zitadel token introspection and role mapping - security/sql_guard.rs: SQL injection prevention with table whitelist - security/command_guard.rs: Command injection prevention - security/secrets.rs: Zeroizing secret management - security/validation.rs: Input validation utilities - security/rate_limiter.rs: Rate limiting with governor crate - security/headers.rs: Security headers (CSP, HSTS, X-Frame-Options) MAIN.RS UPDATES: - Replaced tower_http::cors::Any with hardened create_cors_layer() - Added panic handler middleware - Added request ID tracking middleware - Set global panic hook SECURITY STATUS: - 0 unwrap() in production code - 0 panic! in production code - 0 unsafe blocks - cargo audit: PASS (no vulnerabilities) - Estimated completion: ~98% Remaining: Wire auth middleware to handlers, audit logs for sensitive data
73 lines
2.7 KiB
Rust
73 lines
2.7 KiB
Rust
use crate::shared::models::TriggerKind;
|
|
use crate::shared::models::UserSession;
|
|
use crate::shared::state::AppState;
|
|
use diesel::prelude::*;
|
|
use log::error;
|
|
use log::trace;
|
|
use rhai::Dynamic;
|
|
use rhai::Engine;
|
|
use serde_json::{json, Value};
|
|
pub fn on_keyword(state: &AppState, _user: UserSession, engine: &mut Engine) {
|
|
let state_clone = state.clone();
|
|
engine
|
|
.register_custom_syntax(
|
|
["ON", "$ident$", "OF", "$string$"],
|
|
true,
|
|
move |context, inputs| {
|
|
let trigger_type = context.eval_expression_tree(&inputs[0])?.to_string();
|
|
let table = context.eval_expression_tree(&inputs[1])?.to_string();
|
|
let name = format!("{}_{}.rhai", table, trigger_type.to_lowercase());
|
|
let kind = match trigger_type.to_uppercase().as_str() {
|
|
"UPDATE" => TriggerKind::TableUpdate,
|
|
"INSERT" => TriggerKind::TableInsert,
|
|
"DELETE" => TriggerKind::TableDelete,
|
|
_ => return Err(format!("Invalid trigger type: {}", trigger_type).into()),
|
|
};
|
|
trace!(
|
|
"Starting execute_on_trigger with kind: {:?}, table: {}, param: {}",
|
|
kind,
|
|
table,
|
|
name
|
|
);
|
|
let mut conn = state_clone
|
|
.conn
|
|
.get()
|
|
.map_err(|e| format!("DB error: {}", e))?;
|
|
let result = execute_on_trigger(&mut conn, kind, &table, &name)
|
|
.map_err(|e| format!("DB error: {}", e))?;
|
|
if let Some(rows_affected) = result.get("rows_affected") {
|
|
Ok(Dynamic::from(rows_affected.as_i64().unwrap_or(0)))
|
|
} else {
|
|
Err("No rows affected".into())
|
|
}
|
|
},
|
|
)
|
|
.expect("valid syntax registration");
|
|
}
|
|
pub fn execute_on_trigger(
|
|
conn: &mut diesel::PgConnection,
|
|
kind: TriggerKind,
|
|
table: &str,
|
|
param: &str,
|
|
) -> Result<Value, String> {
|
|
use crate::shared::models::system_automations;
|
|
let new_automation = (
|
|
system_automations::kind.eq(kind as i32),
|
|
system_automations::target.eq(table),
|
|
system_automations::param.eq(param),
|
|
);
|
|
let result = diesel::insert_into(system_automations::table)
|
|
.values(&new_automation)
|
|
.execute(conn)
|
|
.map_err(|e| {
|
|
error!("SQL execution error: {}", e);
|
|
e.to_string()
|
|
})?;
|
|
Ok(json!({
|
|
"command": "on_trigger",
|
|
"trigger_type": format!("{:?}", kind),
|
|
"table": table,
|
|
"param": param,
|
|
"rows_affected": result
|
|
}))
|
|
}
|