Rodrigo Rodriguez (Pragmatismo)
c67aaa677a
SECURITY MODULES ADDED: - security/auth.rs: Full RBAC with roles (Anonymous, User, Moderator, Admin, SuperAdmin, Service, Bot, BotOwner, BotOperator, BotViewer) and permissions - security/cors.rs: Hardened CORS (no wildcard in production, env-based config) - security/panic_handler.rs: Panic catching middleware with safe 500 responses - security/path_guard.rs: Path traversal protection, null byte prevention - security/request_id.rs: UUID request tracking with correlation IDs - security/error_sanitizer.rs: Sensitive data redaction from responses - security/zitadel_auth.rs: Zitadel token introspection and role mapping - security/sql_guard.rs: SQL injection prevention with table whitelist - security/command_guard.rs: Command injection prevention - security/secrets.rs: Zeroizing secret management - security/validation.rs: Input validation utilities - security/rate_limiter.rs: Rate limiting with governor crate - security/headers.rs: Security headers (CSP, HSTS, X-Frame-Options) MAIN.RS UPDATES: - Replaced tower_http::cors::Any with hardened create_cors_layer() - Added panic handler middleware - Added request ID tracking middleware - Set global panic hook SECURITY STATUS: - 0 unwrap() in production code - 0 panic! in production code - 0 unsafe blocks - cargo audit: PASS (no vulnerabilities) - Estimated completion: ~98% Remaining: Wire auth middleware to handlers, audit logs for sensitive data
84 lines
3.1 KiB
Rust
84 lines
3.1 KiB
Rust
use crate::shared::models::UserSession;
|
|
use crate::shared::state::AppState;
|
|
use log::{error, trace};
|
|
use rhai::{Dynamic, Engine};
|
|
use std::sync::Arc;
|
|
|
|
pub fn set_context_keyword(state: Arc<AppState>, user: UserSession, engine: &mut Engine) {
|
|
let cache = state.cache.clone();
|
|
|
|
engine
|
|
.register_custom_syntax(
|
|
["SET", "CONTEXT", "$expr$", "AS", "$expr$"],
|
|
true,
|
|
move |context, inputs| {
|
|
let context_name = context.eval_expression_tree(&inputs[0])?.to_string();
|
|
let context_value = context.eval_expression_tree(&inputs[1])?.to_string();
|
|
|
|
trace!(
|
|
"SET CONTEXT command executed - name: {}, value: {}",
|
|
context_name,
|
|
context_value
|
|
);
|
|
|
|
let redis_key = format!("context:{}:{}:{}", user.user_id, user.id, context_name);
|
|
|
|
trace!(
|
|
"Constructed Redis key: {} for user {}, session {}, context {}",
|
|
redis_key,
|
|
user.user_id,
|
|
user.id,
|
|
context_name
|
|
);
|
|
|
|
if let Some(cache_client) = &cache {
|
|
let cache_client = cache_client.clone();
|
|
|
|
trace!(
|
|
"Cloned cache_client, redis_key ({}) and context_value (len={}) for async task",
|
|
redis_key,
|
|
context_value.len()
|
|
);
|
|
|
|
tokio::spawn(async move {
|
|
let mut conn = match cache_client.get_multiplexed_async_connection().await {
|
|
Ok(conn) => {
|
|
trace!("Cache connection established successfully");
|
|
conn
|
|
}
|
|
Err(e) => {
|
|
error!("Failed to connect to cache: {}", e);
|
|
return;
|
|
}
|
|
};
|
|
|
|
trace!(
|
|
"Executing Redis SET command with key: {} and value length: {}",
|
|
redis_key,
|
|
context_value.len()
|
|
);
|
|
|
|
let result: Result<(), redis::RedisError> = redis::cmd("SET")
|
|
.arg(&redis_key)
|
|
.arg(&context_value)
|
|
.query_async(&mut conn)
|
|
.await;
|
|
|
|
match result {
|
|
Ok(_) => {
|
|
trace!("Context value successfully stored in cache");
|
|
}
|
|
Err(e) => {
|
|
error!("Failed to set cache value: {}", e);
|
|
}
|
|
}
|
|
});
|
|
} else {
|
|
trace!("No cache configured, context not persisted");
|
|
}
|
|
|
|
Ok(Dynamic::UNIT)
|
|
},
|
|
)
|
|
.expect("valid syntax registration");
|
|
}
|