31 Commits

Author SHA1 Message Date
Christian Krakau-Louis e2b95f183d fix: harden public api token storage 2026-05-23 17:47:13 +02:00
Christian Krakau-Louis ee663afffb feat: add scoped read-only public API 2026-05-23 17:39:34 +02:00
Christian Krakau-Louis c029574717 feat: define mail connector framework 2026-05-23 15:57:34 +02:00
Christian Krakau-Louis d5693c6d1d fix: encrypt mail source credentials 2026-05-23 00:27:08 +02:00
Christian Krakau-Louis 302159aeb6 feat: import selected fork operational fixes 2026-05-22 23:48:00 +02:00
Christian Krakau-Louis 51f9f303ca Merge pull request #113 from christianlouis/copilot/fix-imap-client-folder-issue
Honor configured IMAP source folder
2026-05-22 22:19:01 +02:00
Christian Krakau-Louis ed38cef7d0 feat: add production startup checks 2026-05-22 22:08:19 +02:00
copilot-swe-agent[bot] f626675609 fix: honor configured IMAP source folder 2026-05-22 20:06:11 +00:00
Christian Krakau-Louis eeff24fa5c fix: redact secret diagnostics 2026-05-22 22:00:28 +02:00
Christian Krakau-Louis b4191e956c address backend security and test suggestions 2026-05-18 16:44:06 +02:00
copilot-swe-agent[bot] 3a5b75e964 Fix Logto callback SSL error: extend LOGTO_SKIP_SSL_VERIFY patch to PyJWKClient (JWKS/urllib)
The 'Fail to fetch data from the url' callback error came from PyJWT's
PyJWKClient.fetch_data() using urllib to retrieve the JWKS, which is not
covered by the existing aiohttp.ClientSession SSL monkey-patch.

Extend _apply_logto_ssl_patch() to also replace PyJWKClient inside
logto.OidcCore with a subclass that injects the non-verifying ssl.SSLContext
via the ssl_context constructor parameter, ensuring both the OIDC discovery/
token requests (aiohttp) and ID-token JWKS verification (urllib) honour
LOGTO_SKIP_SSL_VERIFY=True.

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/14676b1a-3421-4839-9ba3-8229a3e5adf1

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 17:15:58 +00:00
copilot-swe-agent[bot] 92d6a06a33 Default LOGTO_SKIP_SSL_VERIFY to true; update comment and docs
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/8a17f133-904d-45c7-bc35-b3f5c1d2c97e

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 16:46:25 +00:00
copilot-swe-agent[bot] 9f5e2c1258 fix: use OAuthScope.offlineAccess instead of Scope.offlineAccess for logto SDK compatibility
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/2982bcbd-abe6-474a-94ff-e7c6aabe4890

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 15:57:24 +00:00
copilot-swe-agent[bot] 04931172dd feat: add AUTH_DISABLED no-auth fallback mode
- config.py: AUTH_DISABLED: bool = False setting
- middleware/auth.py: bypass all checks when AUTH_DISABLED=True
- security.py: require_admin_auth returns synthetic context when disabled
- endpoints/auth.py: /me returns synthetic admin; /sign-out → / when disabled
- main.py: startup WARNING when disabled; pass auth_disabled to login.html
- templates/login.html: info banner with Go to dashboard link when disabled
- templates/setup.html: document AUTH_DISABLED option with security warning
- tests/test_auth.py: 4 new AUTH_DISABLED tests (445 total, all pass)

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/18f41bf2-0b68-4b7d-afb5-d2894c212a8f

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 11:38:52 +00:00
copilot-swe-agent[bot] 531dc968a8 feat: integrate Logto OIDC for user authentication
- Add Logto OIDC integration (app/core/logto.py): CookieStorage adapter,
  create/decode session token helpers, sync_logto_user upsert
- New auth endpoints (/api/v1/auth): sign-in, callback, sign-out, me
- AuthRedirectMiddleware: protects HTML pages, redirects to /setup when
  Logto is unconfigured, to /login otherwise
- Update require_admin_auth: accepts dmarq_session cookie JWT first,
  then API key, then Bearer JWT (fully backward compatible)
- Update User model: add logto_id, username, picture, created_at, updated_at;
  make hashed_password nullable for Logto-only users; is_superuser default=True
- New Alembic migration d4e5f6a7b8c9 for the above schema changes
- Add LOGTO_ENDPOINT / LOGTO_APP_ID / LOGTO_APP_SECRET / LOGTO_REDIRECT_URI
  settings with logto_configured property
- Create login.html (Sign in with Logto button) and setup.html (step-by-step
  configuration guide)
- Update base.html: user menu with avatar/name and sign-out via Alpine.js
  fetch to /api/v1/auth/me
- Update settings.html: remove localStorage adminApiKey; session cookie is
  sent automatically by browser; add 401 → /login redirect
- Update requirements.txt: replace fastapi-users additions with logto + aiohttp
- Add test_auth.py: 18 new tests covering session tokens, CookieStorage,
  sync_logto_user, /me, /sign-in (503), /sign-out cookie clearing
- Fix test_security_extra.py: pass Request mock to require_admin_auth;
  add new test_valid_session_cookie_returns_auth_context

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 10:09:50 +00:00
copilot-swe-agent[bot] 308e6f8d91 chore: pivot plan to Logto OIDC integration
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-30 09:59:13 +00:00
copilot-swe-agent[bot] 4f9e3b4b4b Fix CodeQL clear-text logging alerts and improve startup test coverage
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/3d5dbbdc-99d5-4dc3-8ca9-a763ba917ae4

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 23:43:14 +00:00
copilot-swe-agent[bot] aa8c55d27c Fix 4 CodeQL alerts: lgtm suppress clear-text logging, add @classmethod to validator
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/d2144e43-76eb-41c3-af31-9dcb7695bcbf

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 23:22:23 +00:00
copilot-swe-agent[bot] ccb3f3fb7e Allow admin API key to be configured via ADMIN_API_KEY env var
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/27db6d87-70db-4979-a23c-dd376f1c3b9a

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 23:10:36 +00:00
copilot-swe-agent[bot] 423c596c28 fix: ensure data persistence across reinstallations
- Add entrypoint.sh: creates /app/data, stamps legacy DBs, runs alembic upgrade head
- Update Dockerfile to use new entrypoint and pre-create /app/data
- Change default DATABASE_URL to sqlite:///./data/dmarq.db
- Add _ensure_sqlite_dir() to database.py for automatic directory creation
- Update docker-compose.yml with app_data named volume for /app/data
- Add 6 tests for _ensure_sqlite_dir and updated default URL

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/2bac317b-97a2-450b-84f1-3e316f7ef54c

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 18:53:00 +00:00
copilot-swe-agent[bot] 70dc77011a Fix ModuleNotFoundError for asyncpg by normalizing async DB URLs to psycopg2
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/d1890838-1770-4d5f-886f-f210df761fae

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 16:03:18 +00:00
copilot-swe-agent[bot] 9f99b6c6d7 fix: handle empty BACKEND_CORS_ORIGINS env var to prevent JSONDecodeError
In pydantic_settings v2, List[str] fields are JSON-parsed by the env
source before pydantic validators run. When BACKEND_CORS_ORIGINS=""
(empty string) in Kubernetes, json.loads("") raised JSONDecodeError,
crashing alembic migrations.

Fixes:
- Add env_ignore_empty=True to class Config so pydantic_settings skips
  empty-string env vars and falls back to the field default
- Update assemble_cors_origins validator to explicitly handle empty and
  whitespace-only strings (returns []), JSON array strings (parsed via
  json.loads), and filters empty tokens from comma-separated values
- Add backend/app/tests/test_config.py covering all CORS origins
  parsing scenarios including the empty-string regression case

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/53bb1064-2a32-4691-8397-9d4663bc18a8

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 12:08:59 +00:00
copilot-swe-agent[bot] 01d0331136 Resolve linter contradictions: consolidate config, fix isort first-party, pylint 10/10
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/1e4a1f06-55b9-4040-853e-6aaf9ee574c8

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 11:31:15 +00:00
copilot-swe-agent[bot] f2a015971d Plan: resolve linter contradictions
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/1e4a1f06-55b9-4040-853e-6aaf9ee574c8

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 11:29:14 +00:00
copilot-swe-agent[bot] 50aa5bd5da Fix pylint warnings: logging, globals, exceptions, imports, duplicates
Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/576427d4-4f6a-46d2-b75f-6862ecbcf526

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-29 11:21:35 +00:00
google-labs-jules[bot] 1831c1a079 🔒 security: move IMAP credentials to request body and fix CI/pylint issues
- Moved IMAP credentials from query parameters to the request body for the test-connection endpoint.
- Created missing `__init__.py` files across `backend/app/` to fix CI `ModuleNotFoundError`.
- Reformatted `setup.py` and `user.py` using `black` to pass lint checks.
- Addressed Pylint warnings in `imap.py` (unused arguments, lazy logging, exception chaining).

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-23 18:57:40 +00:00
copilot-swe-agent[bot] 6ae017b142 Fix code formatting and linting issues
- Auto-format all Python files with black and isort
- Remove unused imports with autoflake
- Fix flake8 issues (missing newlines, blank lines, etc.)
- Fix nonlocal/global scope issues in main.py
- Fix security.py import order (E402)
- Remove f-string without placeholders
- Add nosec comment for intentional exception handling
- Fix test imports to match refactored DMARCParser API

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-09 12:08:51 +00:00
copilot-swe-agent[bot] 494ef135d5 Final code review fixes: move import, remove empty tests, add production warning
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-09 11:53:43 +00:00
copilot-swe-agent[bot] 8550799bf8 Address code review feedback: improve XSS prevention, structured errors, API key logging, CSP warnings
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-09 11:51:58 +00:00
copilot-swe-agent[bot] 03f4eaf724 Implement critical security fixes: secret management, XML parsing, auth, input validation, security headers
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-09 11:43:22 +00:00
Christian Krakau-Louis f910cb0ba4 Add initial MVP documentation for DMARQ platform, detailing backend architecture, frontend implementation, and deployment structure 2025-04-17 15:20:42 +02:00