feat: implement Ghaymah CLI Pre-Deployment Scanner and add associated audit and integration documentation
هذا الالتزام موجود في:
@@ -13,6 +13,13 @@ This report documents the results of a **deep, original adversarial security ass
|
||||
|
||||
### Key Metrics
|
||||
|
||||
```mermaid
|
||||
pie title New Findings by Severity (Total: 8)
|
||||
"Critical" : 2
|
||||
"High" : 3
|
||||
"Medium" : 3
|
||||
```
|
||||
|
||||
| Metric | Value |
|
||||
| :--- | :--- |
|
||||
| **Adversarial Tests Executed** | **62** |
|
||||
@@ -182,6 +189,20 @@ This means:
|
||||
1. The login request (`POST /signin/email-password`) containing **plaintext email and password** is routed through the proxy.
|
||||
2. The token refresh request (`POST /token`) containing the **refresh token** is routed through the proxy.
|
||||
|
||||
```mermaid
|
||||
sequenceDiagram
|
||||
participant U as Developer (CLI)
|
||||
participant P as Malicious Proxy (Mitmproxy)
|
||||
participant B as Backend (Auth Server)
|
||||
|
||||
U->>P: POST /signin (email, password)
|
||||
Note over P: Intercepts plaintext credentials!
|
||||
P->>B: POST /signin
|
||||
B-->>P: 200 OK (access_token, refresh_token)
|
||||
Note over P: Intercepts session tokens!
|
||||
P-->>U: 200 OK
|
||||
```
|
||||
|
||||
On shared infrastructure (CI/CD runners, cloud VMs, container environments), an attacker who can set environment variables can silently intercept **all credentials and tokens**.
|
||||
|
||||
**Impact:** Complete credential theft via proxy poisoning in multi-tenant environments.
|
||||
|
||||
@@ -325,29 +325,46 @@ The deploy command orchestrates a **10-step pipeline**. Here is the exact sequen
|
||||
|
||||
### 3.2 Deploy Data Flow Diagram
|
||||
|
||||
```
|
||||
┌──────────────┐ ┌─────────────────────┐ ┌──────────────────────┐
|
||||
│ Local Files │ │ Ghaymah CLI v2 │ │ Ghaymah Cloud │
|
||||
│ │ │ (gy-linux-amd64) │ │ │
|
||||
│ ./ │ │ │ │ │
|
||||
│ ├── src/ │────▶│ 1. Detect project │ │ │
|
||||
│ ├── .gy.json │ │ 2. Gen Dockerfile │ │ │
|
||||
│ ├── .env │ │ 3. Create tar.gz │ │ │
|
||||
│ └── Dockerfile│ │ 4. Upload artifact │────▶│ S3 Storage │
|
||||
│ │ │ │ │ (s3-nhost-proxy) │
|
||||
│ │ │ 5. GraphQL mutation │────▶│ Hasura GraphQL API │
|
||||
│ │ │ │ │ (graphql.ghaymah.systems)│
|
||||
│ │ │ 6. Subscribe status │◀──▶│ │
|
||||
│ │ │ (WebSocket) │ │ Build Pipeline │
|
||||
│ │ │ │ │ ├── Pull artifact │
|
||||
│ │ │ 7. Stream updates │◀───│ ├── docker build │
|
||||
│ │ │ "building..." │ │ ├── docker push │
|
||||
│ │ │ "deploying..." │ │ │ → registry.ghaymah│
|
||||
│ │ │ "running ✅" │ │ └── k8s deploy │
|
||||
│ │ │ │ │ │
|
||||
│ │ │ 8. Print app URL │ │ App running at: │
|
||||
│ │ │ https://{name}... │ │ https://{name}.hosted│
|
||||
└──────────────┘ └─────────────────────┘ └──────────────────────┘
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph Local["Local Files (./)"]
|
||||
A[src/]
|
||||
B[.gy.json]
|
||||
C[.env]
|
||||
D[Dockerfile]
|
||||
end
|
||||
|
||||
subgraph CLI["Ghaymah CLI v2 (gy-linux-amd64)"]
|
||||
direction TB
|
||||
E1[1. Detect project]
|
||||
E2[2. Gen Dockerfile]
|
||||
E3[3. Create tar.gz]
|
||||
E4[4. Upload artifact]
|
||||
E5[5. GraphQL mutation]
|
||||
E6[6. Subscribe status]
|
||||
E7[7. Stream updates]
|
||||
E8[8. Print app URL]
|
||||
end
|
||||
|
||||
subgraph Cloud["Ghaymah Cloud"]
|
||||
F1[S3 Storage<br/>s3-nhost-proxy]
|
||||
F2[Hasura GraphQL API<br/>graphql.ghaymah.systems]
|
||||
subgraph BuildPipe["Build Pipeline"]
|
||||
direction TB
|
||||
F3[Pull artifact]
|
||||
F4[docker build]
|
||||
F5[docker push<br/>→ registry.ghaymah]
|
||||
F6[k8s deploy]
|
||||
end
|
||||
end
|
||||
|
||||
Local --> E1
|
||||
E4 --> F1
|
||||
E5 --> F2
|
||||
E6 <--> F2
|
||||
E7 <--> BuildPipe
|
||||
F3 --> F4 --> F5 --> F6
|
||||
F1 -.-> F3
|
||||
```
|
||||
|
||||
### 3.3 Infrastructure Endpoints Used by Deploy
|
||||
@@ -409,32 +426,19 @@ mutation CreateApp($object: ghaymah_cloud_resources_insert_input!) {
|
||||
|
||||
### 3.5 Resource Status Lifecycle (WebSocket Subscription)
|
||||
|
||||
```
|
||||
┌─────────┐
|
||||
│ PENDING │ ← Resource just created via mutation
|
||||
└────┬────┘
|
||||
│
|
||||
▼
|
||||
┌─────────┐
|
||||
│BUILDING │ ← Backend pulling artifact from S3,
|
||||
│ │ running docker build
|
||||
└────┬────┘
|
||||
│
|
||||
┌────┴────┐
|
||||
│ │
|
||||
▼ ▼
|
||||
┌────────┐ ┌────────┐
|
||||
│DEPLOYING│ │ FAILED │ ← Build error / Dockerfile issue
|
||||
│ │ └────────┘
|
||||
└────┬───┘
|
||||
│
|
||||
▼
|
||||
┌────────┐
|
||||
│RUNNING │ ← App is live at https://{name}.hosted.ghaymah.systems
|
||||
└────────┘
|
||||
```mermaid
|
||||
stateDiagram-v2
|
||||
[*] --> PENDING : Resource created via mutation
|
||||
PENDING --> BUILDING : Backend pulling artifact / docker build
|
||||
BUILDING --> DEPLOYING
|
||||
BUILDING --> FAILED : Build error / Dockerfile issue
|
||||
DEPLOYING --> RUNNING : App live at https://{name}.hosted.ghaymah.systems
|
||||
DEPLOYING --> FAILED : K8s deploy issue
|
||||
|
||||
Timeout: 15 minutes → "deployment timed out"
|
||||
Stuck: → "Your app might be stuck building. Check 'gy logs'"
|
||||
note right of RUNNING
|
||||
Timeout: 15 minutes → "deployment timed out"
|
||||
Stuck: → "Your app might be stuck building. Check 'gy logs'"
|
||||
end note
|
||||
```
|
||||
|
||||
### 3.6 Auto-Generated Dockerfile Templates (13 Supported)
|
||||
|
||||
المرجع في مشكلة جديدة
حظر مستخدم