1 line
11 KiB
JSON
1 line
11 KiB
JSON
{"repo": "ahmdelbaz28-ux/bazspark", "files": {"deploy/akamai/waf/api-security.json": {"77bb8a0f433ce244085b03d8392bc593a964b306": {"t": 1785674319.0624945, "n": 4984, "h": "045a97fcb19dd9fa", "c": "{\n \"_comment\": \"Akamai API Security configuration — schema-based protection for BAZSPARK's 30+ API routers. Upload the OpenAPI spec (from /api/v1/openapi.json) and Akamai auto-discovers endpoints + enforces schema conformance. See docs/AKAMAI_DEPLOYMENT_GUIDE.md.\",\n \"configName\": \"BAZSPARK-API-SECURITY\",\n \"openApiSpecSource\": \"/api/v1/openapi.json\",\n \"discoveryMode\": \"AUTO_DISCOVER_AND_ENFORCE\",\n \"endpoints\": [\n {\n \"path\": \"/api/v1/auth/login\",\n \"method\": \"POST\",\n \"schema\": {\n \"body\": {\n \"type\": \"object\",\n \"required\": [\"api_key\"],\n \"properties\": {\n \"api_key\": {\"type\": \"string\", \"minLength\": 64, \"maxLength\": 64, \"pattern\": \"^[a-fA-F0-9]{64}$\"},\n \"user_email\": {\"type\": \"string\", \"format\": \"email\"}\n },\n \"additionalProperties\": false\n }\n },\n \"rateLimit\": {\n \"perIp\": \"10/minute\",\n \"perUser\": \"5/minute\"\n },\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"BLOCK_IF_API_KEY_IN_QUERY_STRING\",\n \"BLOCK_IF_API_KEY_IN_URL_PATH\",\n \"REQUIRE_HTTPS\"\n ]\n },\n {\n \"path\": \"/api/v1/projects\",\n \"method\": \"GET\",\n \"rateLimit\": {\n \"perIp\": \"60/minute\",\n \"perUser\": \"60/minute\"\n },\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/projects\",\n \"method\": \"POST\",\n \"schema\": {\n \"body\": {\n \"type\": \"object\",\n \"required\": [\"name\"],\n \"properties\": {\n \"name\": {\"type\": \"string\", \"minLength\": 1, \"maxLength\": 200},\n \"description\": {\"type\": \"string\", \"maxLength\": 5000},\n \"author\": {\"type\": \"string\", \"maxLength\": 100}\n },\n \"additionalProperties\": false\n }\n },\n \"rateLimit\": {\"perUser\": \"20/minute\"},\n \"protections\": [\"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\", \"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/qomn/*\",\n \"method\": \"POST\",\n \"_comment\": \"NFPA 72 engineering calculation endpoints — strict schema validation required for safety.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"LOG_ENGINEERING_CALCULATION_FOR_AUDIT_TRAIL\"\n ],\n \"comments\": \"Engineering calculations are auditable events per NFPA 72 §14.2.4 — must log to immutable audit trail.\"\n },\n {\n \"path\": \"/api/v1/marine/*\",\n \"method\": \"POST\",\n \"_comment\": \"SOLAS / IMO ship design pipeline — same audit requirements as qomn.\",\n \"rateLimit\": {\"perUser\": \"20/minute\"},\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"LOG_ENGINEERING_CALCULATION_FOR_AUDIT_TRAIL\"\n ]\n },\n {\n \"path\": \"/api/v1/projects/{project_id}/reports/*\",\n \"method\": \"GET\",\n \"_comment\": \"Report generation (PDF/DXF/Excel) — large responses, allow long TTL.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"responseTimeout\": \"5m\",\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\", \"ALLOW_LARGE_RESPONSE\"]\n },\n {\n \"path\": \"/api/v1/environment/*\",\n \"method\": \"GET\",\n \"_comment\": \"Weather/geocode/hazmat endpoints — public data, allow higher rate.\",\n \"rateLimit\": {\"perUser\": \"120/minute\"},\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/admin/*\",\n \"method\": \"*\",\n \"_comment\": \"Admin endpoints — require admin role + IP allowlist.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"protections\": [\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"REQUIRE_ADMIN_ROLE\",\n \"IP_ALLOWLIST_OPTIONAL\"\n ],\n \"ipAllowlist\": \"${AKAMAI_ADMIN_IP_ALLOWLIST}\",\n \"comments\": \"If env var set, only listed IPs can access admin endpoints.\"\n }\n ],\n \"globalProtections\": [\n {\n \"name\": \"Block API key in URL\",\n \"description\": \"Never allow X-API-Key as a query parameter — only header.\",\n \"condition\": \"url.query contains \\\"api_key=\\\" OR url.query contains \\\"apikey=\\\" OR url.query contains \\\"X-API-Key=\\\"\",\n \"action\": \"DENY\",\n \"comments\": \"API keys in URLs leak into server logs, browser history, and Referer headers.\"\n },\n {\n \"name\": \"Require HTTPS\",\n \"description\": \"All API requests must use HTTPS.\",\n \"condition\": \"request.protocol equals \\\"HTTP\\\"\",\n \"action\": \"REDIRECT_TO_HTTPS\"\n },\n {\n \"name\": \"Block path traversal\",\n \"description\": \"Block ../ and ..\\\\ in URL paths.\",\n \"condition\": \"url.path contains \\\"../\\\" OR url.path contains \\\"..\\\\\\\\\\\"\",\n \"action\": \"DENY\"\n },\n {\n \"name\": \"Block null bytes in URL\",\n \"description\": \"Null byte injection attack.\",\n \"condition\": \"url.path contains \\\"%00\\\" OR url.path contains \\\"\\\\x00\\\"\",\n \"action\": \"DENY\"\n }\n ]\n}\n"}, "e768a2678042f568169ab16d241472344fbb9ca1": {"t": 1785846876.261118, "n": 4984, "h": "045a97fcb19dd9fa", "c": "{\n \"_comment\": \"Akamai API Security configuration — schema-based protection for BAZSPARK's 30+ API routers. Upload the OpenAPI spec (from /api/v1/openapi.json) and Akamai auto-discovers endpoints + enforces schema conformance. See docs/AKAMAI_DEPLOYMENT_GUIDE.md.\",\n \"configName\": \"BAZSPARK-API-SECURITY\",\n \"openApiSpecSource\": \"/api/v1/openapi.json\",\n \"discoveryMode\": \"AUTO_DISCOVER_AND_ENFORCE\",\n \"endpoints\": [\n {\n \"path\": \"/api/v1/auth/login\",\n \"method\": \"POST\",\n \"schema\": {\n \"body\": {\n \"type\": \"object\",\n \"required\": [\"api_key\"],\n \"properties\": {\n \"api_key\": {\"type\": \"string\", \"minLength\": 64, \"maxLength\": 64, \"pattern\": \"^[a-fA-F0-9]{64}$\"},\n \"user_email\": {\"type\": \"string\", \"format\": \"email\"}\n },\n \"additionalProperties\": false\n }\n },\n \"rateLimit\": {\n \"perIp\": \"10/minute\",\n \"perUser\": \"5/minute\"\n },\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"BLOCK_IF_API_KEY_IN_QUERY_STRING\",\n \"BLOCK_IF_API_KEY_IN_URL_PATH\",\n \"REQUIRE_HTTPS\"\n ]\n },\n {\n \"path\": \"/api/v1/projects\",\n \"method\": \"GET\",\n \"rateLimit\": {\n \"perIp\": \"60/minute\",\n \"perUser\": \"60/minute\"\n },\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/projects\",\n \"method\": \"POST\",\n \"schema\": {\n \"body\": {\n \"type\": \"object\",\n \"required\": [\"name\"],\n \"properties\": {\n \"name\": {\"type\": \"string\", \"minLength\": 1, \"maxLength\": 200},\n \"description\": {\"type\": \"string\", \"maxLength\": 5000},\n \"author\": {\"type\": \"string\", \"maxLength\": 100}\n },\n \"additionalProperties\": false\n }\n },\n \"rateLimit\": {\"perUser\": \"20/minute\"},\n \"protections\": [\"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\", \"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/qomn/*\",\n \"method\": \"POST\",\n \"_comment\": \"NFPA 72 engineering calculation endpoints — strict schema validation required for safety.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"LOG_ENGINEERING_CALCULATION_FOR_AUDIT_TRAIL\"\n ],\n \"comments\": \"Engineering calculations are auditable events per NFPA 72 §14.2.4 — must log to immutable audit trail.\"\n },\n {\n \"path\": \"/api/v1/marine/*\",\n \"method\": \"POST\",\n \"_comment\": \"SOLAS / IMO ship design pipeline — same audit requirements as qomn.\",\n \"rateLimit\": {\"perUser\": \"20/minute\"},\n \"protections\": [\n \"BLOCK_IF_BODY_DOES_NOT_MATCH_SCHEMA\",\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"LOG_ENGINEERING_CALCULATION_FOR_AUDIT_TRAIL\"\n ]\n },\n {\n \"path\": \"/api/v1/projects/{project_id}/reports/*\",\n \"method\": \"GET\",\n \"_comment\": \"Report generation (PDF/DXF/Excel) — large responses, allow long TTL.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"responseTimeout\": \"5m\",\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\", \"ALLOW_LARGE_RESPONSE\"]\n },\n {\n \"path\": \"/api/v1/environment/*\",\n \"method\": \"GET\",\n \"_comment\": \"Weather/geocode/hazmat endpoints — public data, allow higher rate.\",\n \"rateLimit\": {\"perUser\": \"120/minute\"},\n \"protections\": [\"REQUIRE_API_KEY\", \"REQUIRE_HTTPS\"]\n },\n {\n \"path\": \"/api/v1/admin/*\",\n \"method\": \"*\",\n \"_comment\": \"Admin endpoints — require admin role + IP allowlist.\",\n \"rateLimit\": {\"perUser\": \"30/minute\"},\n \"protections\": [\n \"REQUIRE_API_KEY\",\n \"REQUIRE_HTTPS\",\n \"REQUIRE_ADMIN_ROLE\",\n \"IP_ALLOWLIST_OPTIONAL\"\n ],\n \"ipAllowlist\": \"${AKAMAI_ADMIN_IP_ALLOWLIST}\",\n \"comments\": \"If env var set, only listed IPs can access admin endpoints.\"\n }\n ],\n \"globalProtections\": [\n {\n \"name\": \"Block API key in URL\",\n \"description\": \"Never allow X-API-Key as a query parameter — only header.\",\n \"condition\": \"url.query contains \\\"api_key=\\\" OR url.query contains \\\"apikey=\\\" OR url.query contains \\\"X-API-Key=\\\"\",\n \"action\": \"DENY\",\n \"comments\": \"API keys in URLs leak into server logs, browser history, and Referer headers.\"\n },\n {\n \"name\": \"Require HTTPS\",\n \"description\": \"All API requests must use HTTPS.\",\n \"condition\": \"request.protocol equals \\\"HTTP\\\"\",\n \"action\": \"REDIRECT_TO_HTTPS\"\n },\n {\n \"name\": \"Block path traversal\",\n \"description\": \"Block ../ and ..\\\\ in URL paths.\",\n \"condition\": \"url.path contains \\\"../\\\" OR url.path contains \\\"..\\\\\\\\\\\"\",\n \"action\": \"DENY\"\n },\n {\n \"name\": \"Block null bytes in URL\",\n \"description\": \"Null byte injection attack.\",\n \"condition\": \"url.path contains \\\"%00\\\" OR url.path contains \\\"\\\\x00\\\"\",\n \"action\": \"DENY\"\n }\n ]\n}\n"}}}} |