init

docs/agents/validation/07-security-deploy-validation.md

@@ -0,0 +1,88 @@
+# Validation Report Template
+
+## Validator
+
+Name: Codex Validation Agent
+
+Stage Reviewed: Agent 07 - Security And Deployment Hardening
+
+Date: 2026-04-15
+
+## Reviewed Inputs
+
+- `/Users/delete/projects/update_server/docs/agents/WORKFLOW.md`
+- `/Users/delete/projects/update_server/PRODUCT_SPEC.md`
+- `/Users/delete/projects/update_server/IMPLEMENTATION_PLAN.md`
+- `/Users/delete/projects/update_server/DEVELOPMENT_WORKFLOW.md`
+- `/Users/delete/projects/update_server/docs/agents/OPERATOR_QUICKSTART_RU.md`
+- `/Users/delete/projects/update_server/docs/agents/handoffs/07-security-deploy.md`
+- previous stage validation report: `/Users/delete/projects/update_server/docs/agents/validation/06-client-api-ui-validation.md`
+- implementation files under `internal/config`, `internal/app`, `internal/db`, `internal/auth`, `internal/http`, `web/templates`, `deploy`, and root deployment files
+- `GOCACHE=/tmp/go-build-agent07-validate GOMODCACHE=/tmp/go-mod-agent06-http go test ./...` -> passed
+- `GOCACHE=/tmp/go-build-agent07-build GOMODCACHE=/tmp/go-mod-agent06-http go build -o /tmp/update-server-agent07-validate ./cmd/server` -> passed
+- `GOCACHE=/tmp/go-build-agent07-migrate GOMODCACHE=/tmp/go-mod-agent06-http go build -o /tmp/update-migrate-agent07-validate ./cmd/migrate` -> passed
+- `command -v docker` -> command not available in this environment, so `docker compose config` and container runtime checks could not be executed here
+- live smoke checks against an HTTP-configured hardened server on `127.0.0.1:18088`:
+  - `GET /admin/login` -> `200 OK` with:
+    - `Cache-Control: no-store, private, max-age=0`
+    - `Content-Security-Policy`
+    - `X-Frame-Options: DENY`
+    - `X-Content-Type-Options: nosniff`
+    - `Referrer-Policy: no-referrer`
+    - `Permissions-Policy`
+    - `Cross-Origin-Opener-Policy: same-origin`
+    - `Cross-Origin-Resource-Policy: same-origin`
+    - `Vary: Cookie`
+    - CSRF cookie scoped to `/admin`, `HttpOnly`, `SameSite=Strict`
+  - `POST /admin/login` without CSRF token -> `403 Forbidden`
+  - `POST /admin/login` with valid CSRF token -> `303 See Other` with:
+    - session cookie scoped to `/admin`
+    - `HttpOnly`
+    - `SameSite=Lax`
+    - rotated CSRF cookie scoped to `/admin`
+  - `GET /api/v1/projects` without bearer token -> `401 Unauthorized` with:
+    - `Cache-Control: no-store, private, max-age=0`
+    - `Vary: Authorization`
+    - shared security headers
+  - created a download-capable API key through the hardened admin flow and verified:
+    - first two `GET /api/v1/projects` requests -> `200 OK`
+    - third request -> `429 Too Many Requests` with `Retry-After: 1`
+    - changing `X-Forwarded-For` between those requests did not bypass the rate limit while `TRUST_PROXY_HEADERS` remained false, confirming socket-address behavior in practice
+- live smoke checks against an HTTPS-configured hardened server on `127.0.0.1:18089` with `APP_BASE_URL=https://updates.example.com`:
+  - `GET /admin/login` -> `200 OK` with `Strict-Transport-Security: max-age=31536000`
+  - CSRF cookie carried `Secure`, `Path=/admin`, `HttpOnly`, `SameSite=Strict`
+  - `POST /admin/login` with valid CSRF token -> `303 See Other` with session cookie carrying `Secure`, `Path=/admin`, `HttpOnly`, `SameSite=Lax`
+- static review of deployment artifacts:
+  - `Dockerfile`
+  - `docker-compose.yml`
+  - `deploy/Caddyfile.example`
+  - `deploy/nginx.update-server.conf.example`
+  - `deploy/update-server.env.example`
+  - `docs/DEPLOYMENT.md`
+
+## Findings
+
+No blocking findings.
+
+The stage satisfies the agreed scope:
+
+- admin and protected client routes emit sane security defaults;
+- CSRF protection is enforced on admin POST flows;
+- cookies are scoped to `/admin` and switch to `Secure` when the public base URL is HTTPS;
+- login and protected client API rate limits work;
+- trusted proxy handling is opt-in;
+- deployment and backup or restore documentation is present and coherent with the current architecture;
+- artifacts remain private and continue flowing through authenticated application endpoints.
+
+## Required Fixes
+
+None.
+
+## Optional Improvements
+
+- Run `docker compose up --build` and one reverse-proxy example on the real target host before first production exposure, since Docker was unavailable in this validation environment.
+- If you later run multiple app instances, replace the current in-memory rate limiter with a shared store-backed or proxy-backed limiter.
+
+## Status
+
+`APPROVED`