feat: hardened intake, storage, retention and delete-by-receipt #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feature/intake"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes BUG-2, BUG-3. Refs BUG-1 (everything except the live deploy, which needs a person; see the deployment checklist in #8)
Part of ECO-EP1 (spec: ECO-66, bread repo
docs/breadbug.md).What
:8120):POST /v1/reports,DELETE /v1/reports/{receipt},GET /v1/reports/{receipt}/status,/healthz. Admin listener is a separate port and not routed publicly (the triage UI comes later).created_unixsanity, app id charset.Retry-After, bounded in-flight requests (503), data-dir size cap.secure_delete), migrations byuser_version, idempotent resend (same install + same payload returns the original receipt), 90-day retention job, token-checked delete (wrong token and unknown receipt are indistinguishable) with WAL truncation so deleted data really leaves disk.packaging/docker-compose.yml(own network and volume, non-root, read-only rootfs, no capabilities, no host mounts, memory and pid limits).docs/threat-model.md, README, CONTRIBUTING, Forgejo check workflow.Tests
breadbug --dry-runreport is accepted and stored unchanged; bad input matrix; oversize; resend; per-install, per-network (with and without a trusted proxy) and global limits; backpressure; leaked PII is scrubbed and quarantined; hostile content stored inert; delete; status; retention.-D warningsclean.Notes
bread-scrubis a git dependency on the bread repo'sfeature/breadbug-scrubberbranch (bread PR #21). Repoint it to a tag/main once that merges.Public listener (POST /v1/reports, DELETE /v1/reports/{receipt}, GET status, /healthz) with a strict versioned schema, size and count limits, per-install, per-network and global rate limits, bounded in-flight requests, server-side re-scrub with quarantine, idempotent resends, SQLite storage with 90-day retention and token-checked deletion. Install ids and network buckets are HMAC'd; IPs are never stored or logged. Includes the container packaging (isolated, non-root, read-only), the threat model, CI check workflow and a real client report as a fixture. Refs BUG-1, BUG-2, BUG-3Blocked at merge. PR #1 (feature/intake into main) was reviewed and is otherwise ready: CI check is success on
4ca69f4, mergeable is true, squash is allowed, and the diff covers schema limits, rate limits, rescrub, retention, delete-by-receipt, oldest-first quota eviction, and the backup rotation contract. The Forgejo merge call failed before the API (tool error: Unable to execute forgejo_merge_pull), retried once with the same result. PR #1 stays open. Per the stack rule, PRs #2 through #16 were not touched.