Graham McIntire
97232117f5
- H12: session and remember-me cookies get http_only + secure (prod-only). Cookie can no longer be read via document.cookie (XSS exfil defense) and the Secure flag is set in production via config/prod.exs. - L2: 404 tracker uses EXPIRE … NX so a sustained probe can't keep refreshing the 60s window and dodge the threshold ban. - L5: vault only reads CLOAK_KEY when :env == :prod — a developer with a prod env var set in their shell won't accidentally encrypt local data with the production key. - L6: health endpoint no longer leaks the app version. - L8: Preseem.dismiss_insight/2 + InsightsLive uses it — dismissing now requires the insight to belong to the user's org (closes IDOR). - L10: SidebarCollapse JS hook stores its click handler and removes it in destroyed(); listeners no longer accumulate across LV navigation. - L11: WebMCP navigate tool rejects anything that isn't a same-origin absolute path (blocks javascript:, data:, off-site URLs).
82 lines
2.1 KiB
Elixir
82 lines
2.1 KiB
Elixir
defmodule ToweropsWeb.HealthController do
|
|
@moduledoc false
|
|
|
|
use ToweropsWeb, :controller
|
|
|
|
alias Ecto.Adapters.SQL
|
|
alias Towerops.Repo
|
|
|
|
def index(conn, _params) do
|
|
require Logger
|
|
|
|
db_status = check_database()
|
|
redis_status = check_redis()
|
|
|
|
# Log health check results for debugging
|
|
Logger.debug("Health check: db=#{inspect(db_status)}, redis=#{inspect(redis_status)}")
|
|
|
|
all_healthy = db_status == :ok and redis_status in [:ok, :not_configured]
|
|
|
|
if all_healthy do
|
|
conn
|
|
|> put_resp_content_type("application/json")
|
|
|> send_resp(
|
|
200,
|
|
Jason.encode!(%{
|
|
status: "ok",
|
|
database: "connected",
|
|
redis: redis_status_string(redis_status)
|
|
})
|
|
)
|
|
else
|
|
conn
|
|
|> put_resp_content_type("application/json")
|
|
|> send_resp(
|
|
503,
|
|
Jason.encode!(%{
|
|
status: "error",
|
|
database: db_status_string(db_status),
|
|
redis: redis_status_string(redis_status)
|
|
})
|
|
)
|
|
end
|
|
end
|
|
|
|
defp check_database do
|
|
case SQL.query(Repo, "SELECT 1", []) do
|
|
{:ok, _} -> :ok
|
|
{:error, _} -> :error
|
|
end
|
|
end
|
|
|
|
defp check_redis do
|
|
require Logger
|
|
|
|
redis_config = Application.get_env(:towerops, :redis, [])
|
|
|
|
if Keyword.has_key?(redis_config, :host) do
|
|
# Redis is configured, check connectivity with short timeout for health check
|
|
timeout = Keyword.get(redis_config, :timeout, 2_000)
|
|
|
|
case Towerops.RedisHealthCheck.check_health(redis_config, timeout) do
|
|
:ok ->
|
|
:ok
|
|
|
|
{:error, reason} ->
|
|
Logger.error("Redis health check failed: #{inspect(reason)}")
|
|
:error
|
|
end
|
|
else
|
|
# Redis not configured (e.g., in development without Redis)
|
|
Logger.debug("Redis not configured")
|
|
:not_configured
|
|
end
|
|
end
|
|
|
|
defp db_status_string(:ok), do: "connected"
|
|
defp db_status_string(:error), do: "disconnected"
|
|
|
|
defp redis_status_string(:ok), do: "connected"
|
|
defp redis_status_string(:error), do: "disconnected"
|
|
defp redis_status_string(:not_configured), do: "not_configured"
|
|
end
|