History

Graham McIntire 24ba393954 Some checks failed Production Deployment / Run ExUnit Tests (push) Failing after 1m0s Details Production Deployment / Build and Push Docker Image (push) Has been skipped Details Fix 22 audit findings across security, performance, and architecture Security (11 items): - SEC-C1: Cross-tenant agent token disclosure -> org-scoped lookup - SEC-H1/H2/H3/M7: IDOR cluster -> org-scoped context functions - SEC-H4: Impersonation session bypass -> unified token validation - SEC-H5: X-Forwarded-For spoofing -> right-to-left XFF walk - SEC-M1: SSRF in vendor integrations -> URL/IP validation + no redirects - SEC-M2: Agent tokens plaintext -> SHA-256 hash, expires_at, rotation - SEC-M4: SNMP communities logged cleartext -> boolean indicators - SEC-M5: API tokens survive membership revocation -> re-check membership - SEC-M8: Superuser API unrated-limited -> rate_limit_api pipeline - SEC-M9: Internal exceptions in API responses -> generic messages - SEC-L1/L3/L4: Cloak key assertion, channel topic binding, download audit Performance (5 items): - PERF-C1: Alert LiveView full reload -> grouped COUNT + debounce - PERF-H3: Device list plain assign -> stream/3 with dom_id - PERF-H4: RateLimit GenServer serialization -> direct ETS access - PERF-H5: EventLogger serial insert -> batch buffer + insert_all - PERF-H6: StormDetector broken under k8s -> global registration Architecture (3 items): - 4 controllers now use context modules instead of direct Repo calls - 6 vendor HTTP clients consolidated onto Towerops.HTTP - equipment->device renames across 18 files (69 call sites) Dependencies (3 items): - bandit 1.12.0 -> 1.12.3 - Removed unused gen_smtp - Updated vendor/README.md versions Test Health: - 3 test files flipped to async: true - Duplicated fixtures consolidated to shared modules - agent_channel_test (2279 lines) split into 5 files - SNMP community encryption migration + data migration script - MikroTik config download audit logging		2026-07-26 15:31:25 -05:00
..
gaiia	chore: add gaiia library dep, remove stale honeybadger/tidewave/cbor	2026-05-11 14:46:27 -05:00
oban_met	chore: update vendored oban_pro to 1.7.6	2026-06-23 09:57:21 -05:00
oban_pro	chore: update dependencies to latest versions	2026-07-15 12:50:20 -05:00
oban_web	fix: vendor oban_web — never pull oban_pro from live repo	2026-07-16 09:19:02 -05:00
README.md	Fix 22 audit findings across security, performance, and architecture	2026-07-26 15:31:25 -05:00

README.md

Vendored Dependencies

This directory contains vendored Elixir dependencies that are included directly in the repository instead of being fetched from external sources during build/CI.

Why Vendor?

These dependencies are vendored to:

Avoid requiring authentication during CI/CD builds
Ensure consistent builds without external dependencies
Enable offline development

Docker Build

IMPORTANT: The vendor/ directory must be copied into the Docker build before running mix deps.get.

In Dockerfile, ensure this order:

COPY mix.exs mix.lock ./
COPY vendor vendor          # ← Must be before mix deps.get
RUN mix deps.get --only $MIX_ENV

Vendored Packages

Oban Pro

Version: 1.7.8 Source: https://getoban.pro/repo (private) License: Commercial (licensed)

Advanced Oban features including batching, workflows, dynamic partitioning, and more.

Configuration in mix.exs:

{:oban_pro, "~> 1.7", path: "vendor/oban_pro"}

Oban Web

Version: 2.12.6 Source: https://hex.pm/packages/oban_web License: Apache-2.0

Web dashboard for Oban job monitoring and management.

Configuration in mix.exs:

{:oban_web, "~> 2.11", path: "vendor/oban_web"}

Router Configuration (superuser only):

# lib/towerops_web/router.ex
scope "/" do
  pipe_through [:browser, :require_authenticated_user, :require_superuser]

  oban_dashboard "/oban"
end

Gaiia

Version: 0.1.0 Source: Path dependency (private) License: Proprietary

Gaiia integration client for subscriber management and service provisioning.

Configuration in mix.exs:

{:gaiia, path: "vendor/gaiia"}

Oban Met

Version: 1.2.0 Source: https://hex.pm/packages/oban_met License: Apache-2.0

Metrics and telemetry support for Oban Web (required dependency).

Configuration in mix.exs:

{:oban_met, "~> 1.0", path: "vendor/oban_met", override: true}

Updating Vendored Dependencies

Step 1: Configure Oban Repository (if needed)

mix hex.repo add oban https://getoban.pro/repo \
  --fetch-public-key SHA256:4/OSKi0NRF91QVVXlGAhb/BIMLnK8NHcx/EWs+aIWPc \
  --auth-key <your-auth-key>

Step 2: Update Dependencies

# Update version constraints in mix.exs if desired
# Then fetch latest versions
mix deps.unlock oban_pro oban_web oban_met
mix deps.get

# Verify versions
mix deps | grep oban

Step 3: Update Vendored Code

# Remove old vendored versions
rm -rf vendor/oban_pro vendor/oban_web vendor/oban_met

# Copy new versions from deps
cp -r deps/oban_pro vendor/
cp -r deps/oban_web vendor/
cp -r deps/oban_met vendor/

# Compile and test
mix deps.compile
mix test

Step 4: Commit Changes

git add vendor/
git commit -m "Update vendored Oban packages

- oban_pro: 1.6.x → 1.6.y
- oban_web: 2.11.x → 2.11.y
- oban_met: 1.0.x → 1.0.y
"

Verifying Vendored Dependencies

To verify that vendored dependencies are being used correctly:

# Check that path dependencies are recognized
mix deps

# Compile from scratch
mix deps.clean --all
mix deps.compile

# Run tests
mix test