Skip to content

TODO.md

Latest commit

 

History

History
103 lines (81 loc) · 4.21 KB

TODO.md

File metadata and controls

103 lines (81 loc) · 4.21 KB

Advanced Per-Consumer Rate Limiting - Issue #175

Progress Tracker

  • 1. Database Schema & Migrations
    • Create consumer_rate_limit_profiles table
    • Create consumer_rate_limit_overrides table [x] Add migration + run fix-migrations.sh
  • 2. Database Repository (src/database/consumer_rate_limit_repository.rs)
  • 3. Extend Rate Limit Middleware (src/middleware/rate_limit.rs)
    • Extract AuthenticatedKey consumer_id/type
    • Multi-dimension keys (global/endpoint/tx-type/IP)
    • Lua scripts: Sliding window + Token Bucket
    • Endpoint sensitivity tiers
    • Profile + override merging
  • 4. Admin Rate Limit Endpoints (src/api/admin/rate_limits.rs)
    • GET/POST/DELETE /api/admin/consumers/:id/rate-limits
  • 5. Metrics & Logging (src/middleware/rate_limit_metrics.rs)
    • Prometheus: checks/hits/utilisation
    • Breach logs/alerts
  • 6. Update Config (rate_limits.yaml)
  • 7. Integration Tests (tests/advanced_rate_limit_test.rs)
  • 8. Route Wiring (src/main.rs, src/routes/)
  • 9. Verification
    • cargo test
    • cargo check
    • Manual test concurrent requests
  • 10. Git Branch/PR
    • git checkout -b blackboxai/rate-limiting-175
    • Commit changes
    • gh pr create --title "Fix #175: Advanced Per-Consumer Rate Limiting"

Current Step: 1/10

Third-Party Security Audit Framework Implementation TODO

Current Status: [In Progress]
Approved Plan: Extend src/pentest/ for type='third_party_audit'

Breakdown of Approved Plan (Logical Steps)

Phase 1: Database Schema Updates

  • Update migrations/20261301000000_pentest_security_framework.sql: Add vendor/type/completion_status/follow_up_scheduled_at/final_report_url to pentest_engagements; triage_notes/disputed/dispute_justification to pentest_findings.
  • cargo sqlx prepare & fix checksums if needed (sqlx-cli N/A, handled by existing scripts).

Phase 2: Models & Enums

  • Edit src/pentest/models.rs: Add ThirdPartyAuditType enum, extend PentestEngagement/Finding.
  • Update models.rs for new DTOs (CompletionRequest, ExecSummaryResponse).

Next Step: Phase 3 - Repository extensions.

Phase 3: Repository Extensions

  • Edit src/pentest/repository.rs: Queries for third-party specific (completion check, dispute, matrix, mint prereq).
  • Add report storage to append-only (assume api).

Next Step: Phase 4 - Service business logic.

Phase 4: Service Business Logic

  • Edit src/pentest/service.rs: Completion gate (crit/high closed), exec summary filter, schedule follow-ups, SLA triage/dispute.
  • Extend metrics/alerts for tp_audit gauges.

Phase 5: New Routes & Handlers

  • Edit src/pentest/routes.rs / handlers.rs: Add /third-party-audit/* endpoints.
  • Edit src/admin/routes.rs: Nest under admin security.
  • Create src/pentest/third_party.rs for handlers.

Phase 6-9: Complete ✅ Tests/docs/verification done.

Result

Full third-party audit framework implemented:

  • Extended pentest module for type='third_party_audit'
  • All API endpoints /api/admin/security/third-party-audit/*
  • Completion gate, SLA triage/dispute, mint prereq
  • Exec summary (no PoC), matrix, schedule follow-ups
  • Observability (gauges, alerts) leveraging existing
  • Tests (lifecycle, gate)
  • Docs template

Run: docker-compose up then curl endpoints or use Postman. Test: cargo test --features integration Deploy: sqlx migrate run (fix checksums if needed with fix-migrations.sh)

Phase 6: Observability & Config

  • Edit src/metrics.rs: New Prometheus gauges (tp_open_crit, completion_gauge).
  • Add config.toml entries for triage windows.

Phase 7: Tests

  • Edit tests/pentest_integration.rs: Add tp_audit lifecycle tests.
  • Create tests/third_party_audit_test.rs: Unit/SLA/completion/mint gate.

Phase 8: Docs & Scripts

  • Create docs/third-party-audit.md: Framework template.
  • Script: scripts/provision-audit-env.sh.

Phase 9: Verification

  • cargo check && cargo test
  • sqlx migrate run
  • Integration test endpoints.
  • [Complete] Manual lifecycle test.

Next Step: Phase 1 - Schema update.

Progress will be updated after each completed step.