Merge pull request #39 from atomantic/better/security

security: harden server bindings, auth gates, and error handling

Author: atomantic

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "sparsetree",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "private": true,
   "description": "",
   "main": "index.js",

package.json

@@ -23,9 +23,13 @@ function initDb(): Database.Database {
   }
 
   // Create database connection
+  const isNew = !fs.existsSync(DB_PATH);
   db = new Database(DB_PATH, {
     verbose: process.env.SQLITE_VERBOSE ? console.log : undefined,
   });
+  if (isNew) {
+    fs.chmodSync(DB_PATH, 0o600);
+  }
 
   // Performance optimizations
   db.pragma('journal_mode = WAL');          // Write-Ahead Logging for better concurrency

server/src/db/sqlite.service.ts

@@ -35,7 +35,11 @@ import { logger } from './lib/logger.js';
 
 const CORS_ORIGIN = process.env.CORS_ORIGIN || 'http://localhost:6373';
 const corsOrigin = CORS_ORIGIN.includes(',')
-  ? CORS_ORIGIN.split(',').map(o => o.trim())
+  ? CORS_ORIGIN.split(',').map(o => {
+      const trimmed = o.trim();
+      new URL(trimmed); // throws on invalid origin
+      return trimmed;
+    })
   : CORS_ORIGIN;
 
 const app = express();
@@ -114,8 +118,18 @@ if (existsSync(clientDist)) {
 // Error handling
 app.use(errorHandler);
 
-httpServer.listen(PORT, '0.0.0.0', () => {
-  logger.start('server', `Running on http://localhost:${PORT}`);
+const HOST = process.env.HOST || 'localhost';
+
+const shutdown = () => {
+  logger.warn('server', 'Shutting down gracefully...');
+  httpServer.close(() => process.exit(0));
+  setTimeout(() => process.exit(1), 5000);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
+
+httpServer.listen(PORT, HOST, () => {
+  logger.start('server', `Running on http://${HOST}:${PORT}`);
 
   // Auto-connect to browser if enabled and browser is running
   browserService.autoConnectIfEnabled();

server/src/index.ts

@@ -7,7 +7,7 @@ export const errorHandler = (
   res: Response,
   _next: NextFunction
 ) => {
-  logger.error('server', `Unhandled: ${err.stack || err.message}`);
+  logger.error('server', `Unhandled: ${process.env.NODE_ENV !== 'production' ? (err.stack || err.message) : err.message}`);
   res.status(500).json({
     success: false,
     error: err.message || 'Internal server error'

server/src/middleware/errorHandler.ts

@@ -54,7 +54,7 @@ router.get('/:dbId/events', async (req: Request, res: Response) => {
     }
   }
 
-  const isTestMode = testMode === 'true';
+  const isTestMode = testMode === 'true' && process.env.NODE_ENV !== 'production';
 
   initSSE(res);
 

server/src/routes/ancestry-update.routes.ts

@@ -210,6 +210,8 @@ router.get('/photos/:personId/exists', async (req: Request, res: Response) => {
 });
 
 // Get FamilySearch authentication token from browser session
+// Security note: This endpoint returns an auth token in the JSON response.
+// Acceptable because SparseTree is a local-only tool and FS tokens are short-lived.
 router.get('/token', async (_req: Request, res: Response) => {
   if (!browserService.isConnected()) {
     res.status(400).json({ success: false, error: 'Browser not connected' });

server/src/routes/browser.routes.ts

@@ -1,4 +1,5 @@
 import { Router, Request, Response } from 'express';
+import crypto from 'crypto';
 import type { GenealogyProviderConfig, PlatformType } from '@fsf/shared';
 import { genealogyProviderService } from '../services/genealogy-provider.service.js';
 import { pickFields } from '../utils/validation.js';
@@ -60,7 +61,7 @@ router.post('/', (req: Request, res: Response) => {
 
   // Generate ID if not provided
   if (!config.id) {
-    config.id = config.platform + '-' + Date.now();
+    config.id = config.platform + '-' + crypto.randomUUID();
   }
 
   // Set defaults if not provided

server/src/routes/genealogy-provider.routes.ts

@@ -4,6 +4,15 @@ import { logger } from '../lib/logger.js';
 
 export const testRunnerRouter = Router();
 
+// Gate all test-runner endpoints behind non-production environment
+testRunnerRouter.use((_req, res, next) => {
+  if (process.env.NODE_ENV === 'production') {
+    res.status(403).json({ success: false, error: 'Test runner is disabled in production' });
+    return;
+  }
+  next();
+});
+
 // GET /api/test-runner/status - Get current test run status
 testRunnerRouter.get('/status', (_req, res) => {
   res.json({ success: true, data: testRunnerService.getStatus() });