move_detect

cw2007/move_detect

Fork 0

Commit graph

Author	SHA1	Message	Date
유창욱	1187df5628	feat(delivery-audit): PIPA retention + cloud hardening (P3-2, P4-1..4) - P3-2 [H] snapshot retention (7 days): snapshot_retention_days config; SnapshotRepository::purgeOlderThan (interface + Pdo + double, files-then-rows, bounded batch); opportunistic purge in the ingest path (Cafe24 has no cron). - P4-1 [H] index.php sets display_errors=0 + a global exception handler → generic {"error":"internal"} + error_log (no DSN/db_user leak); ships www/move_detect/.user.ini. - P4-2 [H] ConfigController + HeartbeatController take an optional rate limiter + clientIp; pre-auth per-IP anti-flood → 429 (were unthrottled). - P4-3 [M] PdoNonceRepository::remember + PdoRateLimiterRepository::hit opportunistically reap expired rows (Cafe24 has no cron; tables grew unbounded). - P4-4 [M] Router::dispatch rawurldecodes captured params (Korean/space camera_id could save zones but never load them). Tests: python green; phpunit 84 green. See docs/delivery-audit.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW	2026-07-17 09:28:16 +09:00
유창욱	7828f9c419	fix(cloud): move ingest per-device rate limit post-auth, add pre-auth IP limit (H1) An unauthenticated attacker could guess a real device_id and 429-lock that camera by hammering /api/events before HMAC verification ran, dropping its accident events. Add a cheap pre-auth per-IP limiter (Config::ingestIpRateLimitPerMin, default 300/min) that fires before any device-secret lookup, and move the existing per-device limiter to run only after HMAC + timestamp + nonce checks succeed, so only authenticated requests consume a device's own quota.	2026-07-12 09:09:31 +09:00
유창욱	50cb2cfe82	feat(cloud): P1-B scaffold — composer autoload + Config	2026-07-11 23:16:13 +09:00

Author

SHA1

Message

Date

유창욱

1187df5628

feat(delivery-audit): PIPA retention + cloud hardening (P3-2, P4-1..4)

- P3-2 [H] snapshot retention (7 days): snapshot_retention_days config;
  SnapshotRepository::purgeOlderThan (interface + Pdo + double, files-then-rows,
  bounded batch); opportunistic purge in the ingest path (Cafe24 has no cron).
- P4-1 [H] index.php sets display_errors=0 + a global exception handler → generic
  {"error":"internal"} + error_log (no DSN/db_user leak); ships www/move_detect/.user.ini.
- P4-2 [H] ConfigController + HeartbeatController take an optional rate limiter +
  clientIp; pre-auth per-IP anti-flood → 429 (were unthrottled).
- P4-3 [M] PdoNonceRepository::remember + PdoRateLimiterRepository::hit opportunistically
  reap expired rows (Cafe24 has no cron; tables grew unbounded).
- P4-4 [M] Router::dispatch rawurldecodes captured params (Korean/space camera_id could
  save zones but never load them).

Tests: python green; phpunit 84 green. See docs/delivery-audit.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW

2026-07-17 09:28:16 +09:00

유창욱

7828f9c419

fix(cloud): move ingest per-device rate limit post-auth, add pre-auth IP limit (H1)

An unauthenticated attacker could guess a real device_id and 429-lock that
camera by hammering /api/events before HMAC verification ran, dropping its
accident events. Add a cheap pre-auth per-IP limiter (Config::ingestIpRateLimitPerMin,
default 300/min) that fires before any device-secret lookup, and move the
existing per-device limiter to run only after HMAC + timestamp + nonce checks
succeed, so only authenticated requests consume a device's own quota.

2026-07-12 09:09:31 +09:00

유창욱

50cb2cfe82

feat(cloud): P1-B scaffold — composer autoload + Config

2026-07-11 23:16:13 +09:00

3 commits