move_detect

cw2007/move_detect

Fork 0

Commit graph

Author	SHA1	Message	Date
유창욱	1187df5628	feat(delivery-audit): PIPA retention + cloud hardening (P3-2, P4-1..4) - P3-2 [H] snapshot retention (7 days): snapshot_retention_days config; SnapshotRepository::purgeOlderThan (interface + Pdo + double, files-then-rows, bounded batch); opportunistic purge in the ingest path (Cafe24 has no cron). - P4-1 [H] index.php sets display_errors=0 + a global exception handler → generic {"error":"internal"} + error_log (no DSN/db_user leak); ships www/move_detect/.user.ini. - P4-2 [H] ConfigController + HeartbeatController take an optional rate limiter + clientIp; pre-auth per-IP anti-flood → 429 (were unthrottled). - P4-3 [M] PdoNonceRepository::remember + PdoRateLimiterRepository::hit opportunistically reap expired rows (Cafe24 has no cron; tables grew unbounded). - P4-4 [M] Router::dispatch rawurldecodes captured params (Korean/space camera_id could save zones but never load them). Tests: python green; phpunit 84 green. See docs/delivery-audit.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW	2026-07-17 09:28:16 +09:00
유창욱	171ef3e1c5	fix(cloud): add nonce-replay + timestamp-window checks to config/heartbeat (M2) ConfigController::get and HeartbeatController::post verified HMAC but never checked nonce replay or timestamp freshness, so a captured signed request (e.g. a replayed heartbeat) could be replayed forever, masking a dead device. Inject NonceRepository (+Config) into both and add the same timestamp-window + nonce-remember checks IngestController already applies, after HMAC verification and before the response/side effect.	2026-07-12 09:19:32 +09:00
유창욱	5135c08e18	feat(cloud): device config + heartbeat sync API (HMAC)	2026-07-12 01:13:02 +09:00

Author

SHA1

Message

Date

유창욱

1187df5628

feat(delivery-audit): PIPA retention + cloud hardening (P3-2, P4-1..4)

- P3-2 [H] snapshot retention (7 days): snapshot_retention_days config;
  SnapshotRepository::purgeOlderThan (interface + Pdo + double, files-then-rows,
  bounded batch); opportunistic purge in the ingest path (Cafe24 has no cron).
- P4-1 [H] index.php sets display_errors=0 + a global exception handler → generic
  {"error":"internal"} + error_log (no DSN/db_user leak); ships www/move_detect/.user.ini.
- P4-2 [H] ConfigController + HeartbeatController take an optional rate limiter +
  clientIp; pre-auth per-IP anti-flood → 429 (were unthrottled).
- P4-3 [M] PdoNonceRepository::remember + PdoRateLimiterRepository::hit opportunistically
  reap expired rows (Cafe24 has no cron; tables grew unbounded).
- P4-4 [M] Router::dispatch rawurldecodes captured params (Korean/space camera_id could
  save zones but never load them).

Tests: python green; phpunit 84 green. See docs/delivery-audit.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW

2026-07-17 09:28:16 +09:00

유창욱

171ef3e1c5

fix(cloud): add nonce-replay + timestamp-window checks to config/heartbeat (M2)

ConfigController::get and HeartbeatController::post verified HMAC but never
checked nonce replay or timestamp freshness, so a captured signed request
(e.g. a replayed heartbeat) could be replayed forever, masking a dead
device. Inject NonceRepository (+Config) into both and add the same
timestamp-window + nonce-remember checks IngestController already applies,
after HMAC verification and before the response/side effect.

2026-07-12 09:19:32 +09:00

유창욱

5135c08e18

feat(cloud): device config + heartbeat sync API (HMAC)

2026-07-12 01:13:02 +09:00

3 commits