Skip to content

Security implementations #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahmet-cskn merged 19 commits into from
Jul 14, 2026
Merged

Security implementations #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
5d5df88
security in the genai service was bypassable before, since service-le…
ahmet-cskn Jul 9, 2026
a52f993
token verification on genai service fully implemented
ahmet-cskn Jul 9, 2026
a9f1a1a
service-level token verification implemented in the checklist service
ahmet-cskn Jul 9, 2026
a5bf185
the models and endpoints generated by openapi are now used instead of…
ahmet-cskn Jul 9, 2026
b58009a
testing implemented for genai service and wired to CI
ahmet-cskn Jul 9, 2026
46007cf
openapi's boilerplate stub tests excluded
ahmet-cskn Jul 9, 2026
bee8908
fetch_user_data now passes auth headers instead of user_id directly
ahmet-cskn Jul 10, 2026
c954631
fixed a small path drift issue
ahmet-cskn Jul 10, 2026
735b0f2
ConversationCreateRequest scrapped, user_id removed from ChatRequest
ahmet-cskn Jul 10, 2026
14ea8c0
added the security details to the openapi spec of the genai service
ahmet-cskn Jul 10, 2026
f5caba7
updates to the checklist service yaml
ahmet-cskn Jul 10, 2026
c82e138
a small addition
ahmet-cskn Jul 10, 2026
da5e7a5
excluded an unnecessary edge case test
ahmet-cskn Jul 10, 2026
572313c
the service code of the checklist service is updated accordingly to t…
ahmet-cskn Jul 10, 2026
f90f76b
bug fix
ahmet-cskn Jul 11, 2026
1a115f8
mirrored the pattern in the calendar service to the checklist service
ahmet-cskn Jul 11, 2026
6e590b4
removed userId from the Checklist schema and moved it to IdentifiedCh…
ahmet-cskn Jul 11, 2026
417e7e8
small bug fix
ahmet-cskn Jul 11, 2026
09aae7d
Merge remote-tracking branch 'origin/main' into security-implementations
ahmet-cskn Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,62 @@ jobs:
- name: Run Ruff Linter
run: ruff check services/genai-service

python-test:
name: Test Python (GenAI Service)
needs: openapi-lint
runs-on: ubuntu-latest
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: genai_service_db
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 5s
--health-timeout 5s
--health-retries 10
env:
SERVICES_POSTGRES_USER: postgres
SERVICES_POSTGRES_PASSWORD: postgres
SERVICES_POSTGRES_URL: localhost
SERVICES_POSTGRES_PORT_INT: 5432
steps:
- name: Checkout Code
uses: actions/checkout@v4
Comment on lines +46 to +71

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Restrict the test job's GitHub token.

This job executes third-party installers and repository tests while inheriting default token permissions and retaining checkout credentials. Limit the token to read-only access and disable credential persistence.

Proposed hardening 
   python-test:
     name: Test Python (GenAI Service)
     needs: openapi-lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
...
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
python-test:
name: Test Python (GenAI Service)
needs: openapi-lint
runs-on: ubuntu-latest
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: genai_service_db
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 5s
--health-timeout 5s
--health-retries 10
env:
SERVICES_POSTGRES_USER: postgres
SERVICES_POSTGRES_PASSWORD: postgres
SERVICES_POSTGRES_URL: localhost
SERVICES_POSTGRES_PORT_INT: 5432
steps:
- name: Checkout Code
uses: actions/checkout@v4
python-test:
name: Test Python (GenAI Service)
needs: openapi-lint
runs-on: ubuntu-latest
permissions:
contents: read
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: genai_service_db
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 5s
--health-timeout 5s
--health-retries 10
env:
SERVICES_POSTGRES_USER: postgres
SERVICES_POSTGRES_PASSWORD: postgres
SERVICES_POSTGRES_URL: localhost
SERVICES_POSTGRES_PORT_INT: 5432
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 70-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[warning] 46-100: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 46 - 71, Harden the python-test job by
setting its job-level GITHUB_TOKEN permissions to read-only and configuring the
actions/checkout@v4 step with credential persistence disabled. Apply these
changes specifically to the python-test job without altering unrelated workflow
jobs.

Source: Linters/SAST tools


- name: Set up Java 21 (Corretto)
uses: actions/setup-java@v4
with:
java-version: '21'
distribution: 'corretto'

- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 22

- name: Generate OpenAPI client
run: |
npx @openapitools/openapi-generator-cli generate -i api/genai-service.yaml -g python-fastapi \
-o services/genai-service/generated --skip-validate-spec

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
cache: 'pip'
cache-dependency-path: services/genai-service/requirements-dev.txt

- name: Install Dependencies
run: pip install -r services/genai-service/requirements-dev.txt

- name: Run Pytest
run: cd services/genai-service && pytest

backend-test:
name: Build & Test Backend - ${{ matrix.service }}
needs: openapi-lint
Expand Down
4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,10 @@ web-client/src/*-service.ts
web-client/src/openapi.ts
web-client/src/api.ts

# ============== Python test artifacts =================
.hypothesis/
.pytest_cache/

# ============== Postman =================
# Ignore local Postman environments and globals (which may contain sensitive secrets)
*.postman_environment.json
Expand Down
Loading
Loading