security: bound Zod inputs, add SSE per-user cap and tRPC body limit (#51) #59

Merged

Hartmut merged 1 commits from security/zod-audit-51 into main 2026-04-18 13:53:28 +02:00

Conversation 0 Commits 1 Files Changed 12

+254 -148

Hartmut commented 2026-04-18 13:31:37 +02:00

Owner

Copy Link

Copy Source

Closes #51 (except the ESLint rule + conventions doc follow-ups).

Summary

• Apply .max() bounds across 9 router schemas (IDs 64, names 200, search 500, arrays 100–5000 by domain).
• Tighten webhook secret to min(16).max(256) and url to max(2048).
• Validate reports/allocations query params via zod (year bounds, end>=start) and restrict format to pdf/xlsx.
• Add per-user SSE connection cap (8) in /api/sse/timeline with 429 + Retry-After.
• Reject tRPC request bodies over 2 MiB via Content-Length header check before auth/DB work.

Test plan

• pnpm test:unit (1945 API + 321 engine + 195 application tests pass)
• pnpm --filter @capakraken/web exec tsc --noEmit
• pnpm --filter @capakraken/api exec tsc --noEmit
• pnpm lint (0 errors)
• Smoke: login, load timeline (SSE), fire an allocations export

🤖 Generated with Claude Code

Closes #51 (except the ESLint rule + conventions doc follow-ups). ## Summary - Apply `.max()` bounds across 9 router schemas (IDs 64, names 200, search 500, arrays 100–5000 by domain). - Tighten webhook `secret` to `min(16).max(256)` and `url` to `max(2048)`. - Validate reports/allocations query params via zod (year bounds, end>=start) and restrict `format` to `pdf`/`xlsx`. - Add per-user SSE connection cap (8) in /api/sse/timeline with 429 + Retry-After. - Reject tRPC request bodies over 2 MiB via Content-Length header check before auth/DB work. ## Test plan - [x] `pnpm test:unit` (1945 API + 321 engine + 195 application tests pass) - [x] `pnpm --filter @capakraken/web exec tsc --noEmit` - [x] `pnpm --filter @capakraken/api exec tsc --noEmit` - [x] `pnpm lint` (0 errors) - [ ] Smoke: login, load timeline (SSE), fire an allocations export 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Hartmut added 1 commit 2026-04-18 13:31:37 +02:00

security: bound Zod inputs, add SSE per-user cap and tRPC body limit (#51) ... 40ca0c3046

Mechanical .max() bounds across 9 router schemas per the convention in
#51: IDs at 64, names at 200, search/filter strings at 500, arrays at
100-5000 depending on domain. Webhook secret bounded at min(16)/max(256).

Reports route now validates startDate/endDate via zod with year bounds
and rejects end<start. SSE timeline route enforces a per-user connection
cap of 8 (returns 429 with Retry-After). tRPC route rejects bodies over
2 MiB via Content-Length check before auth/DB work.

Covers 12 call-sites listed in #51. ESLint rule and zod conventions doc
remain as follow-up.

Hartmut merged commit 17471af7f8 into main 2026-04-18 13:53:28 +02:00

Hartmut deleted branch security/zod-audit-51 2026-04-18 13:53:29 +02:00

Hartmut referenced this issue from a commit 2026-04-18 13:53:30 +02:00

security: bound Zod inputs, add SSE per-user cap and tRPC body limit (#51, PR #59)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

cdp

CDP (Client Data Protection) compliance

epic

Parent/umbrella ticket

not-applicable

Control does not apply to CapaKraken scope

security

Security / compliance work

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

Hartmut

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Hartmut/CapaKraken#59