Hartmut
1fc1e9f24c
AI Security (EGAI 4.3.1.3, 4.3.1.4, 4.1.3.1, IAAI 3.6.26): - AI Disclaimer banner in ChatPanel: "AI responses may be inaccurate" - "AI Generated" violet badge on: chat messages, AI summaries, project narratives, AI-generated cover images - HITL: system prompt now requires explicit user confirmation before any data mutation (strongly worded instruction) - Mutation tool audit logging: all 31 write tools logged with tool name, params, userId, userRole via Pino PostgreSQL Hardening (PG Standard V1.6): - Audit logging: log_connections, log_disconnections, log_statement=ddl, log_min_duration_statement=1000 in docker-compose - SUPERUSER removal script: scripts/harden-postgres.sh (NOSUPERUSER + minimal GRANT for app user) - Health check: pg_isready -U capakraken -d capakraken - Documentation: security-architecture.md Section 12 updated Controls closed: EGAI 4.1.3.1, 4.3.1.3, 4.3.1.4, PG 3.3, 3.5 Co-Authored-By: claude-flow <ruv@ruv.net>
25 lines
991 B
Bash
Executable File
25 lines
991 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Remove SUPERUSER from the application database user
|
|
# Run after initial setup: bash scripts/harden-postgres.sh
|
|
|
|
CONTAINER="planarchy-postgres-1" # Note: container name may still use old naming
|
|
DB_USER="capakraken"
|
|
DB_NAME="capakraken"
|
|
|
|
echo "Hardening PostgreSQL for $DB_USER..."
|
|
|
|
# Remove SUPERUSER privilege
|
|
docker exec $CONTAINER psql -U postgres -c "ALTER USER $DB_USER NOSUPERUSER;"
|
|
|
|
# Grant only needed permissions
|
|
docker exec $CONTAINER psql -U postgres -d $DB_NAME -c "
|
|
GRANT CONNECT ON DATABASE $DB_NAME TO $DB_USER;
|
|
GRANT USAGE ON SCHEMA public TO $DB_USER;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO $DB_USER;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO $DB_USER;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO $DB_USER;
|
|
"
|
|
|
|
echo "Done. $DB_USER no longer has SUPERUSER."
|