Auctalis/nocturnusai

Second wave of security fixes on top of v0.3.7. All 764 tests pass.

🛡️ Security

High

• Trusted-proxy-aware rate limiting — AuthInterceptor and /auth/bootstrap now honour X-Forwarded-For when the TCP peer is listed in TRUSTED_PROXY_IPS. Without this, every client behind a reverse proxy shared a single bucket (DoS vector) and attackers upstream of the proxy could evade the limit entirely.

Medium

• Strict GCM decrypt for WAL + snapshots — when ENCRYPTION_KEY is configured, lines/files that fail auth are skipped rather than silently accepted as plaintext, blocking injection of replayable records by someone with filesystem access. Set STORAGE_STRICT_DECRYPT=false for a one-off legacy-data migration.
• Log-injection guard — CallLogging sanitizes URI and X-Database / X-Tenant-ID headers before logging (strips CRLF + control chars, caps length).
• POST /admin/backups — validates the db query param via Validator and returns only the relative backup name (previously leaked the absolute server-side path).
• POST /infer result cap — bounded by INFERENCE_MAX_RESULTS (default 10 000) to prevent OOM from cartesian rule expansion.
• Atomic snapshot rename — SnapshotManager.saveSnapshot now uses Files.move(ATOMIC_MOVE, REPLACE_EXISTING) instead of the silent-fail File.renameTo.

Low

• API key pepper — when API_KEY_PEPPER is set, new keys are stored as HMAC-SHA256(pepper, key). Legacy SHA-256 keys continue to validate for rolling migration.
• /llm.txt filter — no longer advertises /admin/*, /auth/* (except /auth/status), or /replication/* routes. It was unauthenticated and functioning as a discovery aid.
• POST /execute requires RULE_WRITE (was FACT_WRITE) — the DSL is strictly more powerful than any single /assert/* route.
• Parser command cap — PARSER_MAX_COMMANDS (default 10 000) guards /execute against DoS via oversized scripts.

🔧 New environment variables

| Variable | Default | Purpose |
|----------|---------|---------|
| TRUSTED_PROXY_IPS | (empty) | Comma-separated proxy IPs whose X-Forwarded-For header is trusted |
| STORAGE_STRICT_DECRYPT | true | Fail-closed on GCM auth errors when ENCRYPTION_KEY is set |
| INFERENCE_MAX_RESULTS | 10000 | Cap on /infer response cardinality |
| PARSER_MAX_COMMANDS | 10000 | Cap on commands per /execute payload |
| API_KEY_PEPPER | (empty) | Secret used to HMAC API keys at rest; opt-in for new keys |

⚠️ Breaking changes

• POST /execute now requires RULE_WRITE. Any writer-scoped key that previously called /execute must be upgraded or the traffic moved to the narrower /assert/* routes.
• WAL / snapshot strict decrypt is on by default. If your deployment has a mix of legacy plaintext and encrypted storage, set STORAGE_STRICT_DECRYPT=false during migration.

Still on the backlog (tracked for a follow-up)

• SSE per-principal concurrency + idle-timeout caps
• Broader narrowing of catch (Exception) { e.message } in AdminRoutes beyond /admin/backups

Full diff: https://github.com/Auctalis/nocturnusai/compare/v0.3.7...v0.3.8