feat(security): pentest-driven hardening (Spring Security, BCrypt, SSRF, CSRF, audit, rate limit)

[alexk-dev]

Summary

Pentest-driven security overhaul of golemcore-brain. Twelve fixes against the issues surfaced in the pentest review, plus two rounds of code-review follow-ups. Every change is covered by tests; backend 288/288 ✅, frontend 82/82 ✅.

The application's own AuthContextResolver continues to own authorization — Spring Security is wired in only for CSRF, security headers, and filter ordering (authorizeHttpRequests = permitAll). This keeps the change footprint small and the existing per-controller requireSpaceAccess(...) semantics intact.

What's fixed (pentest findings)

• Critical: SHA-256 → BCrypt with seamless on-login upgrade. Session cookie Secure + HttpOnly + SameSite=Lax. CSRF (double-submit cookie + X-XSRF-TOKEN) on cookie-auth requests; Bearer-auth bypassed.
• High: SSRF guard on outbound LLM calls (RFC1918, ULA, CGNAT, IPv4-mapped IPv6, redirect-disabled). BRAIN_AUTH_DISABLED removed from prod profile + ProdProfileSecurityGuard refuses startup with placeholder JWT secret / blank admin creds. CSP, HSTS, X-Frame-Options, Referrer-Policy, X-Content-Type-Options. Login rate-limit (per-IP + per-user LRU). style attribute removed from markdown sanitizer.
• Medium: Asset upload allow-list + magic-bytes + 25MB cap + path-traversal post-check. API key issuance enforces requestedRoles ⊆ requesterRoles. JWT clock skew tolerance. Generic error responses + X-Request-Id correlation (no internal stack/path leaks).
• Low / hardening: Admin audit log via SLF4J audit logger.

Architecture

Request
  → RequestIdFilter (MDC + X-Request-Id)
  → JwtAuthenticationFilter (Bearer → AuthContext attribute)
  → Spring Security FilterChain (CSRF, security headers)
      └─ ignoringRequestMatchers: Authorization: Bearer ...
  → CsrfCookieFilter (force XSRF-TOKEN materialization on GET)
  → Controller
      └─ AuthContextResolver.requireSpaceAccess(...)  ← unchanged
          └─ AuthService.resolveContext(sessionToken) | apiKeyContext(...)

Key design decisions

• Spring Security with permitAll authorize — keeping our self-rolled authorization avoids rewriting every controller's role check; Spring contributes only what it does best (CSRF, headers).
• PasswordEncoderPort in application layer — keeps PasswordHasher Spring-free (the HexagonalArchitectureTest ArchUnit-style enforcer still passes), bridges to BCryptPasswordEncoder from the adapter side.
• Property-gated test escapes — brain.security.{csrf-enabled,cookie-secure,trust-forwarded-for} and brain.outbound.allow-private-addresses exist so tests that hit local mock servers / MockMvc without TLS / without CSRF cookies can opt out per-test, while prod defaults stay locked down. The CSRF integration test re-enables CSRF via @TestPropertySource to prove the prod posture.
• Dual LRU rate limiter — per-(IP,user) catches credential stuffing on a single account; per-IP catches the eviction-spray attack where a hostile IP spams 10k usernames to evict honest entries from the per-user LRU. Successful login clears per-(IP,user) only — the per-IP record survives so an in-progress spray remains visible.
• BCrypt seamless migration — no forced password reset; legacy SHA-256 hashes verify and are replaced with BCrypt on the user's next successful login. PasswordHasher.needsRehash() is the contract for callers to trigger persistence.

Files changed

Area	Files	What
Build	pom.xml	Spring Boot 4.0.6, spring-boot-starter-security, spring-security-test.
Config	config/SecurityConfig.java, config/CsrfCookieFilter.java, config/ProdProfileSecurityGuard.java, config/BrainApplicationConfiguration.java	Filter chain wiring + prod-startup invariants.
Auth	application/service/auth/{PasswordHasher,LoginRateLimiter,LoginThrottledException,AuthService}.java, application/port/out/auth/PasswordEncoderPort.java, adapter/out/security/BcryptPasswordEncoderAdapter.java, adapter/in/web/auth/{AuthController,AuthCookieHelper}.java, adapter/out/jwt/JwtApiKeyTokenAdapter.java	BCrypt, rate limit, hardened cookies, JWT clock skew.
API surface	adapter/in/web/{ApiExceptionHandler,WikiController,AssetMimeGuard}.java, web/RequestIdFilter.java, application/service/apikey/ApiKeyService.java, application/service/user/UserManagementService.java	Generic errors, request-id, upload guard, role-escalation guard.
Outbound	adapter/out/http/OutboundUrlGuard.java, adapter/out/http/llm/HttpLlmProviderCheckAdapter.java	SSRF guard for LLM calls.
FS	adapter/out/filesystem/FileSystemWikiRepository.java	Asset path-traversal post-check.
Audit	application/service/audit/AuditLogger.java + wiring in user / api-key services / login	SLF4J audit logger for admin actions.
Frontend	frontend/src/lib/api.ts, frontend/src/features/preview/MarkdownPreview.tsx, frontend/src/index.css	XSRF-TOKEN echo, removed style attr from sanitizer, fixed editor preview prose styles.
Config defaults	src/main/resources/application-prod.properties	Pin auth-disabled=false, multipart limits 25MB.
Tests	src/test/java/.../{LoginRateLimiterTest,OutboundUrlGuardTest,AssetMimeGuardTest,PasswordHasherTest,ProdProfileSecurityGuardTest,SecurityHeadersAndCsrfIntegrationTest}.java, src/test/java/.../testsupport/MutableClock.java, src/test/resources/application.properties	+33 unit tests, +1 integration test, shared MutableClock helper.

Configuration (new properties)

# Production defaults — locked down. Override only with intent.
brain.security.csrf-enabled=true
brain.security.cookie-secure=true
brain.security.trust-forwarded-for=false
brain.outbound.allow-private-addresses=false
spring.servlet.multipart.max-file-size=25MB
spring.servlet.multipart.max-request-size=26MB

BRAIN_AUTH_DISABLED is no longer consumed in the prod profile; it is hard-coded to false and ProdProfileSecurityGuard will refuse to boot if brain.auth-disabled=true arrives via any other source.

Compatibility

• Password storage format changes from 64-char hex SHA-256 to $2a$12$... BCrypt. Migration is automatic on next successful login per user; no flag, no downtime.
• API error body shape stays { "error": "...", "requestId": "..." } — Spring ErrorResponse exceptions are translated to this shape (with ProblemDetail.detail as the message text) so the SPA's existing error reader keeps working.
• CSRF: any external integration that authenticated via the session cookie now needs to read XSRF-TOKEN and echo X-XSRF-TOKEN on mutating requests. Bearer-token (API key) integrations are unaffected.
• Asset uploads: SVG, ZIP, and other previously-accepted MIME types are now rejected. The markdown import endpoints (/import/markdown/plan|apply) keep their own contract and do not go through AssetMimeGuard.