Paperclip CTO
1f6a4183d4
feat(TRA-247): M5 security hardening — tests, markers, and header enforcement
...
- tests/test_security.py: 30 security regression tests covering secure
headers, CSP directives, middleware ordering, DRF throttle configuration,
and SecurityAuditMiddleware event-detection logic
- tests/test_upload.py: 19 upload defense tests covering extension allow-list,
byte-length limits, and magic-byte signature validation (polyglot / disguised
executable detection)
- pytest.ini: register 'security' and 'upload' markers (--strict-markers
enforcement was already on)
Security settings already committed in feat(TRA-233) via harness include:
SECURE_REFERRER_POLICY, CSP_* directives, DEFAULT_THROTTLE_*, MAX_UPLOAD_SIZE,
SESSION/CSRF cookie hardening, AWS presigned URL policy, and
SecurityAuditMiddleware with dual-logger (access + security) pattern.
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
Paperclip CTO
8054c1e1e4
feat(TRA-233): Django M1 foundation scaffold
...
- Environment-split settings: base/local/test/prod with django-environ
- Postgres + Redis + Celery wiring (broker, beat, result backend)
- All 9 domain app stubs: accounts, courses, cms, tracking, quizzes,
training, certificates, reports, notifications
- api app: /healthz/ endpoint, custom DRF exception handler,
SecurityAuditMiddleware, permissions/throttle/upload-validation stubs
- DRF global baseline: JWT+session auth, closed-by-default permissions,
cursor/page pagination, drf-spectacular schema generation
- Dockerfile (multi-env build arg), docker-compose.yml (local),
docker-compose.test.yml (CI-friendly tmpfs Postgres)
- pytest.ini with smoke + settings marker definitions
- tests/test_smoke.py: startup, URL resolution, healthcheck shape
- tests/test_settings_matrix.py: per-profile security assertions
- .github/workflows/ci.yml: test, lint, schema CI jobs
- .env.example with all required vars documented
- .gitignore
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
Paperclip CTO
3c59a4c9fc
docs(TRA-253): add DRF settings baseline and handoff checklist
...
- Add section 7: DRF global settings (REST_FRAMEWORK dict, required
packages, custom exception handler, drf-spectacular config, URL
routing skeleton) to satisfy the DoD requirement for concrete
implementation conventions
- Add section 9: handoff checklist for domain tracks (TRA-254/255/256),
frontend track (TRA-257), and QA/CI track (TRA-258) with per-gate
merge criteria and oasdiff command
- Fix section numbering: old section 7 OpenAPI subsections were
labelled 6.x; renumbered to 8.x; old sections 8 and 9 become 10 and 11
Co-Authored-By: Paperclip <noreply@paperclip.ing >
2026-05-07 09:11:23 +02:00
