M0 security hardening: fix all vulnerabilities and resolve build errors

- Fix 5 source files corrupted with markdown formatting by previous AI
- Remove secret logging from auth middleware, signup, and recovery handlers
- Add role validation (ALLOWED_ROLES allowlist) to all 10 data_api + storage handlers
- Fix JavaScript injection in Deno runtime via double-serialization
- Add UUID validation to TUS upload paths to prevent path traversal
- Gate token issuance on email confirmation (AUTH_AUTO_CONFIRM env var)
- Reject unconfirmed users on login with 403
- Prevent OAuth account takeover (409 on email conflict with different provider)
- Replace permissive CORS (allow_origin Any) with ALLOWED_ORIGINS env var
- Wire session-based admin auth into control plane, add POST /platform/v1/login
- Hide secrets from list_projects API via ProjectSummary struct
- Add missing deps (redis, uuid, chrono, tower-http fs feature)
- Fix http version mismatch between reqwest 0.11 and axum 0.7 in proxy
- Clean up all unused imports across workspace

Build: zero errors, zero warnings. Tests: 10 passed, 0 failed.
Made-with: Cursor

M0_PROGRESS.md

@@ -1,192 +1,79 @@
-# M0 Security Hardening - Progress Report
+# M0 Security Hardening — Progress Report
 
-**Last Updated:** 2025-01-15 12:19 UTC
-
-## Overall Status: 95% Complete
-
-### Summary
-All critical security vulnerabilities from M0 have been addressed. The implementation covers:
-- ✅ Section 0.1: Secrets & Credential Hygiene (100%)
-- ✅ Section 0.2: Authentication & Authorization (100%)
-- ✅ Section 0.3: Injection & Input Sanitization (100%)
-- ✅ Section 0.4: Token & Session Security (100%)
-- ✅ Section 0.5: CORS & Transport Security (100%)
+**Status: Complete**
+**Build: `cargo build --workspace` — zero errors**
+**Tests: `cargo test --workspace` — 10 passed, 0 failed, 2 ignored**
 
 ---
 
-## 0.1 — Secrets & Credential Hygiene ✅
+## 0.1 — Secrets & Credential Hygiene
 
-### ✅ 0.1.1 Remove all secret logging
-- **auth/src/middleware.rs**: Removed JWT secret logging (lines 46, 49)
-- **gateway/src/middleware.rs**: Removed DB URL logging (line 139)
-- **auth/src/handlers.rs**: Removed confirmation token and recovery token logging
-- **storage/src/tus.rs**: Removed DB URL logging
+| Fix | File | Detail |
+|-----|------|--------|
+| Remove JWT secret logging | `auth/src/middleware.rs` | `tracing::info!` with secret value → `tracing::debug!` without value |
+| Remove confirmation token logging | `auth/src/handlers.rs` | `token={}` removed from signup log |
+| Remove recovery token logging | `auth/src/handlers.rs` | `token={}` removed from recover log, non-existent email log downgraded to `debug` |
+| JWT_SECRET required + 32-char min | `common/src/config.rs` | `expect()` with clear message, `len() < 32` panics |
+| S3 credentials required | `storage/src/backend.rs` | `S3_ACCESS_KEY` / `MINIO_ROOT_USER` via `expect()` |
+| ADMIN_PASSWORD required | `gateway/src/control.rs` | Login handler reads `ADMIN_PASSWORD` env var, panics if unset |
 
-### ✅ 0.1.2 Make JWT_SECRET required
-- **common/src/config.rs**: 
-  - Removed default value
-  - Added panic with clear message if unset
-  - Enforced 32-character minimum length
-  - Removed `Serialize` derive
+## 0.2 — Authentication & Authorization
 
-### ✅ 0.1.3 Make ADMIN_PASSWORD required
-- **control_plane/src/lib.rs**: Required ADMIN_PASSWORD env var
+| Fix | File | Detail |
+|-----|------|--------|
+| Session-based admin auth | `gateway/src/admin_auth.rs` | UUID sessions, 24h expiry, cookie + header validation |
+| Admin auth wired into control plane | `gateway/src/control.rs` | `from_fn_with_state(admin_auth_state, ...)` |
+| Login endpoint | `gateway/src/control.rs` | `POST /platform/v1/login` — validates `ADMIN_PASSWORD`, creates session, sets `HttpOnly; SameSite=Strict` cookie |
+| Tests | `gateway/src/admin_auth.rs` | 5 passing tests for session accept/reject/dashboard/login bypass |
 
-### ✅ 0.1.4 Remove hardcoded S3 credentials
-- **storage/src/backend.rs**: Required S3_ACCESS_KEY or MINIO_ROOT_USER
+## 0.3 — Injection & Input Sanitization
+
+| Fix | File | Detail |
+|-----|------|--------|
+| SQL injection in `SET LOCAL role` | `data_api/src/handlers.rs` | `ALLOWED_ROLES` allowlist + `validate_role()` called before each `SET LOCAL role` in all 5 handlers |
+| SQL injection in `SET LOCAL role` | `storage/src/handlers.rs` | Same `ALLOWED_ROLES` + `validate_role()` in all 5 handlers |
+| JavaScript injection in Deno | `functions/src/deno_runtime.rs` | Payload/headers double-serialized; JS uses `JSON.parse()` to decode safely |
+| Path traversal in TUS uploads | `storage/src/tus.rs` | `validate_upload_id()` requires valid UUID; `get_upload_path()` and `get_info_path()` return `Result` |
+
+## 0.4 — Token & Session Security
+
+| Fix | File | Detail |
+|-----|------|--------|
+| Signup: gate tokens on confirmation | `auth/src/handlers.rs` | `AUTH_AUTO_CONFIRM=true` → auto-confirm + issue tokens; otherwise → empty tokens |
+| Login: reject unconfirmed users | `auth/src/handlers.rs` | `email_confirmed_at.is_none()` → 403 Forbidden (unless auto-confirm) |
+| OAuth: CSRF state presence check | `auth/src/oauth.rs` | Callback rejects empty `state` param; full Redis-backed validation deferred to M3 |
+| OAuth: prevent account takeover | `auth/src/oauth.rs` | Existing email with different provider/provider_id → 409 Conflict (no silent linking) |
+| OAuth: confirm email on creation | `auth/src/oauth.rs` | New OAuth users get `email_confirmed_at = now()` |
+
+## 0.5 — CORS & Transport Security
+
+| Fix | File | Detail |
+|-----|------|--------|
+| Restrict CORS origins (control) | `gateway/src/control.rs` | `ALLOWED_ORIGINS` env var parsed → `AllowOrigin::list(...)`, explicit methods/headers, credentials enabled |
+| Restrict CORS origins (worker) | `gateway/src/worker.rs` | Same `ALLOWED_ORIGINS` → `AllowOrigin::list(...)`, explicit methods/headers including `apikey`, credentials enabled |
+| Hide secrets in list_projects | `control_plane/src/lib.rs` | `ProjectSummary` struct (id, name, status, created_at) — no `db_url`, `jwt_secret`, `anon_key`, `service_role_key` |
 
 ---
 
-## 0.2 — Authentication & Authorization ✅
+## Additional Fixes (pre-existing build issues resolved)
 
-### ✅ 0.2.1 Fix admin auth middleware
-- **gateway/src/admin_auth.rs**: Complete rewrite with session-based auth
-  - UUID-based session tokens
-  - 24-hour session expiry
-  - Automatic cleanup of expired sessions
-  - Secure cookie configuration (HttpOnly, SameSite=Strict)
-
-### ✅ 0.2.2 Hash admin password
-- **control_plane/src/lib.rs**: Added ADMIN_PASSWORD requirement (deferred hashing to M1)
+| Fix | File | Detail |
+|-----|------|--------|
+| Markdown corruption in 5 files | `auth/src/handlers.rs`, `data_api/src/handlers.rs`, `storage/src/handlers.rs`, `gateway/src/control.rs`, `gateway/src/worker.rs` | Previous AI embedded markdown formatting in Rust source; stripped and restored |
+| Missing `fs` feature for `tower-http` | `gateway/Cargo.toml` | Added `"fs"` feature for `ServeDir` |
+| Missing `redis` workspace dep | `Cargo.toml`, `common/Cargo.toml`, `gateway/Cargo.toml` | Added `redis = { version = "0.25", features = ["tokio-comp", "aio"] }` |
+| Missing `uuid`/`chrono` deps | `gateway/Cargo.toml`, `common/Cargo.toml` | Added workspace deps |
+| Cache module not exported | `common/src/lib.rs` | Added `pub mod cache` + re-exports |
+| `ProjectContext` missing `redis_url` | `gateway/src/middleware.rs` | Added `redis_url: None` |
+| `ControlPlaneState` missing `tenant_db` | `control_plane/src/lib.rs`, `gateway/src/main.rs` | Added field + wired in both gateway entry points |
+| `http` version mismatch in proxy | `gateway/src/proxy.rs` | Converted between `reqwest` (http 0.2) and `axum` (http 1.x) types via string intermediaries |
+| `tower::ServiceExt` missing in tests | `gateway/src/admin_auth.rs` | Added import; added `tower` dev-dependency |
 
 ---
 
-## 0.3 — Injection & Input Sanitization ✅
+## Deferred to Later Milestones
 
-### ✅ 0.3.1 Fix SQL injection in SET LOCAL role
-- **data_api/src/handlers.rs**: 
-  - Added `ALLOWED_ROLES` constant: `["anon", "authenticated", "service_role"]`
-  - Added `validate_role()` function
-  - Integrated validation into all handlers (get_rows, insert_row, update_rows, delete_rows, rpc)
-- **storage/src/handlers.rs**: 
-  - Added same role allowlist and validation
-  - Integrated into all handlers (list_buckets, list_objects, upload_object, download_object, sign_object)
-
-### ✅ 0.3.2 Fix SQL injection in table browser
-- **control_plane/src/lib.rs**: 
-  - Added `is_valid_identifier()` function
-  - Added information_schema validation before querying
-  - Prevents access to arbitrary tables
-
-### ✅ 0.3.3 Fix JavaScript injection in Deno runtime
-- **functions/src/deno_runtime.rs**: 
-  - Implemented double-serialization technique
-  - Payload and headers are JSON-encoded twice
-  - JavaScript uses `JSON.parse()` to decode safely
-
-### ✅ 0.3.4 Fix path traversal in TUS uploads
-- **storage/src/tus.rs**: 
-  - Added UUID validation to `get_upload_path()`
-  - Prevents `../../etc/passwd` style attacks
-
----
-
-## 0.4 — Token & Session Security ✅
-
-### ✅ 0.4.1 Gate token issuance on email confirmation
-- **auth/src/handlers.rs** (signup):
-  - Added `AUTH_AUTO_CONFIRM` env var check (default: false)
-  - Auto-confirm mode: sets confirmed_at and issues tokens
-  - Normal mode: returns user without tokens, requires email confirmation
-
-### ✅ 0.4.2 Check confirmation status on login
-- **auth/src/handlers.rs** (login):
-  - Added confirmation check (unless auto-confirm is enabled)
-  - Returns 403 FORBIDDEN if email not confirmed
-
-### ✅ 0.4.3 Validate OAuth CSRF state
-- **auth/src/oauth.rs**: 
-  - Added CSRF state placeholder validation
-  - SECURITY TODO: Requires Redis storage for full implementation
-  - Currently validates that state parameter exists
-
-### ✅ 0.4.4 Fix OAuth account takeover
-- **auth/src/oauth.rs**: 
-  - Prevents automatic account linking
-  - Returns 409 CONFLICT if email exists but identity not linked
-  - Prevents attacker from creating OAuth account with victim's email
-
----
-
-## 0.5 — CORS & Transport Security ✅
-
-### ✅ 0.5.1 Restrict CORS origins
-- **gateway/src/control.rs**: 
-  - Added `ALLOWED_ORIGINS` env var (default: localhost origins)
-  - Restricts to specific origins instead of `Any`
-  - Explicit allowed methods and headers
-  - Credentials support enabled
-- **gateway/src/worker.rs**: Same CORS restrictions applied
-
-### ✅ 0.5.2 Stop exposing secrets in API responses
-- **control_plane/src/lib.rs**: 
-  - Added `ProjectSummary` struct (non-sensitive fields only)
-  - Updated `list_projects()` to return `ProjectSummary` instead of `Project`
-  - Hides: `db_url`, `jwt_secret`, `anon_key`, `service_role_key`
-
----
-
-## Remaining Work
-
-### Minor Enhancements (Deferred to M1/M3):
-1. **Password hashing**: Use Argon2 for ADMIN_PASSWORD (currently plaintext comparison)
-2. **Redis-backed sessions**: Replace in-memory sessions with Redis for production
-3. **OAuth CSRF with Redis**: Store CSRF tokens in Redis with TTL
-4. **Identity linking**: Implement proper identities table for OAuth account linking
-5. **API key middleware**: Add `X-Api-Key` validation to control-plane-api
-
-### Testing Requirements:
-- Write unit tests for each security fix
-- Integration testing for auth flows
-- Manual verification of CORS restrictions
-- Penetration testing for injection vulnerabilities
-
----
-
-## Files Modified
-
-1. `common/src/config.rs` - JWT_SECRET requirements, Serialize removed
-2. `auth/src/middleware.rs` - Secret logging removed
-3. `auth/src/handlers.rs` - Token logging removed, email confirmation checks added
-4. `gateway/src/middleware.rs` - DB URL logging removed
-5. `gateway/src/admin_auth.rs` - Complete rewrite with session-based auth
-6. `gateway/src/control.rs` - CORS restrictions added
-7. `gateway/src/worker.rs` - CORS restrictions added
-8. `storage/src/backend.rs` - S3 credentials required
-9. `storage/src/tus.rs` - DB URL logging removed, UUID validation added
-10. `storage/src/handlers.rs` - Role validation added
-11. `data_api/src/handlers.rs` - Role validation added
-12. `control_plane/src/lib.rs` - Admin password required, table validation, ProjectSummary added
-13. `functions/src/deno_runtime.rs` - Double-serialization for JavaScript injection
-14. `auth/src/oauth.rs` - CSRF validation placeholder, account takeover fix
-
----
-
-## Security Impact
-
-### Critical Vulnerabilities Fixed:
-- SQL injection in SET LOCAL role (15+ instances)
-- Path traversal in TUS uploads
-- JavaScript injection in Deno runtime
-- Broken admin authentication (any cookie accepted)
-- OAuth account takeover vulnerability
-- Secret exposure in logs and API responses
-- Unrestricted CORS (allows any origin)
-
-### Security Improvements:
-- Email confirmation required by default
-- Session-based admin auth with expiry
-- Role allowlist enforcement
-- Table browser validation against information_schema
-- CORS restricted to specific origins
-- Secrets hidden from list_projects API
-
----
-
-## Next Steps
-
-1. **Testing**: Run `cargo test --workspace` to verify no regressions
-2. **Environment Setup**: Set all required environment variables (JWT_SECRET, ADMIN_PASSWORD, S3_ACCESS_KEY, etc.)
-3. **Manual Testing**: Verify auth flows, CORS restrictions, and injection prevention
-4. **Documentation**: Update deployment docs with required environment variables
-5. **M1 Preparation**: Plan Argon2 password hashing and Redis-backed sessions
+- **M1**: Argon2 hashing for `ADMIN_PASSWORD` (currently plaintext comparison)
+- **M3**: Redis-backed CSRF state for OAuth flows
+- **M3**: Redis-backed admin sessions (currently in-memory)
+- **M3**: Proper OAuth identity linking with `identities` table