fix: add request size

Author: fiqrikm18

.env.example

@@ -7,6 +7,8 @@ REDIS_URL=redis://:password@127.0.0.1:6379/0
 
 SECRET_KEY=your-super-secret-production-key-here
 
+MAX_REQUEST_SIZE_MB=5242880 #5mb
+
 ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=30
 REFRESH_TOKEN_EXPIRE_MINUTES=10080

README.md

@@ -28,6 +28,7 @@ The API is currently versioned under `/api/v1`.
 - [Docker Notes](#docker-notes)
 - [Development Guide](#development-guide)
 - [Troubleshooting](#troubleshooting)
+- [Security TODO](#security-todo)
 - [Known Notes](#known-notes)
 
 ## Features
@@ -476,6 +477,51 @@ Authorization: Bearer <token>
 
 The token must contain a `sub` claim with a valid user id.
 
+## Security TODO
+
+Legend: `Implemented` means code exists in the repository. `Partial` means code exists but still needs a fix, test, or production hardening.
+
+| Category | Recommended | Current Status | Notes |
+| --- | --- | --- | --- |
+| JWT Authentication | Required | Implemented | `AuthenticationMiddleware` validates bearer tokens for non-public routes. |
+| Refresh Token Rotation | Required | Implemented | Refresh flow revokes the old refresh token and persists a new token. |
+| RBAC + Permissions | Required | Implemented | Casbin-backed role and permission checks are wired through route dependencies. |
+| Rate Limiting (Redis-backed) | Required | Partial | Redis-backed limiter exists, but `apply_global_rate_limit` reads `GLOBAL_RATE_LIMIT` while settings expose `RATE_LIMIT`. |
+| Security Headers Middleware | Required | Not Implemented | Add headers such as `X-Content-Type-Options`, `X-Frame-Options` or CSP `frame-ancestors`, `Referrer-Policy`, and production CSP. |
+| CORS Configuration | Required | Partial | CORS middleware exists, but production origins, methods, and headers should be environment-driven. |
+| Request ID Middleware | Required | Not Implemented | Add request/correlation ID generation and response header propagation. |
+| Audit Logging | Required | Not Implemented | Add audit events for sensitive auth, user, role, permission, and todo mutations. |
+| Structured Logging | Required | Not Implemented | Add structured application logs with request ID, method, path, status, latency, and user context when available. |
+| Global Exception Handling | Required | Partial | Exception handlers exist, but `Exception` is registered twice; verify domain and fallback handling behavior. |
+| Input Validation | Required | Implemented | Pydantic schemas and application validation functions are used across user and todo flows. |
+| Password Hashing (Argon2 or bcrypt) | Required | Implemented | User auth service uses bcrypt hashing. |
+| Account Lockout | Required | Not Implemented | Add failed-login tracking and temporary lockout or throttling by account. |
+| Token Revocation | Required | Implemented | Refresh tokens are revoked on rotation/logout, and access tokens are denylisted in Redis until expiry. |
+| OpenAPI Authentication | Required | Partial | Swagger OAuth2 auth is configured, but `/docs`, `/redoc`, and `/openapi.json` are public; disable them in production or protect them with authentication. |
+| Health Check Endpoint | Required | Implemented | `/health` endpoint returns service health. |
+| Readiness/Liveness Endpoints | Required | Not Implemented | Add separate readiness and liveness endpoints for deployment orchestration. |
+| Request Size Limiting | Required | Implemented | `LimitRequestSizeMiddleware` rejects oversized write requests. |
+| Idempotency Support (for applicable POST endpoints) | Optional but valuable | Not Implemented | Consider idempotency keys for retry-safe create/payment-like workflows. |
+| Database Migrations | Required | Implemented | Alembic is configured with migration commands in the README and Makefile. |
+| Dependency Injection | Required | Implemented | FastAPI dependencies wire repositories, handlers, auth, authorization, and database sessions. |
+| Configuration via Environment Variables | Required | Partial | Pydantic settings read `.env`, but production validation should reject unsafe defaults. |
+
+### Next Implementation Checklist
+
+- [ ] Fix and verify rate limit configuration wiring.
+- [ ] Add security headers middleware.
+- [ ] Add request ID middleware.
+- [ ] Add structured request logging.
+- [ ] Add audit logging for sensitive actions.
+- [ ] Add account lockout or equivalent failed-login protection.
+- [ ] Disable or authenticate `/docs`, `/redoc`, and `/openapi.json` in production.
+- [ ] Add readiness and liveness endpoints.
+- [ ] Add production config validation for secrets and unsafe defaults.
+- [ ] Harden CORS through environment-driven allowed origins, methods, and headers.
+- [ ] Review exception responses to avoid leaking token parsing details or internal exception messages.
+- [ ] Add automated tests for request size limits, rate limiting, auth failures, authorization failures, CORS, security headers, and request IDs.
+- [ ] Add dependency vulnerability scanning to local or CI checks, for example `pip-audit` or an equivalent Poetry-compatible scanner.
+
 ## Known Notes
 
 - `alembic/env.py` currently prints metadata debug output during migrations.

docker-compose.yml

@@ -8,7 +8,7 @@ services:
     depends_on:
       - db
     volumes:
-      - ./src:/app/src # For hot-reloading during dev
+      - ./src:/app/src
 
   db:
     image: postgres:15-alpine

src/core/bootstrap/middleware.py

@@ -1,13 +1,21 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
+from src.core.config.setting import get_settings
+from src.core.middleware.request_size import LimitRequestSizeMiddleware
 from src.core.middleware.auth import AuthenticationMiddleware
 
+settings = get_settings()
+
 
 def register_middleware(app: FastAPI):
+    app.add_middleware(
+        LimitRequestSizeMiddleware,
+        max_upload_size=settings.MAX_REQUEST_SIZE_MB,
+    )
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["http://localhost:3000"],  # Your frontend URL
+        allow_origins=["http://localhost:3000"],
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],

src/core/config/setting.py

@@ -1,18 +1,34 @@
 from functools import lru_cache
 
+from pydantic import Field
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
-    APP_NAME: str = "Todo Modulith API"
-    APP_ENV: str = "development"
-    DATABASE_URL: str = "postgresql+asyncpg://user:password@localhost:5432/todo_db"
-    REDIS_URL: str = "redis://:eYVX7EwVmmxKPCDmwMtyKVge8oLd2t81@127.0.0.1:6379/0"
-    SECRET_KEY: str = "super-secret-key-change-in-production"
-    ALGORITHM: str = "HS256"
-    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
-    REFRESH_TOKEN_EXPIRE_MINUTES: int = 10080
-    RATE_LIMIT: str = "100/minute"
+    APP_NAME: str = Field(alias="APP_NAME", default="Todo Modulith API")
+    APP_ENV: str = Field(alias="APP_ENV", default="development")
+    DATABASE_URL: str = Field(
+        alias="DATABASE_URL",
+        default="postgresql+asyncpg://user:password@localhost:5432/todo_db",
+    )
+    REDIS_URL: str = Field(
+        alias="REDIS_URL",
+        default="redis://:eYVX7EwVmmxKPCDmwMtyKVge8oLd2t81@127.0.0.1:6379/0",
+    )
+    SECRET_KEY: str = Field(
+        alias="SECRET_KEY", default="super-secret-key-change-in-production"
+    )
+    ALGORITHM: str = Field(alias="ALGORITHM", default="HS256")
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = Field(
+        alias="ACCESS_TOKEN_EXPIRE_MINUTES", default=30
+    )
+    REFRESH_TOKEN_EXPIRE_MINUTES: int = Field(
+        alias="REFRESH_TOKEN_EXPIRE_MINUTES", default=10080
+    )
+    RATE_LIMIT: str = Field(alias="RATE_LIMIT", default="100/minute")
+    MAX_REQUEST_SIZE_MB: int = Field(
+        alias="MAX_REQUEST_SIZE_MB", default=5 * 1024 * 1024
+    )
 
     model_config = SettingsConfigDict(
         env_file=".env",

src/core/middleware/auth.py

@@ -5,6 +5,7 @@
 from starlette.responses import JSONResponse, Response
 
 from src.core.security.jwt import JWTService
+from src.core.security.token_revocation import TokenRevocationService
 
 PUBLIC_PATHS = frozenset(
     {
@@ -43,6 +44,12 @@ async def dispatch(
 
         try:
             payload = JWTService.decode_token(token)
+            if await TokenRevocationService.is_access_token_revoked(token):
+                return JSONResponse(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    content={"detail": "Token has been revoked"},
+                )
+
             user_id = payload.get("sub")
             if not user_id:
                 raise ValueError("Token missing 'sub' claim")

src/core/middleware/request_size.py

@@ -0,0 +1,29 @@
+from fastapi import Request, status
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+
+
+class LimitRequestSizeMiddleware(BaseHTTPMiddleware):
+    def __init__(self, app, max_upload_size: int):
+        super().__init__(app)
+        self.max_upload_size = max_upload_size
+
+    async def dispatch(self, request: Request, call_next):
+        if request.method in ("POST", "PUT", "PATCH"):
+            content_length = request.headers.get("content-length")
+
+            if content_length:
+                if int(content_length) > self.max_upload_size:
+                    return JSONResponse(
+                        status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+                        content={
+                            "detail": "Request payload exceeds maximum allowed size."
+                        },
+                    )
+            else:
+                return JSONResponse(
+                    status_code=status.HTTP_411_LENGTH_REQUIRED,
+                    content={"detail": "Content-Length header is required."},
+                )
+
+        return await call_next(request)

src/core/security/jwt.py

@@ -1,4 +1,5 @@
 from datetime import datetime, timedelta, timezone
+from uuid import uuid4
 
 from jose import JWTError, jwt
 
@@ -15,7 +16,7 @@ def create_access_token(data: dict) -> str:
         expire = datetime.now(timezone.utc) + timedelta(
             minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
         )
-        to_encode.update({"exp": expire})
+        to_encode.update({"exp": expire, "jti": str(uuid4())})
         return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
 
     @staticmethod

src/core/security/token_revocation.py

@@ -0,0 +1,45 @@
+from datetime import datetime, timezone
+
+from src.core.database.redis.client import get_redis_client
+from src.core.security.jwt import JWTService
+
+
+class TokenRevocationService:
+    KEY_PREFIX = "revoked_access_token"
+
+    @staticmethod
+    def _key(jti: str) -> str:
+        return f"{TokenRevocationService.KEY_PREFIX}:{jti}"
+
+    @staticmethod
+    async def revoke_access_token(token: str, redis=None) -> None:
+        try:
+            payload = JWTService.decode_token(token)
+        except Exception:
+            return
+
+        jti = payload.get("jti")
+        exp = payload.get("exp")
+        if not jti or not exp:
+            return
+
+        ttl = int(exp - datetime.now(timezone.utc).timestamp())
+        if ttl <= 0:
+            return
+
+        redis_client = redis or await get_redis_client()
+        await redis_client.setex(TokenRevocationService._key(jti), ttl, "1")
+
+    @staticmethod
+    async def is_access_token_revoked(token: str, redis=None) -> bool:
+        try:
+            payload = JWTService.decode_token(token)
+        except Exception:
+            return False
+
+        jti = payload.get("jti")
+        if not jti:
+            return False
+
+        redis_client = redis or await get_redis_client()
+        return bool(await redis_client.exists(TokenRevocationService._key(jti)))

src/modules/authorization/presenter/routers/permission_router.py

@@ -2,7 +2,7 @@
 
 from fastapi import APIRouter, Depends, HTTPException, status
 
-from core.authorization.dependencies import require_permission
+from src.core.authorization.dependencies import require_permission
 from src.core.authorization.infrastructure.services.casbin_authorization_service import (
     CasbinAuthorizationService,
 )