66 lines
3.5 KiB
Markdown
66 lines
3.5 KiB
Markdown
# Production Hardening & Architecture Security Report
|
|
|
|
**Engineers**: Principal Backend Engineer & DevSecOps Lead
|
|
**Target System**: `AI Patient Onboarding FastAPI Microservice v1.0.0`
|
|
**Deployment Target**: Dockerized Container Deployment / Cloud Infrastructure
|
|
|
|
---
|
|
|
|
## 1. System Architecture & Component Overview
|
|
|
|
```
|
|
[ Client / Web / Mobile ]
|
|
│ (HTTPS / TLS 1.3)
|
|
▼
|
|
[ Reverse Proxy / Load Balancer ] (Nginx / Cloud Load Balancer)
|
|
│ (Forwarded headers sanitized)
|
|
▼
|
|
[ FastAPI Application Service ] (Uvicorn / Docker Container)
|
|
├── Security Headers Middleware (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
|
|
├── Request Correlation Middleware (X-Request-ID)
|
|
├── Rate Limiting Middleware (Token Bucket Rate Limiter)
|
|
├── Service / Patient Authentication (Bearer / X-API-Key)
|
|
└── IDOR Session Authorization (session.patient_id == auth.patient_id)
|
|
│
|
|
┌─────┴──────────────────────────────┐
|
|
▼ ▼
|
|
[ SQLite Storage ] [ External AI Services ]
|
|
(onboarding_sessions, ├── Google Gemini AI (gemini-3.6-flash)
|
|
onboarding_state, ├── Sarvam AI (Indic ASR & TTS)
|
|
onboarding_messages) └── OpenAI GPT-4o-mini (Fallback)
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Implemented Production Hardening Safeguards
|
|
|
|
### A. Environment & Debug Controls
|
|
- **Debug Protection**: `DEBUG=false` enforced in production configuration.
|
|
- **Global Error Handling**: Uncaught exceptions are intercepted by a global FastAPI handler in `app/main.py`, returning a sanitized `{ "success": false, "error": { "code": "INTERNAL_SERVER_ERROR", "message": "An internal error occurred" } }` payload without revealing Python stack traces or file paths.
|
|
|
|
### B. Request Correlation & Traceability
|
|
- **Request ID Tracking**: Attached `X-Request-ID` middleware in `app/main.py`. Every HTTP request receives a unique tracking correlation ID in logs and headers.
|
|
|
|
### C. CORS & Security Response Headers
|
|
- **Explicit Domain Binding**: Replaced wildcard CORS (`*`) with explicit trusted domains (`https://onboarding.skyheal.ai`, `http://localhost:5173`).
|
|
- **HTTP Security Headers**: Attached `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy: strict-origin-when-cross-origin`.
|
|
|
|
### D. Upload Security & Payload Size Limits
|
|
- **Payload & Upload Caps**: Enforced 10MB file upload caps (`MAX_UPLOAD_SIZE=10485760`) in `app/api/documents.py`.
|
|
- **MIME Type Validation**: Restricted document uploads to valid clinical formats (`image/jpeg`, `image/png`, `image/webp`, `application/pdf`). Executables (`.exe`, `.sh`, `.bat`) are rejected immediately with `400 Bad Request`.
|
|
|
|
### E. Containerization & Deployment Configuration
|
|
- **Dockerfile Security**: Configured minimal `python:3.11-slim` base image running under a dedicated non-root user (`appuser`, UID 999). Docker health checks verify container readiness via `/health`.
|
|
|
|
---
|
|
|
|
## 3. Deployment Checklist
|
|
|
|
- [x] Environment template `.env.example` created.
|
|
- [x] Global exception handler attached to prevent error disclosure.
|
|
- [x] `X-Request-ID` request correlation middleware active.
|
|
- [x] CORS origins restricted to authorized domains.
|
|
- [x] Document upload MIME validation and 10MB size limits enforced.
|
|
- [x] Non-root Dockerfile & `.dockerignore` created.
|
|
- [x] Automated production security tests (`tests/production/test_production_security.py`) verified (5/5 Passed).
|