botserver/src/basic/keywords/social/post_to_scheduled.rs
Rodrigo Rodriguez (Pragmatismo) c67aaa677a feat(security): Complete security infrastructure implementation
SECURITY MODULES ADDED:
- security/auth.rs: Full RBAC with roles (Anonymous, User, Moderator, Admin, SuperAdmin, Service, Bot, BotOwner, BotOperator, BotViewer) and permissions
- security/cors.rs: Hardened CORS (no wildcard in production, env-based config)
- security/panic_handler.rs: Panic catching middleware with safe 500 responses
- security/path_guard.rs: Path traversal protection, null byte prevention
- security/request_id.rs: UUID request tracking with correlation IDs
- security/error_sanitizer.rs: Sensitive data redaction from responses
- security/zitadel_auth.rs: Zitadel token introspection and role mapping
- security/sql_guard.rs: SQL injection prevention with table whitelist
- security/command_guard.rs: Command injection prevention
- security/secrets.rs: Zeroizing secret management
- security/validation.rs: Input validation utilities
- security/rate_limiter.rs: Rate limiting with governor crate
- security/headers.rs: Security headers (CSP, HSTS, X-Frame-Options)

MAIN.RS UPDATES:
- Replaced tower_http::cors::Any with hardened create_cors_layer()
- Added panic handler middleware
- Added request ID tracking middleware
- Set global panic hook

SECURITY STATUS:
- 0 unwrap() in production code
- 0 panic! in production code
- 0 unsafe blocks
- cargo audit: PASS (no vulnerabilities)
- Estimated completion: ~98%

Remaining: Wire auth middleware to handlers, audit logs for sensitive data
2025-12-28 19:29:18 -03:00

169 lines
5.6 KiB
Rust

use crate::shared::models::UserSession;
use crate::shared::state::AppState;
use chrono::{DateTime, NaiveDateTime, Utc};
use diesel::prelude::*;
use log::{debug, error, trace};
use rhai::{Dynamic, Engine};
use std::sync::Arc;
use uuid::Uuid;
pub fn post_to_at_keyword(state: Arc<AppState>, user: UserSession, engine: &mut Engine) {
let state_clone = Arc::clone(&state);
let user_clone = user;
engine
.register_custom_syntax(
[
"POST", "TO", "$expr$", "AT", "$expr$", "$expr$", ",", "$expr$",
],
false,
move |context, inputs| {
let platform = context.eval_expression_tree(&inputs[0])?.to_string();
let schedule_time = context.eval_expression_tree(&inputs[1])?.to_string();
let media = context.eval_expression_tree(&inputs[2])?.to_string();
let caption = context.eval_expression_tree(&inputs[3])?.to_string();
let platform = platform.trim_matches('"').to_lowercase();
let schedule_time = schedule_time.trim_matches('"');
let media = media.trim_matches('"');
let caption = caption.trim_matches('"');
let scheduled_at = parse_schedule_time(schedule_time)?;
trace!(
"POST TO {} AT {}: media={}, caption={}",
platform,
scheduled_at,
media,
caption
);
let state_for_task = Arc::clone(&state_clone);
let user_for_task = user_clone.clone();
let platform_owned = platform;
let media_owned = media.to_string();
let caption_owned = caption.to_string();
let (tx, rx) = std::sync::mpsc::channel();
std::thread::spawn(move || {
let rt = tokio::runtime::Builder::new_multi_thread()
.worker_threads(2)
.enable_all()
.build();
if let Ok(_rt) = rt {
let result = execute_scheduled_post(
&state_for_task,
&user_for_task,
&platform_owned,
&media_owned,
&caption_owned,
scheduled_at,
);
let _ = tx.send(result);
}
});
match rx.recv_timeout(std::time::Duration::from_secs(30)) {
Ok(Ok(post_id)) => Ok(Dynamic::from(post_id)),
Ok(Err(e)) => Err(Box::new(rhai::EvalAltResult::ErrorRuntime(
format!("Scheduled POST TO failed: {}", e).into(),
rhai::Position::NONE,
))),
Err(_) => Err(Box::new(rhai::EvalAltResult::ErrorRuntime(
"Scheduled POST TO timed out".into(),
rhai::Position::NONE,
))),
}
},
)
.expect("valid syntax registration");
debug!("Registered POST TO AT keyword");
}
fn parse_schedule_time(time_str: &str) -> Result<DateTime<Utc>, Box<rhai::EvalAltResult>> {
let formats = [
"%Y-%m-%d %H:%M",
"%Y-%m-%d %H:%M:%S",
"%Y-%m-%dT%H:%M:%S",
"%Y-%m-%dT%H:%M",
"%d/%m/%Y %H:%M",
"%m/%d/%Y %H:%M",
];
for format in formats {
if let Ok(naive) = NaiveDateTime::parse_from_str(time_str, format) {
return Ok(DateTime::from_naive_utc_and_offset(naive, Utc));
}
}
Err(Box::new(rhai::EvalAltResult::ErrorRuntime(
format!(
"Invalid date format: {}. Use YYYY-MM-DD HH:MM format.",
time_str
)
.into(),
rhai::Position::NONE,
)))
}
fn execute_scheduled_post(
state: &AppState,
user: &UserSession,
platform: &str,
media: &str,
caption: &str,
scheduled_at: DateTime<Utc>,
) -> Result<String, String> {
let platforms: Vec<&str> = platform.split(',').map(|s| s.trim()).collect();
let mut post_ids = Vec::new();
for p in platforms {
let post_id = save_scheduled_post(state, user, p, media, caption, scheduled_at)?;
post_ids.push(post_id);
}
Ok(post_ids.join(","))
}
fn save_scheduled_post(
state: &AppState,
user: &UserSession,
platform: &str,
media: &str,
caption: &str,
scheduled_at: DateTime<Utc>,
) -> Result<String, String> {
let mut conn = state.conn.get().map_err(|e| format!("DB error: {}", e))?;
let post_id = Uuid::new_v4().to_string();
let now = Utc::now();
let query = diesel::sql_query(
"INSERT INTO social_posts (id, bot_id, user_id, platform, content, media_url, status, scheduled_at, created_at)
VALUES ($1, $2, $3, $4, $5, $6, 'scheduled', $7, $8)",
)
.bind::<diesel::sql_types::Text, _>(&post_id)
.bind::<diesel::sql_types::Uuid, _>(user.bot_id)
.bind::<diesel::sql_types::Uuid, _>(user.user_id)
.bind::<diesel::sql_types::Text, _>(platform)
.bind::<diesel::sql_types::Text, _>(caption)
.bind::<diesel::sql_types::Text, _>(media)
.bind::<diesel::sql_types::Timestamptz, _>(&scheduled_at)
.bind::<diesel::sql_types::Timestamptz, _>(&now);
query.execute(&mut *conn).map_err(|e| {
error!("Failed to save scheduled post: {}", e);
format!("Failed to save scheduled post: {}", e)
})?;
trace!(
"Scheduled post saved: {} to {} at {}",
post_id,
platform,
scheduled_at
);
Ok(post_id)
}