feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma binaryTargets for openssl 3.0 - nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal cron, http->https redirect - prisma: add origin_goods.delisted migration, sync missing schema (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz - api: CORS wildcard reflection, helmet CORP cross-origin, price backfill in persistProductDetail, categoryIcon ancestor fallback, mediaByColor per-color gallery in public goods detail - admin: /admin base path (vite + router) - import-data.mjs: udt_name casting, serial sequence advance fix
2026-08-26 14:23:09 +08:00
parent be0b90e68f
commit 6c61a4e871
982 changed files with 74156 additions and 179393 deletions
@@ -1,54 +0,0 @@
---
-title: Apply Principle of Least Privilege
-impact: MEDIUM
-impactDescription: Reduced attack surface, better audit trail
-tags: privileges, security, roles, permissions
---
-
-## Apply Principle of Least Privilege
-
-Grant only the minimum permissions required. Never use superuser for application queries.
-
-**Incorrect (overly broad permissions):**
-
-```sql
-- Application uses superuser connection
-- Or grants ALL to application role
-grant all privileges on all tables in schema public to app_user;
-grant all privileges on all sequences in schema public to app_user;
-
-- Any SQL injection becomes catastrophic
-- drop table users; cascades to everything
-```
-
-**Correct (minimal, specific grants):**
-
-```sql
-- Create role with no default privileges
-create role app_readonly nologin;
-
-- Grant only SELECT on specific tables
-grant usage on schema public to app_readonly;
-grant select on public.products, public.categories to app_readonly;
-
-- Create role for writes with limited scope
-create role app_writer nologin;
-grant usage on schema public to app_writer;
-grant select, insert, update on public.orders to app_writer;
-grant usage on sequence orders_id_seq to app_writer;
-- No DELETE permission
-
-- Login role inherits from these
-create role app_user login password 'xxx';
-grant app_writer to app_user;
-```
-
-Revoke public defaults:
-
-```sql
-- Revoke default public access
-revoke all on schema public from public;
-revoke all on all tables in schema public from public;
-```
-
-Reference: [Roles and Privileges](https://supabase.com/blog/postgres-roles-and-privileges)