20ba381 fix(admin): address security vulnerabilities in admin API · gordon

M go.mod +2 -2


@@ -45,7 +45,7 @@ require (
45	45		github.com/pmezard/go-difflib v1.0.0 // indirect
46	46		github.com/stretchr/objx v0.5.2 // indirect
47	47		go.uber.org/mock v0.5.2 // direct
48		-	golang.org/x/time v0.12.0 // indirect
	48	+	golang.org/x/time v0.14.0
49	49		)
50	50
51	51		require (

@@ -69,7 +69,7 @@ require (
69	69		github.com/morikuni/aec v1.0.0 // indirect
70	70		github.com/opencontainers/go-digest v1.0.0 // indirect
71	71		github.com/opencontainers/image-spec v1.1.1 // indirect
72		-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
	72	+	github.com/pelletier/go-toml/v2 v2.2.4
73	73		github.com/pkg/errors v0.9.1 // indirect
74	74		github.com/sagikazarmark/locafero v0.12.0 // indirect
75	75		github.com/spf13/afero v1.15.0


@@ -45,7 +45,7 @@ require (
45		github.com/pmezard/go-difflib v1.0.0 // indirect	45		github.com/pmezard/go-difflib v1.0.0 // indirect
46		github.com/stretchr/objx v0.5.2 // indirect	46		github.com/stretchr/objx v0.5.2 // indirect
47		go.uber.org/mock v0.5.2 // direct	47		go.uber.org/mock v0.5.2 // direct
48	-	golang.org/x/time v0.12.0 // indirect	48	+	golang.org/x/time v0.14.0
49		)	49		)
50			50
51		require (	51		require (

@@ -69,7 +69,7 @@ require (
69		github.com/morikuni/aec v1.0.0 // indirect	69		github.com/morikuni/aec v1.0.0 // indirect
70		github.com/opencontainers/go-digest v1.0.0 // indirect	70		github.com/opencontainers/go-digest v1.0.0 // indirect
71		github.com/opencontainers/image-spec v1.1.1 // indirect	71		github.com/opencontainers/image-spec v1.1.1 // indirect
72	-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect	72	+	github.com/pelletier/go-toml/v2 v2.2.4
73		github.com/pkg/errors v0.9.1 // indirect	73		github.com/pkg/errors v0.9.1 // indirect
74		github.com/sagikazarmark/locafero v0.12.0 // indirect	74		github.com/sagikazarmark/locafero v0.12.0 // indirect
75		github.com/spf13/afero v1.15.0	75		github.com/spf13/afero v1.15.0

M go.sum +2 -2


@@ -194,8 +194,8 @@ golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
194	194		golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
195	195		golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
196	196		golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
197		-	golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
198		-	golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
	197	+	golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
	198	+	golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
199	199		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0=
200	200		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto=
201	201		google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=


@@ -194,8 +194,8 @@ golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
194		golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=	194		golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
195		golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=	195		golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
196		golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=	196		golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
197	-	golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=	197	+	golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
198	-	golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=	198	+	golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
199		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0=	199		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0=
200		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto=	200		google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto=
201		google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=	201		google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=

M internal/adapters/in/http/admin/handler.go +20 -7


@@ -13,6 +13,9 @@ import (
13	13		"gordon/internal/domain"
14	14		)
15	15
	16	+	// maxAdminRequestSize is the maximum allowed size for admin API request bodies.
	17	+	const maxAdminRequestSize = 1 << 20 // 1MB
	18	+
16	19		// Handler implements the HTTP handler for the admin API.
17	20		type Handler struct {
18	21		configSvc in.ConfigService

@@ -157,6 +160,9 @@ func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {
157	160		return
158	161		}
159	162
	163	+	// Limit request body size
	164	+	r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
	165	+
160	166		var route domain.Route
161	167		if err := json.NewDecoder(r.Body).Decode(&route); err != nil {
162	168		log.Warn().Err(err).Msg("invalid route JSON")

@@ -171,7 +177,7 @@ func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {
171	177
172	178		if err := h.configSvc.AddRoute(ctx, route); err != nil {
173	179		log.Error().Err(err).Str("domain", route.Domain).Msg("failed to add route")
174		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	180	+	h.sendError(w, http.StatusInternalServerError, "failed to add route")
175	181		return
176	182		}
177	183

@@ -194,6 +200,9 @@ func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeD
194	200		return
195	201		}
196	202
	203	+	// Limit request body size
	204	+	r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
	205	+
197	206		var route domain.Route
198	207		if err := json.NewDecoder(r.Body).Decode(&route); err != nil {
199	208		log.Warn().Err(err).Msg("invalid route JSON")

@@ -205,7 +214,7 @@ func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeD
205	214
206	215		if err := h.configSvc.UpdateRoute(ctx, route); err != nil {
207	216		log.Error().Err(err).Str("domain", routeDomain).Msg("failed to update route")
208		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	217	+	h.sendError(w, http.StatusInternalServerError, "failed to update route")
209	218		return
210	219		}
211	220

@@ -230,7 +239,7 @@ func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, rou
230	239
231	240		if err := h.configSvc.RemoveRoute(ctx, routeDomain); err != nil {
232	241		log.Error().Err(err).Str("domain", routeDomain).Msg("failed to remove route")
233		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	242	+	h.sendError(w, http.StatusInternalServerError, "failed to remove route")
234	243		return
235	244		}
236	245

@@ -267,7 +276,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
267	276		secrets, err := h.listSecrets(secretDomain)
268	277		if err != nil {
269	278		log.Error().Err(err).Str("domain", secretDomain).Msg("failed to list secrets")
270		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	279	+	h.sendError(w, http.StatusInternalServerError, "failed to list secrets")
271	280		return
272	281		}
273	282		h.sendJSON(w, http.StatusOK, map[string]any{"domain": secretDomain, "keys": secrets})

@@ -278,6 +287,10 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
278	287		h.sendError(w, http.StatusForbidden, "insufficient permissions for secrets:write")
279	288		return
280	289		}
	290	+
	291	+	// Limit request body size
	292	+	r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
	293	+
281	294		// Set secret(s)
282	295		var data map[string]string
283	296		if err := json.NewDecoder(r.Body).Decode(&data); err != nil {

@@ -288,7 +301,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
288	301
289	302		if err := h.setSecrets(secretDomain, data); err != nil {
290	303		log.Error().Err(err).Str("domain", secretDomain).Msg("failed to set secrets")
291		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	304	+	h.sendError(w, http.StatusInternalServerError, "failed to set secrets")
292	305		return
293	306		}
294	307

@@ -308,7 +321,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
308	321
309	322		if err := h.deleteSecret(secretDomain, secretKey); err != nil {
310	323		log.Error().Err(err).Str("domain", secretDomain).Str("key", secretKey).Msg("failed to delete secret")
311		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	324	+	h.sendError(w, http.StatusInternalServerError, "failed to delete secret")
312	325		return
313	326		}
314	327

@@ -414,7 +427,7 @@ func (h Handler) handleReload(w http.ResponseWriter, r http.Request) {
414	427		// Reload configuration from file into memory
415	428		if err := h.configSvc.Load(ctx); err != nil {
416	429		log.Error().Err(err).Msg("failed to reload config")
417		-	h.sendError(w, http.StatusInternalServerError, err.Error())
	430	+	h.sendError(w, http.StatusInternalServerError, "failed to reload config")
418	431		return
419	432		}
420	433

 	"gordon/internal/domain"
 )
+// maxAdminRequestSize is the maximum allowed size for admin API request bodies.
+const maxAdminRequestSize = 1 << 20 // 1MB
 // Handler implements the HTTP handler for the admin API.
 type Handler struct {
 	configSvc    in.ConfigService
 		return
 	}
+	// Limit request body size
+	r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
 	var route domain.Route
 	if err := json.NewDecoder(r.Body).Decode(&route); err != nil {
 		log.Warn().Err(err).Msg("invalid route JSON")
 	if err := h.configSvc.AddRoute(ctx, route); err != nil {
 		log.Error().Err(err).Str("domain", route.Domain).Msg("failed to add route")
-		h.sendError(w, http.StatusInternalServerError, err.Error())
+		h.sendError(w, http.StatusInternalServerError, "failed to add route")
 		return
 	}
 		return
 	}
+	// Limit request body size
+	r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
 	var route domain.Route
 	if err := json.NewDecoder(r.Body).Decode(&route); err != nil {
 		log.Warn().Err(err).Msg("invalid route JSON")
 	if err := h.configSvc.UpdateRoute(ctx, route); err != nil {
 		log.Error().Err(err).Str("domain", routeDomain).Msg("failed to update route")
-		h.sendError(w, http.StatusInternalServerError, err.Error())
+		h.sendError(w, http.StatusInternalServerError, "failed to update route")
 		return
 	}
 	if err := h.configSvc.RemoveRoute(ctx, routeDomain); err != nil {
 		log.Error().Err(err).Str("domain", routeDomain).Msg("failed to remove route")
-		h.sendError(w, http.StatusInternalServerError, err.Error())
+		h.sendError(w, http.StatusInternalServerError, "failed to remove route")
 		return
 	}
 		secrets, err := h.listSecrets(secretDomain)
 		if err != nil {
 			log.Error().Err(err).Str("domain", secretDomain).Msg("failed to list secrets")
-			h.sendError(w, http.StatusInternalServerError, err.Error())
+			h.sendError(w, http.StatusInternalServerError, "failed to list secrets")
 			return
 		}
 		h.sendJSON(w, http.StatusOK, map[string]any{"domain": secretDomain, "keys": secrets})
 			h.sendError(w, http.StatusForbidden, "insufficient permissions for secrets:write")
 			return
 		}
+		// Limit request body size
+		r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestSize)
 		// Set secret(s)
 		var data map[string]string
 		if err := json.NewDecoder(r.Body).Decode(&data); err != nil {
 		if err := h.setSecrets(secretDomain, data); err != nil {
 			log.Error().Err(err).Str("domain", secretDomain).Msg("failed to set secrets")
-			h.sendError(w, http.StatusInternalServerError, err.Error())
+			h.sendError(w, http.StatusInternalServerError, "failed to set secrets")
 			return
 		}
 		if err := h.deleteSecret(secretDomain, secretKey); err != nil {
 			log.Error().Err(err).Str("domain", secretDomain).Str("key", secretKey).Msg("failed to delete secret")
-			h.sendError(w, http.StatusInternalServerError, err.Error())
+			h.sendError(w, http.StatusInternalServerError, "failed to delete secret")
 			return
 		}
 	// Reload configuration from file into memory
 	if err := h.configSvc.Load(ctx); err != nil {
 		log.Error().Err(err).Msg("failed to reload config")
-		h.sendError(w, http.StatusInternalServerError, err.Error())
+		h.sendError(w, http.StatusInternalServerError, "failed to reload config")
 		return
 	}

M internal/adapters/in/http/admin/middleware.go +21 -4


@@ -2,10 +2,12 @@ package admin
2	2
3	3		import (
4	4		"context"
	5	+	"encoding/json"
5	6		"net/http"
6	7		"strings"
7	8
8	9		"github.com/bnema/zerowrap"
	10	+	"golang.org/x/time/rate"
9	11
10	12		"gordon/internal/boundaries/in"
11	13		"gordon/internal/domain"

@@ -22,14 +24,29 @@ const (
22	24		)
23	25
24	26		// AuthMiddleware creates middleware that validates admin API authentication.
25		-	func AuthMiddleware(authSvc in.AuthService, log zerowrap.Logger) func(http.Handler) http.Handler {
	27	+	// The limiter parameter is optional and can be nil to disable rate limiting.
	28	+	func AuthMiddleware(authSvc in.AuthService, limiter *rate.Limiter, log zerowrap.Logger) func(http.Handler) http.Handler {
26	29		return func(next http.Handler) http.Handler {
27	30		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
28	31		ctx := r.Context()
29	32
	33	+	// Rate limit check (before any auth processing)
	34	+	if limiter != nil && !limiter.Allow() {
	35	+	w.Header().Set("Content-Type", "application/json")
	36	+	w.Header().Set("Retry-After", "1")
	37	+	w.WriteHeader(http.StatusTooManyRequests)
	38	+	_ = json.NewEncoder(w).Encode(map[string]string{"error": "rate limit exceeded"})
	39	+	return
	40	+	}
	41	+
30	42		// Check if auth is enabled
31	43		if !authSvc.IsEnabled() {
32		-	// Auth disabled, allow all requests
	44	+	// Auth disabled, log warning and allow all requests
	45	+	log.Warn().
	46	+	Str("path", r.URL.Path).
	47	+	Str("method", r.Method).
	48	+	Str("remote_addr", r.RemoteAddr).
	49	+	Msg("auth disabled - allowing unauthenticated admin API access")
33	50		next.ServeHTTP(w, r)
34	51		return
35	52		}

@@ -125,11 +142,11 @@ func sendUnauthorized(w http.ResponseWriter, message string) {
125	142		w.Header().Set("Content-Type", "application/json")
126	143		w.Header().Set("WWW-Authenticate", `Bearer realm="gordon-admin"`)
127	144		w.WriteHeader(http.StatusUnauthorized)
128		-	w.Write([]byte(`{"error":"` + message + `"}`))
	145	+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
129	146		}
130	147
131	148		func sendForbidden(w http.ResponseWriter, message string) {
132	149		w.Header().Set("Content-Type", "application/json")
133	150		w.WriteHeader(http.StatusForbidden)
134		-	w.Write([]byte(`{"error":"` + message + `"}`))
	151	+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
135	152		}

 import (
 	"context"
+	"encoding/json"
 	"net/http"
 	"strings"
 	"github.com/bnema/zerowrap"
+	"golang.org/x/time/rate"
 	"gordon/internal/boundaries/in"
 	"gordon/internal/domain"
 )
 // AuthMiddleware creates middleware that validates admin API authentication.
-func AuthMiddleware(authSvc in.AuthService, log zerowrap.Logger) func(http.Handler) http.Handler {
+// The limiter parameter is optional and can be nil to disable rate limiting.
+func AuthMiddleware(authSvc in.AuthService, limiter *rate.Limiter, log zerowrap.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
+			// Rate limit check (before any auth processing)
+			if limiter != nil && !limiter.Allow() {
+				w.Header().Set("Content-Type", "application/json")
+				w.Header().Set("Retry-After", "1")
+				w.WriteHeader(http.StatusTooManyRequests)
+				_ = json.NewEncoder(w).Encode(map[string]string{"error": "rate limit exceeded"})
+				return
+			}
 			// Check if auth is enabled
 			if !authSvc.IsEnabled() {
-				// Auth disabled, allow all requests
+				// Auth disabled, log warning and allow all requests
+				log.Warn().
+					Str("path", r.URL.Path).
+					Str("method", r.Method).
+					Str("remote_addr", r.RemoteAddr).
+					Msg("auth disabled - allowing unauthenticated admin API access")
 				next.ServeHTTP(w, r)
 				return
 			}
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("WWW-Authenticate", `Bearer realm="gordon-admin"`)
 	w.WriteHeader(http.StatusUnauthorized)
-	w.Write([]byte(`{"error":"` + message + `"}`))
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
 }
 func sendForbidden(w http.ResponseWriter, message string) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusForbidden)
-	w.Write([]byte(`{"error":"` + message + `"}`))
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
 }

M internal/adapters/in/http/admin/secrets.go +67 -15


@@ -11,17 +11,41 @@ import (
11	11		// domainToEnvFile converts a domain to its env file path.
12	12		// Example: app.mydomain.com -> app_mydomain_com.env
13	13		// Must match the naming convention in envloader.FileLoader.getEnvFilePath
14		-	func (h *Handler) domainToEnvFile(domain string) string {
	14	+	// Returns an error if the domain contains path traversal attempts or is invalid.
	15	+	func (h *Handler) domainToEnvFile(domain string) (string, error) {
	16	+	// Reject path traversal attempts
	17	+	if strings.Contains(domain, "..") {
	18	+	return "", fmt.Errorf("invalid domain: path traversal not allowed")
	19	+	}
	20	+
	21	+	// Validate domain length (max DNS name length is 253)
	22	+	if len(domain) == 0 \|\| len(domain) > 253 {
	23	+	return "", fmt.Errorf("invalid domain length")
	24	+	}
	25	+
15	26		// Replace special characters with underscores (matches envloader)
16	27		filename := strings.ReplaceAll(domain, ".", "_")
17	28		filename = strings.ReplaceAll(filename, ":", "_")
18	29		filename = strings.ReplaceAll(filename, "/", "_")
19		-	return filepath.Join(h.envDir, filename+".env")
	30	+
	31	+	fullPath := filepath.Join(h.envDir, filename+".env")
	32	+
	33	+	// Verify path stays within envDir after cleaning
	34	+	cleanPath := filepath.Clean(fullPath)
	35	+	cleanEnvDir := filepath.Clean(h.envDir)
	36	+	if !strings.HasPrefix(cleanPath, cleanEnvDir+string(filepath.Separator)) {
	37	+	return "", fmt.Errorf("invalid domain: path escapes env directory")
	38	+	}
	39	+
	40	+	return cleanPath, nil
20	41		}
21	42
22	43		// listSecrets returns the list of secret keys for a domain (not values).
23	44		func (h *Handler) listSecrets(domain string) ([]string, error) {
24		-	envFile := h.domainToEnvFile(domain)
	45	+	envFile, err := h.domainToEnvFile(domain)
	46	+	if err != nil {
	47	+	return nil, err
	48	+	}
25	49
26	50		file, err := os.Open(envFile)
27	51		if err != nil {

@@ -55,7 +79,10 @@ func (h *Handler) listSecrets(domain string) ([]string, error) {
55	79
56	80		// getSecrets returns all secrets for a domain as a map.
57	81		func (h *Handler) getSecrets(domain string) (map[string]string, error) {
58		-	envFile := h.domainToEnvFile(domain)
	82	+	envFile, err := h.domainToEnvFile(domain)
	83	+	if err != nil {
	84	+	return nil, err
	85	+	}
59	86
60	87		file, err := os.Open(envFile)
61	88		if err != nil {

@@ -126,35 +153,60 @@ func (h *Handler) deleteSecret(domain, key string) error {
126	153		return h.writeSecrets(domain, existing)
127	154		}
128	155
129		-	// writeSecrets writes all secrets to the domain's env file.
130		-	func (h *Handler) writeSecrets(domain string, secrets map[string]string) (err error) {
131		-	envFile := h.domainToEnvFile(domain)
	156	+	// writeSecrets writes all secrets to the domain's env file atomically.
	157	+	// It writes to a temporary file first, syncs it, then renames to the final path.
	158	+	func (h *Handler) writeSecrets(domain string, secrets map[string]string) error {
	159	+	envFile, err := h.domainToEnvFile(domain)
	160	+	if err != nil {
	161	+	return err
	162	+	}
132	163
133		-	// Create/truncate file with secure permissions
134		-	file, err := os.OpenFile(envFile, os.O_WRONLY\|os.O_CREATE\|os.O_TRUNC, 0600)
	164	+	// Write to temp file for atomic operation
	165	+	tmpFile := envFile + ".tmp"
	166	+
	167	+	file, err := os.OpenFile(tmpFile, os.O_WRONLY\|os.O_CREATE\|os.O_TRUNC, 0600)
135	168		if err != nil {
136		-	return fmt.Errorf("failed to create env file: %w", err)
	169	+	return fmt.Errorf("failed to create temp env file: %w", err)
137	170		}
138		-	defer func() {
139		-	if cerr := file.Close(); cerr != nil && err == nil {
140		-	err = fmt.Errorf("failed to close env file: %w", cerr)
141		-	}
142		-	}()
143	171
144	172		// Write header comment
145	173		if _, err := fmt.Fprintf(file, "# Environment variables for %s\n", domain); err != nil {
	174	+	file.Close()
	175	+	os.Remove(tmpFile)
146	176		return fmt.Errorf("failed to write header: %w", err)
147	177		}
148	178		if _, err := fmt.Fprintf(file, "# Managed by Gordon admin API\n\n"); err != nil {
	179	+	file.Close()
	180	+	os.Remove(tmpFile)
149	181		return fmt.Errorf("failed to write header: %w", err)
150	182		}
151	183
152	184		// Write each secret
153	185		for key, value := range secrets {
154	186		if _, err := fmt.Fprintf(file, "%s=%s\n", key, value); err != nil {
	187	+	file.Close()
	188	+	os.Remove(tmpFile)
155	189		return fmt.Errorf("failed to write secret %s: %w", key, err)
156	190		}
157	191		}
158	192
	193	+	// Sync to ensure data is on disk before rename
	194	+	if err := file.Sync(); err != nil {
	195	+	file.Close()
	196	+	os.Remove(tmpFile)
	197	+	return fmt.Errorf("failed to sync env file: %w", err)
	198	+	}
	199	+
	200	+	if err := file.Close(); err != nil {
	201	+	os.Remove(tmpFile)
	202	+	return fmt.Errorf("failed to close env file: %w", err)
	203	+	}
	204	+
	205	+	// Atomic rename
	206	+	if err := os.Rename(tmpFile, envFile); err != nil {
	207	+	os.Remove(tmpFile)
	208	+	return fmt.Errorf("failed to rename env file: %w", err)
	209	+	}
	210	+
159	211		return nil
160	212		}


@@ -11,17 +11,41 @@ import (
11		// domainToEnvFile converts a domain to its env file path.	11		// domainToEnvFile converts a domain to its env file path.
12		// Example: app.mydomain.com -> app_mydomain_com.env	12		// Example: app.mydomain.com -> app_mydomain_com.env
13		// Must match the naming convention in envloader.FileLoader.getEnvFilePath	13		// Must match the naming convention in envloader.FileLoader.getEnvFilePath
14	-	func (h *Handler) domainToEnvFile(domain string) string {	14	+	// Returns an error if the domain contains path traversal attempts or is invalid.
			15	+	func (h *Handler) domainToEnvFile(domain string) (string, error) {
			16	+	// Reject path traversal attempts
			17	+	if strings.Contains(domain, "..") {
			18	+	return "", fmt.Errorf("invalid domain: path traversal not allowed")
			19	+	}
			20	+
			21	+	// Validate domain length (max DNS name length is 253)
			22	+	if len(domain) == 0 \|\| len(domain) > 253 {
			23	+	return "", fmt.Errorf("invalid domain length")
			24	+	}
			25	+
15		// Replace special characters with underscores (matches envloader)	26		// Replace special characters with underscores (matches envloader)
16		filename := strings.ReplaceAll(domain, ".", "_")	27		filename := strings.ReplaceAll(domain, ".", "_")
17		filename = strings.ReplaceAll(filename, ":", "_")	28		filename = strings.ReplaceAll(filename, ":", "_")
18		filename = strings.ReplaceAll(filename, "/", "_")	29		filename = strings.ReplaceAll(filename, "/", "_")
19	-	return filepath.Join(h.envDir, filename+".env")	30	+
			31	+	fullPath := filepath.Join(h.envDir, filename+".env")
			32	+
			33	+	// Verify path stays within envDir after cleaning
			34	+	cleanPath := filepath.Clean(fullPath)
			35	+	cleanEnvDir := filepath.Clean(h.envDir)
			36	+	if !strings.HasPrefix(cleanPath, cleanEnvDir+string(filepath.Separator)) {
			37	+	return "", fmt.Errorf("invalid domain: path escapes env directory")
			38	+	}
			39	+
			40	+	return cleanPath, nil
20		}	41		}
21			42
22		// listSecrets returns the list of secret keys for a domain (not values).	43		// listSecrets returns the list of secret keys for a domain (not values).
23		func (h *Handler) listSecrets(domain string) ([]string, error) {	44		func (h *Handler) listSecrets(domain string) ([]string, error) {
24	-	envFile := h.domainToEnvFile(domain)	45	+	envFile, err := h.domainToEnvFile(domain)
			46	+	if err != nil {
			47	+	return nil, err
			48	+	}
25			49
26		file, err := os.Open(envFile)	50		file, err := os.Open(envFile)
27		if err != nil {	51		if err != nil {

@@ -55,7 +79,10 @@ func (h *Handler) listSecrets(domain string) ([]string, error) {
55			79
56		// getSecrets returns all secrets for a domain as a map.	80		// getSecrets returns all secrets for a domain as a map.
57		func (h *Handler) getSecrets(domain string) (map[string]string, error) {	81		func (h *Handler) getSecrets(domain string) (map[string]string, error) {
58	-	envFile := h.domainToEnvFile(domain)	82	+	envFile, err := h.domainToEnvFile(domain)
			83	+	if err != nil {
			84	+	return nil, err
			85	+	}
59			86
60		file, err := os.Open(envFile)	87		file, err := os.Open(envFile)
61		if err != nil {	88		if err != nil {

@@ -126,35 +153,60 @@ func (h *Handler) deleteSecret(domain, key string) error {
126		return h.writeSecrets(domain, existing)	153		return h.writeSecrets(domain, existing)
127		}	154		}
128			155
129	-	// writeSecrets writes all secrets to the domain's env file.	156	+	// writeSecrets writes all secrets to the domain's env file atomically.
130	-	func (h *Handler) writeSecrets(domain string, secrets map[string]string) (err error) {	157	+	// It writes to a temporary file first, syncs it, then renames to the final path.
131	-	envFile := h.domainToEnvFile(domain)	158	+	func (h *Handler) writeSecrets(domain string, secrets map[string]string) error {
			159	+	envFile, err := h.domainToEnvFile(domain)
			160	+	if err != nil {
			161	+	return err
			162	+	}
132			163
133	-	// Create/truncate file with secure permissions	164	+	// Write to temp file for atomic operation
134	-	file, err := os.OpenFile(envFile, os.O_WRONLY\|os.O_CREATE\|os.O_TRUNC, 0600)	165	+	tmpFile := envFile + ".tmp"
			166	+
			167	+	file, err := os.OpenFile(tmpFile, os.O_WRONLY\|os.O_CREATE\|os.O_TRUNC, 0600)
135		if err != nil {	168		if err != nil {
136	-	return fmt.Errorf("failed to create env file: %w", err)	169	+	return fmt.Errorf("failed to create temp env file: %w", err)
137		}	170		}
138	-	defer func() {
139	-	if cerr := file.Close(); cerr != nil && err == nil {
140	-	err = fmt.Errorf("failed to close env file: %w", cerr)
141	-	}
142	-	}()
143			171
144		// Write header comment	172		// Write header comment
145		if _, err := fmt.Fprintf(file, "# Environment variables for %s\n", domain); err != nil {	173		if _, err := fmt.Fprintf(file, "# Environment variables for %s\n", domain); err != nil {
			174	+	file.Close()
			175	+	os.Remove(tmpFile)
146		return fmt.Errorf("failed to write header: %w", err)	176		return fmt.Errorf("failed to write header: %w", err)
147		}	177		}
148		if _, err := fmt.Fprintf(file, "# Managed by Gordon admin API\n\n"); err != nil {	178		if _, err := fmt.Fprintf(file, "# Managed by Gordon admin API\n\n"); err != nil {
			179	+	file.Close()
			180	+	os.Remove(tmpFile)
149		return fmt.Errorf("failed to write header: %w", err)	181		return fmt.Errorf("failed to write header: %w", err)
150		}	182		}
151			183
152		// Write each secret	184		// Write each secret
153		for key, value := range secrets {	185		for key, value := range secrets {
154		if _, err := fmt.Fprintf(file, "%s=%s\n", key, value); err != nil {	186		if _, err := fmt.Fprintf(file, "%s=%s\n", key, value); err != nil {
			187	+	file.Close()
			188	+	os.Remove(tmpFile)
155		return fmt.Errorf("failed to write secret %s: %w", key, err)	189		return fmt.Errorf("failed to write secret %s: %w", key, err)
156		}	190		}
157		}	191		}
158			192
			193	+	// Sync to ensure data is on disk before rename
			194	+	if err := file.Sync(); err != nil {
			195	+	file.Close()
			196	+	os.Remove(tmpFile)
			197	+	return fmt.Errorf("failed to sync env file: %w", err)
			198	+	}
			199	+
			200	+	if err := file.Close(); err != nil {
			201	+	os.Remove(tmpFile)
			202	+	return fmt.Errorf("failed to close env file: %w", err)
			203	+	}
			204	+
			205	+	// Atomic rename
			206	+	if err := os.Rename(tmpFile, envFile); err != nil {
			207	+	os.Remove(tmpFile)
			208	+	return fmt.Errorf("failed to rename env file: %w", err)
			209	+	}
			210	+
159		return nil	211		return nil
160		}	212		}

M internal/app/run.go +5 -1


@@ -29,6 +29,8 @@ import (
29	29		"gordon/internal/adapters/out/secrets"
30	30		"gordon/internal/adapters/out/tokenstore"
31	31
	32	+	"golang.org/x/time/rate"
	33	+
32	34		// Adapters - Input
33	35		"gordon/internal/adapters/in/http/admin"
34	36		"gordon/internal/adapters/in/http/middleware"

@@ -800,7 +802,9 @@ func createHTTPHandlers(svc *services, cfg Config, log zerowrap.Logger) (http.Ha
800	802		}
801	803		// Add admin auth middleware if auth is enabled
802	804		if svc.authSvc != nil {
803		-	adminMiddlewares = append(adminMiddlewares, admin.AuthMiddleware(svc.authSvc, log))
	805	+	// Rate limiter for admin API: 10 req/s with burst of 20
	806	+	adminLimiter := rate.NewLimiter(rate.Limit(10), 20)
	807	+	adminMiddlewares = append(adminMiddlewares, admin.AuthMiddleware(svc.authSvc, adminLimiter, log))
804	808		}
805	809		adminWithMiddleware := middleware.Chain(adminMiddlewares...)(svc.adminHandler)
806	810		registryMux.Handle("/admin/", adminWithMiddleware)

 	"gordon/internal/adapters/out/secrets"
 	"gordon/internal/adapters/out/tokenstore"
+	"golang.org/x/time/rate"
 	// Adapters - Input
 	"gordon/internal/adapters/in/http/admin"
 	"gordon/internal/adapters/in/http/middleware"
 		}
 		// Add admin auth middleware if auth is enabled
 		if svc.authSvc != nil {
-			adminMiddlewares = append(adminMiddlewares, admin.AuthMiddleware(svc.authSvc, log))
+			// Rate limiter for admin API: 10 req/s with burst of 20
+			adminLimiter := rate.NewLimiter(rate.Limit(10), 20)
+			adminMiddlewares = append(adminMiddlewares, admin.AuthMiddleware(svc.authSvc, adminLimiter, log))
 		}
 		adminWithMiddleware := middleware.Chain(adminMiddlewares...)(svc.adminHandler)
 		registryMux.Handle("/admin/", adminWithMiddleware)

M internal/usecase/health/service.go +8 -1


@@ -12,6 +12,9 @@ import (
12	12		"gordon/internal/domain"
13	13		)
14	14
	15	+	// maxConcurrentProbes limits the number of concurrent health probes to prevent resource exhaustion.
	16	+	const maxConcurrentProbes = 10
	17	+
15	18		// Service implements the HealthService interface.
16	19		type Service struct {
17	20		configSvc in.ConfigService

@@ -105,14 +108,18 @@ func (s Service) CheckAllRoutes(ctx context.Context) map[string]domain.RouteHe
105	108		return results
106	109		}
107	110
108		-	// Check routes concurrently
	111	+	// Check routes concurrently with semaphore to limit resource usage
109	112		var mu sync.Mutex
110	113		var wg sync.WaitGroup
	114	+	sem := make(chan struct{}, maxConcurrentProbes)
111	115
112	116		for _, route := range routes {
113	117		wg.Add(1)
114	118		go func(r domain.Route) {
115	119		defer wg.Done()
	120	+	sem <- struct{}{} // Acquire semaphore
	121	+	defer func() { <-sem }() // Release semaphore
	122	+
116	123		health := s.CheckRoute(ctx, r)
117	124		mu.Lock()
118	125		results[r.Domain] = health

 	"gordon/internal/domain"
 )
+// maxConcurrentProbes limits the number of concurrent health probes to prevent resource exhaustion.
+const maxConcurrentProbes = 10
 // Service implements the HealthService interface.
 type Service struct {
 	configSvc    in.ConfigService
 		return results
 	}
-	// Check routes concurrently
+	// Check routes concurrently with semaphore to limit resource usage
 	var mu sync.Mutex
 	var wg sync.WaitGroup
+	sem := make(chan struct{}, maxConcurrentProbes)
 	for _, route := range routes {
 		wg.Add(1)
 		go func(r domain.Route) {
 			defer wg.Done()
+			sem <- struct{}{}        // Acquire semaphore
+			defer func() { <-sem }() // Release semaphore
 			health := s.CheckRoute(ctx, r)
 			mu.Lock()
 			results[r.Domain] = health