2 commits

Author	SHA1	Message	Date
Adam Moussa	091c5fcb44	Fix Phase 1 security and data integrity audit findings (#49) ... BLOCK-01: Add API Gateway JWT authorizer with Cognito, route internal Lambda calls through Function URL to bypass gateway auth BLOCK-02/03: Prevent proposal number race condition with pg_advisory_xact_lock and filter revision numbers from max-number query BLOCK-04: Restrict VendorProposals and GeneratedPdfs to admins/sysadmins BLOCK-05: Sum all vendor costs instead of overwriting with single vendor BLOCK-06: Enable ValidateAudience on JWT, add Auth env vars to API Lambda BLOCK-07: Validate ID token signature in AuthController via OIDC discovery BLOCK-08: Use batchItemFailures in all Lambda SQS handlers BLOCK-09: Increase SQS visibility timeout from 180s to 720s FIX-10: Scope dispatcher queries to own proposals (IDOR fix)	2026-05-20 18:51:31 -04:00
Adam Moussa	0b055b3ad9	Initial scaffold: monorepo structure, CDK stacks, CI/CD, domain model ... Phase 0 of proposal-system: complete project setup including: - CDK infrastructure (3 stacks: foundation, compute, frontend) - .NET 8 solution with Clean Architecture (Domain, Application, Infrastructure, Api) - EF Core data model (PostgreSQL) with all entities - Python Lambda placeholders (pdf-extract, pdf-generate, library-ingest) - React 19 web frontend scaffold (Vite + MUI) - React Native mobile placeholder - Shared TypeScript API contracts - GitHub Actions CI/CD (ci.yaml + deploy.yaml) - OIDC deploy role (githubdeploy-proposal-system) - Dependabot configuration - Cognito User Pool with Google OAuth, PKCE clients, groups	2026-05-16 18:40:46 -04:00