security: v1.7.7 hardening release

- Add WEBHOOK_CLIENT_SECRET validation for Graph webhooks
- Add Redis-backed rate limiting (fetch/ask/write/default tiers)
- Validate LLM_BASE_URL to prevent SSRF (HTTPS only, block private IPs)
- Enforce non-wildcard CORS when AUTH_ENABLED=true
- Add Content-Security-Policy headers
- Fix audit middleware to use verified JWT claims via contextvars
- Cap bulk_tags updates to 10,000 documents
- Return generic error messages to clients (no internal detail leakage)
- Strict AlertCondition Pydantic model for alert rules
- Security warning on MCP stdio server startup
- Remove MongoDB/Redis host ports from docker-compose
- Remove mongo_query from /ask API response

backend/routes/ask.py

@@ -397,8 +397,31 @@ def _format_events_for_llm(
     return "\n".join(lines)
 
 
+def _validate_llm_url(url: str):
+    """Prevent SSRF by rejecting internal/reserved addresses."""
+    from urllib.parse import urlparse
+
+    parsed = urlparse(url)
+    if parsed.scheme != "https":
+        raise RuntimeError("LLM_BASE_URL must use HTTPS")
+    hostname = (parsed.hostname or "").lower()
+    if not hostname:
+        raise RuntimeError("LLM_BASE_URL must have a valid hostname")
+    blocked = {"localhost", "127.0.0.1", "0.0.0.0", "::1", "169.254.169.254"}
+    if hostname in blocked:
+        raise RuntimeError(f"LLM_BASE_URL hostname '{hostname}' is not allowed")
+    # Block link-local and private IP ranges
+    import ipaddress
+
+    try:
+        ip = ipaddress.ip_address(hostname)
+        if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+            raise RuntimeError(f"LLM_BASE_URL IP '{hostname}' is not allowed")
+    except ValueError:
+        pass  # hostname is not an IP, which is fine
+
+
 def _build_chat_url(base_url: str, api_version: str) -> str:
-    """Construct the chat completions URL, handling Azure OpenAI endpoints."""
     base = base_url.rstrip("/")
     url = base if base.endswith("/chat/completions") else f"{base}/chat/completions"
     if api_version:
@@ -424,6 +447,9 @@ async def _call_llm(
         },
     ]
 
+    # SSRF guard: only allow known public HTTPS endpoints
+    _validate_llm_url(LLM_BASE_URL)
+
     url = _build_chat_url(LLM_BASE_URL, LLM_API_VERSION)
     headers = {
         "Content-Type": "application/json",
@@ -570,6 +596,8 @@ async def _explain_event(event: dict, related: list[dict]) -> str:
         },
     ]
 
+    _validate_llm_url(LLM_BASE_URL)
+
     url = _build_chat_url(LLM_BASE_URL, LLM_API_VERSION)
     headers = {"Content-Type": "application/json"}
     if "azure" in LLM_BASE_URL.lower() or "cognitiveservices" in LLM_BASE_URL.lower():
@@ -731,7 +759,7 @@ async def ask_question(body: AskRequest, user: dict = Depends(require_auth)):
         raw_events = list(cursor)
     except Exception as exc:
         logger.error("Failed to query events for ask", error=str(exc))
-        raise HTTPException(status_code=500, detail=f"Database query failed: {exc}") from exc
+        raise HTTPException(status_code=500, detail="Database query failed") from exc
 
     for e in raw_events:
         e["_id"] = str(e.get("_id", ""))
@@ -803,7 +831,6 @@ async def ask_question(body: AskRequest, user: dict = Depends(require_auth)):
                     "total_matched": total,
                     "services_queried": query_services,
                     "excluded_services": excluded_services,
-                    "mongo_query": json.dumps(query, default=str),
                 },
                 llm_used=False,
                 llm_error=None,
@@ -863,7 +890,6 @@ async def ask_question(body: AskRequest, user: dict = Depends(require_auth)):
             "total_matched": total,
             "services_queried": query_services,
             "excluded_services": excluded_services,
-            "mongo_query": json.dumps(query, default=str),
         },
         llm_used=llm_used,
         llm_error=llm_error,

backend/routes/events.py

@@ -158,7 +158,7 @@ def list_events(
         cursor_query = events_collection.find(query).sort([("timestamp", -1), ("_id", -1)]).limit(safe_page_size)
         events = list(cursor_query)
     except Exception as exc:
-        raise HTTPException(status_code=500, detail=f"Failed to query events: {exc}") from exc
+        raise HTTPException(status_code=500, detail="Failed to query events") from exc
 
     next_cursor = None
     if len(events) == safe_page_size:
@@ -241,9 +241,17 @@ def bulk_tags(
     update = {"$set": {"tags": tags}} if body.mode == "replace" else {"$addToSet": {"tags": {"$each": tags}}}
 
     try:
+        matched = events_collection.count_documents(query, limit=10001)
+        if matched > 10000:
+            raise HTTPException(
+                status_code=400,
+                detail="Bulk tag update matches too many events (>10000). Narrow your filters.",
+            )
         result_obj = events_collection.update_many(query, update)
+    except HTTPException:
+        raise
     except Exception as exc:
-        raise HTTPException(status_code=500, detail=f"Failed to update tags: {exc}") from exc
+        raise HTTPException(status_code=500, detail="Failed to update tags") from exc
 
     log_action(
         "bulk_tags",
@@ -268,7 +276,7 @@ def filter_options(
         actor_upns = sorted([a for a in events_collection.distinct("actor_upn") if a])[:safe_limit]
         devices = sorted([a for a in events_collection.distinct("target_displays") if isinstance(a, str)])[:safe_limit]
     except Exception as exc:
-        raise HTTPException(status_code=500, detail=f"Failed to load filter options: {exc}") from exc
+        raise HTTPException(status_code=500, detail="Failed to load filter options") from exc
 
     if not user_can_access_privacy_services(user):
         services = [s for s in services if s not in PRIVACY_SERVICES]

backend/routes/fetch.py

@@ -1,5 +1,6 @@
 import time
 
+import structlog
 from audit_trail import log_action
 from auth import require_auth
 from config import ALERTS_ENABLED
@@ -15,6 +16,8 @@ from sources.intune_audit import fetch_intune_audit
 from sources.unified_audit import fetch_unified_audit
 from watermark import get_watermark, set_watermark
 
+logger = structlog.get_logger("aoc.fetch")
+
 router = APIRouter(dependencies=[Depends(require_auth)])
 
 
@@ -85,5 +88,8 @@ def fetch_logs(
             user.get("sub", "anonymous"),
         )
         return result
+    except HTTPException:
+        raise
     except Exception as exc:
-        raise HTTPException(status_code=502, detail=str(exc)) from exc
+        logger.error("Fetch failed", error=str(exc))
+        raise HTTPException(status_code=502, detail="Failed to fetch audit logs") from exc

backend/routes/webhooks.py

@@ -1,4 +1,5 @@
 import structlog
+from config import WEBHOOK_CLIENT_SECRET
 from fastapi import APIRouter, Request, Response
 
 router = APIRouter()
@@ -10,9 +11,12 @@ async def graph_webhook(request: Request):
     """
     Receive Microsoft Graph change notifications.
     Handles the validation handshake by echoing validationToken.
+    Validates clientState on notifications to prevent spoofing.
     """
     validation_token = request.query_params.get("validationToken")
     if validation_token:
+        # Microsoft sends validationToken as a query param during subscription creation.
+        # Echo it back as plain text to prove endpoint ownership.
         return Response(content=validation_token, media_type="text/plain")
 
     try:
@@ -21,12 +25,26 @@ async def graph_webhook(request: Request):
         logger.warning("Invalid webhook payload", error=str(exc))
         return Response(status_code=400)
 
-    for notification in body.get("value", []):
+    notifications = body.get("value", [])
+    if not isinstance(notifications, list):
+        logger.warning("Invalid webhook payload structure")
+        return Response(status_code=400)
+
+    for notification in notifications:
+        client_state = notification.get("clientState")
+        if WEBHOOK_CLIENT_SECRET and client_state != WEBHOOK_CLIENT_SECRET:
+            logger.warning(
+                "Graph webhook rejected: invalid clientState",
+                change_type=notification.get("changeType"),
+                resource=notification.get("resource"),
+            )
+            return Response(status_code=401)
+
         logger.info(
             "Received Graph notification",
             change_type=notification.get("changeType"),
             resource=notification.get("resource"),
-            client_state=notification.get("clientState"),
+            client_state=client_state,
         )
 
     return {"status": "accepted"}