70 lines
3.9 KiB
Bash
70 lines
3.9 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Deployment-skript: Säkerhetshårdning av aamos-ledger
|
||
|
|
# Kör med: sudo bash /home/bernt/.openclaw/workspace/aamos-ledger/deploy-security-fixes.sh
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
echo "=== AAMOS Ledger Security Deployment ==="
|
||
|
|
|
||
|
|
# ── Backup ───────────────────────────────────────────────────────────────────
|
||
|
|
BACKUP_DIR="/opt/amos/services/aamos-ledger/.backup-$(date +%s)"
|
||
|
|
mkdir -p "$BACKUP_DIR"
|
||
|
|
cp /opt/amos/services/aamos-ledger/index.mjs "$BACKUP_DIR/"
|
||
|
|
cp /opt/amos/services/aamos-ledger/auth.mjs "$BACKUP_DIR/"
|
||
|
|
echo "✅ Backup skapad: $BACKUP_DIR"
|
||
|
|
|
||
|
|
# ── Kopiera nya filer ────────────────────────────────────────────────────────
|
||
|
|
cp /home/bernt/.openclaw/workspace/aamos-ledger/.env.example /opt/amos/services/aamos-ledger/.env.example
|
||
|
|
cp /home/bernt/.openclaw/workspace/aamos-ledger/SECURITY.md /opt/amos/services/aamos-ledger/SECURITY.md
|
||
|
|
echo "✅ .env.example och SECURITY.md kopierade"
|
||
|
|
|
||
|
|
# ── Uppdatera index.mjs med requireRole ──────────────────────────────────────
|
||
|
|
# Lägg till import av requireRole och ROLES
|
||
|
|
sed -i "s/import { authMiddleware } from '.\/auth.mjs';/import { authMiddleware, requireRole, ROLES } from '.\/auth.mjs';/" /opt/amos/services/aamos-ledger/index.mjs
|
||
|
|
|
||
|
|
# Lägg till requireRole på muterande endpoints
|
||
|
|
# POST /api/ledger/accounts
|
||
|
|
sed -i "/app.post('\/api\/ledger\/accounts', async (req, res) => {/c\
|
||
|
|
app.post('\/api\/ledger\/accounts', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs
|
||
|
|
|
||
|
|
# POST /api/ledger/journal
|
||
|
|
sed -i "/app.post('\/api\/ledger\/journal', async (req, res) => {/c\
|
||
|
|
app.post('\/api\/ledger\/journal', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs
|
||
|
|
|
||
|
|
# POST /api/ledger/journal/:id/post
|
||
|
|
sed -i "/app.post('\/api\/ledger\/journal\/:id\/post', async (req, res) => {/c\
|
||
|
|
app.post('\/api\/ledger\/journal\/:id\/post', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs
|
||
|
|
|
||
|
|
# POST /api/ledger/journal/:id/void
|
||
|
|
sed -i "/app.post('\/api\/ledger\/journal\/:id\/void', async (req, res) => {/c\
|
||
|
|
app.post('\/api\/ledger\/journal\/:id\/void', requireRole(ROLES.ADMIN), async (req, res) => {" /opt/amos/services/aamos-ledger/index.mjs
|
||
|
|
|
||
|
|
echo "✅ requireRole() tillagt på muterande endpoints"
|
||
|
|
|
||
|
|
# ── Verifiera att filen är giltig JavaScript ─────────────────────────────────
|
||
|
|
cd /opt/amos/services/aamos-ledger
|
||
|
|
node --check index.mjs 2>/dev/null || {
|
||
|
|
echo "❌ Syntax error i index.mjs — återställer backup"
|
||
|
|
cp "$BACKUP_DIR/index.mjs" index.mjs
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
echo "✅ Syntax check OK"
|
||
|
|
|
||
|
|
# ── Starta om tjänsten ───────────────────────────────────────────────────────
|
||
|
|
systemctl restart aamos-ledger
|
||
|
|
sleep 2
|
||
|
|
systemctl is-active aamos-ledger && echo "✅ aamos-ledger aktiv" || {
|
||
|
|
echo "❌ aamos-ledger startade inte — återställer backup"
|
||
|
|
cp "$BACKUP_DIR/index.mjs" index.mjs
|
||
|
|
systemctl restart aamos-ledger
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
# ── Health check ─────────────────────────────────────────────────────────────
|
||
|
|
curl -s http://localhost:3250/health | grep -q '"ok":true' && echo "✅ Health check OK" || echo "⚠️ Health check misslyckades"
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
echo "=== Deployment klar ==="
|
||
|
|
echo "Backup: $BACKUP_DIR"
|
||
|
|
echo "För att återställa: sudo cp $BACKUP_DIR/* /opt/amos/services/aamos-ledger/"
|