Feat/1177 1178 1179 1180 security governance suite

[devmocrea]

Description

Implements four security, governance, and audit suites for Bridge Watch:

1. feat: Add Security Event Correlation View #1177 Security Event Correlation View: Correlates security events, auth anomalies, and rate limit spikes across services into unified, actionable alert views.
2. feat: Implement Webhook IP Allowlist Management #1178 Webhook IP Allowlist Management: Provides dynamic CIDR/IP allowlists for inbound webhooks and outbound delivery targets with an interactive IP evaluation sandbox.
3. feat: Build Signed Request Verification Middleware #1179 Signed Request Verification Middleware: Enforces HMAC-SHA256 request signature verification, key rotation lifecycle, timestamp clock skew validation, and audit logging.
4. feat: Add Sensitive Field Access Reports #1180 Sensitive Field Access Reports: Tracks and audits access to sensitive resource fields (secrets, private keys, PII) and compiles automated compliance access reports.

---

Technical Details

Database Migrations

• 20260829090000_security_event_correlation.ts: Created security_event_correlations and security_events tables.
• 20260829091000_webhook_ip_allowlist.ts: Created webhook_ip_allowlists table.
• 20260829092000_signed_request_verification.ts: Created request_signing_keys and signed_request_logs tables.
• 20260829093000_sensitive_field_access_reports.ts: Created sensitive_field_definitions, sensitive_field_access_logs, and sensitive_field_access_reports tables.

Backend Services & Fastify Middleware

• securityEventCorrelation.service.ts & securityEventCorrelation.routes.ts: Correlation view aggregation and event ingestion endpoints.
• webhookIpAllowlist.service.ts & webhookIpAllowlist.routes.ts: CIDR subnet matching engine and rule management.
• signedRequestVerification.service.ts, signedRequestVerification.middleware.ts & signedRequestVerification.routes.ts: HMAC signature verification hook, key lifecycle, and audit logs.
• sensitiveFieldAccess.service.ts & sensitiveFieldAccess.routes.ts: Sensitive field definition registry, access logger, and report generator.
• Registered all route modules in admin-routes.ts.

Frontend Admin UI Components

• SecurityEventCorrelation.tsx: Severity metrics, filterable correlation table, and drilldown viewer (/admin/security-correlations).
• WebhookIpAllowlist.tsx: Rule management table and interactive IP access simulator (/admin/webhook-ip-allowlist).
• SignedRequestVerification.tsx: Signing credentials table, HMAC calculation workbench, and verification log viewer (/admin/signed-requests).
• SensitiveFieldAccessReport.tsx: Tabbed view for field registry, real-time access logs, and compliance report generation (/admin/sensitive-field-reports).
• Integrated lazy-loaded routes in App.tsx and menu items in navigation.ts.

---

Testing & Verification

Vitest Unit Tests

Ran test suites for all 4 new services (21 unit tests passed):

• tests/services/securityEventCorrelation.service.test.ts (5 tests passed)
• tests/services/webhookIpAllowlist.service.test.ts (7 tests passed)
• tests/services/signedRequestVerification.service.test.ts (5 tests passed)
• tests/services/sensitiveFieldAccess.service.test.ts (4 tests passed)

Build Checks

• Backend compilation: npm --prefix backend run build (Clean build into dist/)
• Frontend type check: npm --prefix frontend run type-check (Zero TypeScript errors)

---

Closes #1177
Closes #1178
Closes #1179
Closes #1180

[drips-wave]

@devmocrea Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits