Merge From Dev

.claude/README_AUDIT.md

@@ -0,0 +1,141 @@
+# Claude Code Audit System
+
+## Overview
+This audit system automatically monitors and logs all file modifications made by Claude Code, providing security scanning, code quality checks, and compliance tracking.
+
+## Components
+
+### 1. Global Audit Script
+**Location**: `~/.claude/audit_agent.sh`
+
+This script runs after every file modification and:
+- Logs all file changes with timestamps
+- Scans for sensitive data (API keys, passwords, tokens)
+- Checks code quality issues (debug statements, TODOs)
+- Runs project-specific linting when available
+- Creates both text and JSON audit logs
+
+### 2. Global Settings
+**Location**: `~/.claude/settings.json`
+
+Configures hooks that trigger the audit system:
+- `PostToolUse` hooks run after Write/Edit operations
+- `PreToolUse` hooks log the start of modifications
+- Audit logs stored in `~/.claude/audit_logs/`
+
+### 3. Project Settings
+**Location**: `.claude/settings.json`
+
+Project-specific configuration for:
+- Python linting with ruff
+- Test file tracking
+- Pre-commit test execution
+- Custom notifications for sensitive data
+
+### 4. Audit Configuration
+**Location**: `.claude/audit_config.json`
+
+Defines audit rules and patterns:
+- Security patterns (API keys, passwords, SQL injection)
+- Code quality checks (debug statements, TODOs)
+- File rules (size limits, forbidden files)
+- Project-specific requirements
+
+## Audit Log Locations
+
+- **Main log**: `~/.claude/audit_logs/audit_YYYYMMDD.log`
+- **JSON log**: `~/.claude/audit_logs/audit_YYYYMMDD.json`
+- **Activity log**: `~/.claude/audit_logs/activity.log`
+- **Test changes**: `~/.claude/audit_logs/test_changes.log`
+
+## Features
+
+### Security Scanning
+- Detects hardcoded credentials
+- Identifies potential SQL injection vulnerabilities
+- Warns about dangerous functions (eval, exec)
+- Blocks commits with critical security issues
+
+### Code Quality
+- Identifies debug print statements
+- Finds TODO/FIXME comments
+- Detects console.log statements in JavaScript
+- Runs project linters automatically
+
+### Compliance Tracking
+- Maintains audit trail of all modifications
+- Tracks who modified what and when
+- Generates daily summary reports
+- Preserves git diff information
+
+## Testing the System
+
+To test if the audit system is working:
+
+```bash
+# Test the audit script directly
+~/.claude/audit_agent.sh "Test" "/path/to/file.py"
+
+# Check recent audit logs
+cat ~/.claude/audit_logs/audit_$(date +%Y%m%d).log
+
+# View JSON audit entries
+cat ~/.claude/audit_logs/audit_$(date +%Y%m%d).json | jq '.'
+```
+
+## Notifications
+
+The system can send notifications for:
+- Critical security issues (macOS notifications)
+- Test failures (console warnings)
+- Linting errors (based on configuration)
+
+## Customization
+
+### Adding New Security Patterns
+Edit `.claude/audit_config.json` and add patterns to the `security.patterns` array.
+
+### Modifying Code Quality Checks
+Update the `codeQuality.checks` section in the audit configuration.
+
+### Project-Specific Rules
+Add project-specific rules in the `projectSpecific` section of the audit config.
+
+## Troubleshooting
+
+### Audit Not Running
+1. Check if the script is executable: `chmod +x ~/.claude/audit_agent.sh`
+2. Verify hooks in settings.json are properly configured
+3. Check for syntax errors in JSON configuration files
+
+### Missing Logs
+1. Ensure audit_logs directory exists: `mkdir -p ~/.claude/audit_logs`
+2. Check file permissions on the audit script
+3. Review Claude Code's hook execution logs
+
+### False Positives
+1. Adjust patterns in audit_config.json
+2. Use `continueOnError: true` for non-critical checks
+3. Customize severity levels for different rule types
+
+## Maintenance
+
+### Log Rotation
+Logs are automatically organized by date. To clean old logs:
+```bash
+find ~/.claude/audit_logs -name "*.log" -mtime +30 -delete
+```
+
+### Updating Rules
+When updating audit rules:
+1. Test new patterns with sample files first
+2. Monitor for false positives
+3. Adjust severity levels as needed
+
+## Integration with CI/CD
+
+The audit system can be integrated with CI/CD pipelines:
+1. Export audit logs to a central location
+2. Parse JSON logs for automated reporting
+3. Fail builds on critical security issues
+4. Generate compliance reports from audit data

.env.authnz.template

@@ -0,0 +1,160 @@
+# ================================================
+# AuthNZ Module Environment Configuration Template
+# ================================================
+# Copy this file to .env and configure for your deployment
+# SECURITY WARNING: Never commit the actual .env file to version control!
+
+# ================================================
+# AUTHENTICATION MODE
+# ================================================
+# Options: single_user, multi_user
+AUTH_MODE=multi_user
+
+# ================================================
+# DATABASE CONFIGURATION
+# ================================================
+# For PostgreSQL (recommended for multi-user production):
+# DATABASE_URL=postgresql://username:password@localhost:5432/tldw_db
+
+# For SQLite (development or single-user):
+DATABASE_URL=sqlite:///./Databases/users.db
+
+# Database connection pool settings
+DATABASE_POOL_MIN_SIZE=5
+DATABASE_POOL_MAX_SIZE=20
+DATABASE_MAX_QUERIES=50000
+DATABASE_MAX_INACTIVE_CONNECTION_LIFETIME=300
+
+# ================================================
+# JWT CONFIGURATION (Multi-User Mode)
+# ================================================
+# REQUIRED: Generate a secure random key (minimum 32 characters)
+# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
+JWT_SECRET_KEY=CHANGE_ME_TO_SECURE_RANDOM_KEY_MIN_32_CHARS
+
+# Token expiration times
+ACCESS_TOKEN_EXPIRE_MINUTES=30
+REFRESH_TOKEN_EXPIRE_DAYS=7
+JWT_ALGORITHM=HS256
+
+# ================================================
+# SINGLE-USER MODE CONFIGURATION
+# ================================================
+# API key for single-user mode (auto-generated if not set)
+# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
+SINGLE_USER_API_KEY=CHANGE_ME_TO_SECURE_API_KEY
+
+# ================================================
+# ENCRYPTION KEYS
+# ================================================
+# Session token encryption key (auto-generated from JWT secret if not set)
+# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+SESSION_ENCRYPTION_KEY=
+
+# API key pepper for additional hashing security (optional but recommended)
+# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
+API_KEY_PEPPER=
+
+# ================================================
+# REDIS CONFIGURATION (Optional)
+# ================================================
+# Redis for session caching and rate limiting (improves performance)
+# REDIS_URL=redis://localhost:6379/0
+# REDIS_MAX_CONNECTIONS=50
+
+# ================================================
+# SECURITY SETTINGS
+# ================================================
+# Registration settings
+ENABLE_REGISTRATION=false
+REQUIRE_REGISTRATION_CODE=true
+REGISTRATION_CODE_DEFAULT_EXPIRY_DAYS=7
+REGISTRATION_CODE_DEFAULT_MAX_USES=1
+
+# Password requirements
+PASSWORD_MIN_LENGTH=10
+ARGON2_MEMORY_COST=32768
+ARGON2_TIME_COST=2
+ARGON2_PARALLELISM=1
+
+# Login security
+MAX_LOGIN_ATTEMPTS=5
+LOCKOUT_DURATION_MINUTES=15
+
+# Rate limiting
+RATE_LIMIT_ENABLED=true
+RATE_LIMIT_PER_MINUTE=60
+RATE_LIMIT_BURST=10
+SERVICE_ACCOUNT_RATE_LIMIT=1000
+
+# Session security
+SESSION_COOKIE_SECURE=true
+SESSION_COOKIE_HTTPONLY=true
+SESSION_COOKIE_SAMESITE=lax
+SESSION_CLEANUP_INTERVAL_HOURS=1
+
+# ================================================
+# STORAGE SETTINGS
+# ================================================
+# User data paths
+USER_DATA_BASE_PATH=./user_databases
+CHROMADB_BASE_PATH=./chromadb_data
+
+# Default user quotas
+DEFAULT_STORAGE_QUOTA_MB=5120
+DEFAULT_USER_ROLE=user
+
+# ================================================
+# MONITORING & LOGGING
+# ================================================
+# Health checks and metrics
+ENABLE_HEALTH_CHECK=true
+ENABLE_METRICS=true
+METRICS_PORT=9090
+
+# Data retention policies
+AUDIT_LOG_RETENTION_DAYS=180
+PASSWORD_HISTORY_RETENTION_COUNT=5
+SESSION_LOG_RETENTION_DAYS=90
+
+# ================================================
+# DEVELOPMENT SETTINGS
+# ================================================
+# WARNING: Only enable these in development!
+# ALLOW_JWT_SECRET_FILE=false  # Never enable in production
+# DEBUG_MODE=false              # Verbose logging
+
+# ================================================
+# PRODUCTION CHECKLIST
+# ================================================
+# Before deploying to production, ensure:
+# [ ] All CHANGE_ME values have been replaced with secure values
+# [ ] JWT_SECRET_KEY is at least 32 characters of random data
+# [ ] SINGLE_USER_API_KEY is set (for single-user mode)
+# [ ] DATABASE_URL points to production database
+# [ ] SESSION_COOKIE_SECURE=true (requires HTTPS)
+# [ ] ENABLE_REGISTRATION is set appropriately
+# [ ] Redis is configured for better performance (optional)
+# [ ] This file is NOT committed to version control
+# [ ] Backup strategy is in place for databases
+# [ ] Monitoring and alerting are configured
+
+# ================================================
+# QUICK START COMMANDS
+# ================================================
+# 1. Copy this template:
+#    cp .env.authnz.template .env
+#
+# 2. Generate secure keys:
+#    python -c "import secrets; print('JWT_SECRET_KEY=' + secrets.token_urlsafe(32))"
+#    python -c "import secrets; print('SINGLE_USER_API_KEY=' + secrets.token_urlsafe(32))"
+#    python -c "from cryptography.fernet import Fernet; print('SESSION_ENCRYPTION_KEY=' + Fernet.generate_key().decode())"
+#
+# 3. Run database migrations:
+#    python -m tldw_Server_API.app.core.AuthNZ.run_migrations
+#
+# 4. Initialize AuthNZ:
+#    python -m tldw_Server_API.app.core.AuthNZ.initialize
+#
+# 5. Start the application:
+#    python -m uvicorn tldw_Server_API.app.main:app --reload

.env.backup

@@ -0,0 +1,24 @@
+# Database Configuration
+AUTH_MODE=multi_user
+DATABASE_URL=postgresql://tldw_user:TestPassword123!@localhost/tldw_multiuser
+
+# JWT Configuration  
+JWT_SECRET_KEY=test-secret-key-for-testing-only-change-in-production
+JWT_ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+REFRESH_TOKEN_EXPIRE_DAYS=30
+
+# Registration Settings
+ENABLE_REGISTRATION=true
+REQUIRE_REGISTRATION_CODE=false
+DEFAULT_USER_ROLE=user
+DEFAULT_STORAGE_QUOTA_MB=5120
+
+# Rate Limiting (disabled for testing)
+RATE_LIMIT_ENABLED=false
+AUTH_RATE_LIMIT=5/minute
+API_RATE_LIMIT=100/minute
+
+# CORS
+ALLOWED_ORIGINS=http://localhost:3000,http://localhost:8000
+CORS_ALLOW_CREDENTIALS=true

.env.test

@@ -0,0 +1,3 @@
+# Test environment configuration
+AUTH_MODE=single_user
+SINGLE_USER_API_KEY=test-api-key-12345

.github/ISSUE_TEMPLATE/bug-report-i-found-a-bug-in-tldw-.md

@@ -0,0 +1,39 @@
+---
+name: Bug report(I found a bug in tldw)
+about: Please file a report so I can fix it! (Thank you!)
+title: ''
+labels: bug
+assignees: rmusser01
+
+---
+
+**Are You on the Latest version?**
+You did a git pull and are running the latest version/build?
+Y/N
+
+**Please describe the bug**
+A clear and concise description of what the bug is and how you found it.
+
+**Is the bug reproducable reliably?**
+Yes / No
+
+**Steps to to reproduce the issue**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**What was the expected behavior?**
+A clear and concise description of what you expected to happen, if there was no bug.
+
+**Screenshots**
+If applicable, please add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [Linux/MacOS/Windows]
+ - Browser [Chrome/Firefox/Safari]
+ - Date you performed the last git pull: 
+
+**Any Additional context**
+Please add any other context about the problem here. Thank you!

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.