Skip to content

F
finwise-miniapp-be
Merged
Opened by ThinhNC@ThinhNC
Report abuse

feat(be): implement admin control center, api key auth, webhooks, and ssrf protection

Features & Enhancements

  • Admin AI Assistant Management:
    • Added feature toggles (chat, insights, categorizer, forecasting, query).
    • Added prompt template management, rate limit dynamic overrides, cache invalidation, and request audit logging.
  • Admin Notification Engine & Broadcasts:
    • Added multi-channel broadcasting (IN_APP, EMAIL, TELEGRAM) with variable interpolation.
    • Implemented template CRUD, delivery status tracking, and manual retry for failed deliveries.
  • System Settings & Maintenance Mode:
    • Implemented global maintenance mode with configurable bypass for admin roles and whitelisted IPs.
    • Added /api/v1/system/public-config and cache purge capabilities.
  • API Keys & Webhooks Infrastructure:
    • Added secure SHA-256 hashed API Key authentication with granular scopes, rate limiting, and IP whitelisting.
    • Implemented HMAC-SHA256 signature verification (X-Finwise-Signature, X-Finwise-Timestamp) for Webhook delivery with exponential backoff & jitter.
  • Security & SSRF Hardening:
    • Added safeFetch, DNS rebinding validation (validateUrlAsync), and comprehensive IPv4/IPv6 private CIDR checks.
    • Hardened /api/v1/health to prevent internal infrastructure disclosure.
    • Added AES-256-GCM secret encryption helper (crypto.helper.ts).