release 3.0.0: test-DB migrations, ruff baseline, typed electronAPI, /health enrichments, multi-worker rate-limit backend, pydantic 3.13 pins, CSRF invariant comment, README + CHANGELOG

Addresses the 3.0 follow-up items on top of the phase 1-6 hardening pass:

- backend/tests now run Alembic `upgrade head` against the in-memory DB, so
  future migrations (like the Phase 4 CHECKs and the Phase 6 index) are
  exercised every pytest run instead of bypassed via create_all.
- ruff baseline added via backend/pyproject.toml; CI's new lint step is
  clean and pytest still green (182 passed, 8 skipped).
- frontend/src/types/electron.d.ts types window.electronAPI; LicenseContext
  drops every `any` cast and TS strict mode stays green.
- /health returns git_sha + started_at alongside version so oncall can map
  an incident to a specific deploy.
- rate_limit.py honours RATELIMIT_STORAGE_URI and logs a loud warning when
  run with WORKERS>1 without a shared backend.
- requirements.txt / requirements-test.txt: pydantic >=2.10, sqlalchemy
  >=2.0.32 etc — Python 3.13 contributors no longer need a Rust toolchain.
- auth.py top-of-module comment documents the CSRF-safety invariant (auth
  state lives in the Authorization header, never a cookie).
- VERSION bumped to 3.0.0 across the three SSOT constants files, both
  package.json, both package-lock.json. README banner + "What's new" block
  added; CHANGELOG 3.0.0 entry with upgrade notes.

Author: Egyan07

CHANGELOG.md

@@ -6,6 +6,140 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## [3.0.0] — 2026-04-22
+
+Major hardening release. Lifts the codebase rating from ~7.8 to ~9.0 by
+closing the long-tail of security, correctness, and scaling issues that
+would have caused incidents at SaaS scale. Contains breaking changes — see
+**Upgrade notes** below before deploying.
+
+### Added
+- **Filesystem-backed evidence uploads** — Manual uploads now write to
+  `EVIDENCE_STORAGE_PATH` (default `./storage`). The DB stores a path only,
+  not the bytes. New endpoint `GET /api/v1/evidence/items/{id}/download`
+  streams the file back with a path-traversal guard.
+- **HTTPS-ready nginx config** — `nginx.conf` ships HTTPS on port 443
+  (SSL certs via mounted `./ssl/`), HTTP → HTTPS redirect, HSTS, a locked-
+  down Content-Security-Policy, `Permissions-Policy`, and 404 responses for
+  `/docs`, `/redoc`, and `/openapi.json`. `nginx.dev.conf` +
+  `docker-compose.dev.yml` keep HTTP-only local dev frictionless.
+- **SSOT for cross-repo constants** — `backend/app/core/constants.py`,
+  `frontend/src/constants.ts`, and `electron/licensing/tier-constants.js`
+  all carry `VERSION`, `VALID_LICENSE_TIERS`, `VALID_COMPLIANCE_LEVELS`,
+  `MACHINE_LIMITS`, and `FEATURE_GATES` with cross-pointer headers.
+- **Enriched `/health`** — Now returns `git_sha` and `started_at` alongside
+  the version string, so oncall can map an incident to a specific deploy.
+- **`GET /api/v1/machines` pagination** — `?limit=` (default 50, max 200)
+  and `?offset=` query params.
+- **CHECK constraints** — `users.license_tier` locked to
+  `{free, pro, enterprise}` and `machines.compliance_level` locked to
+  `{NULL, compliant, at_risk, critical}` at the DB level.
+- **Rate limits on auth + credential endpoints** — `/forgot-password`
+  (3/min), `/reset-password` (5/min), and every AWS-credential endpoint
+  now carry slowapi limits.
+- **Domain-separated credential encryption key** — Fernet key derived from
+  `SECRET_KEY` via HKDF-SHA256 with label
+  `complianceguard:credential-encryption:v1`. Legacy SHA-256 derivation
+  retained as a read-only fallback so pre-3.0 rows still decrypt.
+- **Multi-worker rate-limit backend** — `RATELIMIT_STORAGE_URI` env var is
+  honoured (e.g. `redis://host:6379/0`). Starting under `WORKERS>1` without
+  a shared backend logs a WARNING.
+- **Ruff lint step in CI** — New `pyproject.toml` with the CI rule set;
+  `backend-tests` now runs `ruff check app` before pytest.
+- **Pip caching + release-job `build` dependency** — CI's release job was
+  able to ship even when the frontend build broke; it now waits on `build`.
+- **Alembic migrations `7a1c4f9b2d08` and `8b2e7c1d5a19`** — data-model
+  hardening (CHECKs, `Machine.updated_at`, nullable
+  `ComplianceFramework.company_id`) and index on
+  `evidence_collections.user_id`.
+
+### Changed — breaking
+- **Hardcoded docker-compose fallbacks removed.** `SECRET_KEY` and
+  `DB_PASSWORD` no longer have silent defaults. An unset value aborts the
+  stack at boot with a readable error. Existing deployments relying on the
+  published demo values will fail fast — set real values in `.env` before
+  upgrading.
+- **Manual evidence storage format changed.** Uploads are now written to
+  the filesystem; `data.content_base64` on `EvidenceItem` is gone. Any
+  automation that reached into that column must switch to the new
+  `GET /api/v1/evidence/items/{id}/download` endpoint. (If you have
+  existing base64 rows, write a one-time script to extract and rewrite
+  them — see `backend/app/api/evidence.py` for the new shape.)
+- **`GET /api/v1/machines` is paginated by default.** Old callers that
+  assumed an unbounded list now receive at most 50 machines. Pass
+  `?limit=200&offset=…` if you need more.
+- **Electron `cloudConnect` sends `application/x-www-form-urlencoded`.**
+  Fixes silent 422 on every sign-in in ≤2.9.0. No action required — this
+  was simply broken before.
+- **`fleet_stats` and `get_machines` no longer load the full machines
+  table into Python.** Same API shape; only the query plan changed.
+
+### Fixed
+- **Grace-period lockout.** `electron/licensing/license-crypto.js` now
+  returns `valid: true` during the 7-day renewal grace window. Paid
+  desktop users were previously kicked off on the day of expiry.
+- **`datetime.utcnow()` deprecation.** Replaced with
+  `datetime.now(timezone.utc)` in all production code.
+- **Module-load side effects on tests.** `run_migrations()` now runs from
+  the FastAPI lifespan handler, so importing `app.main` in tests does not
+  hit the DB.
+- **Unbounded in-memory eval cache.** `ComplianceService.evaluations` is
+  now a `collections.OrderedDict` capped at 100 entries (FIFO).
+- **Mutating a Pydantic v2 model post-construction.** `Settings`
+  environment overrides are now applied via `@model_validator(mode="after")`
+  instead of a module-level `setattr` loop.
+- **`SECRET_KEY` captured at module import.** JWT helpers now resolve the
+  key lazily, so pytest env-var overrides are honoured.
+- **`pydantic.v1.ConfigDict` import** in `config.py` removed; three
+  `class Config:` blocks migrated to `ConfigDict(...)`.
+- **Cloud-sync plaintext fallback.** `secure-storage.js` fallback path now
+  AES-256-GCM-encrypts values with a machine-derived key and logs a loud
+  warning, instead of storing plaintext. `decryptString` throws a
+  descriptive error on failure instead of returning an empty string.
+- **Windows evidence collection sequential loop.** Ten `exec` calls now
+  run concurrently via `Promise.allSettled`, each with a 30s default
+  timeout. Fixed a pre-existing `log` variable shadow in `collectEventLogs`.
+- **Web-mode license activation.** `LicenseContext.activateLicense` now
+  calls `POST /api/auth/activate-license` instead of returning
+  "Requires desktop app".
+- **Release CI gap.** `release` job now `needs: [..., build]`.
+
+### Security
+- **CSRF invariant documented.** `backend/app/api/auth.py` now carries a
+  top-of-file comment spelling out that auth state rides in the
+  `Authorization` header only — the API is CSRF-safe as long as no
+  cookie-based auth path is ever introduced without explicit CSRF
+  protection.
+
+### Upgrade notes
+1. Set `SECRET_KEY` and `DB_PASSWORD` in your `.env` (generate with
+   `openssl rand -hex 32` for the former). The stack will refuse to start
+   otherwise.
+2. Provide TLS certificates at `./ssl/cert.pem` and `./ssl/key.pem` for the
+   production `nginx` service, or run the dev stack via
+   `docker-compose -f docker-compose.yml -f docker-compose.dev.yml up`.
+3. If you run `uvicorn` with `WORKERS>1`, set
+   `RATELIMIT_STORAGE_URI=redis://…` — otherwise rate limits silently
+   multiply by worker count.
+4. Expose `GIT_SHA` (usually via CI) in your deploy env to get meaningful
+   `git_sha` values in `/health`.
+5. Run Alembic: `alembic upgrade head` applies `7a1c4f9b2d08` and
+   `8b2e7c1d5a19`. Existing rows whose `license_tier` is outside
+   `{free, pro, enterprise}` — or `compliance_level` outside
+   `{compliant, at_risk, critical}` — will fail the new CHECK. Fix the
+   data first.
+
+### Developer experience
+- Backend test DB now runs Alembic migrations (via `create_test_database`
+  → `alembic upgrade head`) instead of `Base.metadata.create_all`. New
+  migrations are exercised by every pytest run.
+- `requirements.txt` and `requirements-test.txt` ranges relaxed so Python
+  3.13 contributors don't need a Rust toolchain.
+- `frontend/src/types/electron.d.ts` replaces the `(window as any)` casts
+  in `LicenseContext` with a typed surface.
+
+---
+
 ## [2.9.0] — 2026-04-17
 
 ### Added

README.md

@@ -3,7 +3,7 @@
 </p>
 
 <p align="center">
-  <a href="#quick-start"><img src="https://img.shields.io/badge/version-2.9.0-2563EB" alt="Version"></a>
+  <a href="#quick-start"><img src="https://img.shields.io/badge/version-3.0.0-2563EB" alt="Version"></a>
   <img src="https://img.shields.io/badge/license-BSL%201.1-orange" alt="License">
   <a href="#soc-2-controls"><img src="https://img.shields.io/badge/SOC%202-29%20controls-10B981" alt="Controls"></a>
   <img src="https://img.shields.io/badge/tests-311%20passing-10B981?logo=vitest&logoColor=white" alt="Tests">
@@ -13,6 +13,42 @@
 
 ---
 
+### What's new in 3.0.0 — security & data hardening
+
+`3.0.0` is a breaking release focused on tightening the things that would
+have eventually caused outages or incidents at scale. Highlights:
+
+- **Deploys fail loudly on missing secrets.** `docker-compose.yml` no longer
+  falls back to the published demo SECRET_KEY or DB_PASSWORD; an unset value
+  aborts the stack at boot with a readable error.
+- **Filesystem-backed evidence uploads.** Manual uploads are stored under
+  `EVIDENCE_STORAGE_PATH` (default `./storage`) and referenced from the DB
+  by path — no more 100 MB base64 blobs in a JSON column. A new
+  `GET /api/v1/evidence/items/{id}/download` endpoint serves them back with
+  a path-traversal guard.
+- **Check constraints on enum columns.** `users.license_tier` and
+  `machines.compliance_level` are now CHECK-constrained at the DB layer, so
+  a bad value can no longer sneak in via a direct SQL write.
+- **Hardened nginx.** HTTPS block active, CSP / HSTS / Permissions-Policy
+  headers added, deprecated `X-XSS-Protection` removed, `/docs` and
+  `/openapi.json` return 404 publicly. A separate `nginx.dev.conf` and
+  `docker-compose.dev.yml` keep HTTP-only local dev frictionless.
+- **Rate limits extended.** `/forgot-password`, `/reset-password`, and every
+  AWS-credential endpoint now carry slowapi limits. Set
+  `RATELIMIT_STORAGE_URI=redis://…` when running with multiple workers —
+  the app logs a warning if you don't.
+- **Fleet stats is now a single query.** `/api/v1/machines/fleet-stats`
+  aggregates in SQL instead of loading every row into Python, and
+  `GET /api/v1/machines` is paginated (`?limit=…&offset=…`).
+- **Grace-period lockout fix.** Paid desktop users are no longer kicked off
+  during the 7-day renewal grace window.
+- **Credential encryption key is domain-separated** from the JWT signing key
+  via HKDF-SHA256 (with transparent fallback for legacy-encrypted rows).
+
+See [`CHANGELOG.md`](CHANGELOG.md) for the full list plus upgrade notes.
+
+---
+
 Compliance tools like Vanta, Drata, and Sprinto scan your cloud infrastructure. That's useful — but they can't see what's happening **on the machines themselves**. Password policies, firewall rules, event logs, running services, local user accounts — that evidence lives on the endpoint, not in AWS.
 
 ComplianceGuard lives on the endpoint too. It collects evidence directly from Windows, scores it against 29 SOC 2 Type II controls, and tells you exactly where the gaps are. Run it as a desktop app or deploy the web version with Docker — everything stays under your control.

backend/app/api/__init__.py

@@ -17,4 +17,4 @@
 # - controls.py: Control assessment endpoints
 # - evidence.py: Evidence collection APIs
 # - reports.py: Compliance reporting
-# - admin.py: Administrative functions
+# - admin.py: Administrative functions

backend/app/api/auth.py

@@ -1,7 +1,21 @@
 """
 Authentication API endpoints for ComplianceGuard.
 
-This module provides JWT-based authentication endpoints including login and registration.
+This module provides JWT-based authentication endpoints including login and
+registration.
+
+CSRF invariant — DO NOT SET AUTH COOKIES
+----------------------------------------
+Authentication state is carried exclusively via the ``Authorization: Bearer``
+header. No endpoint in this module sets an auth cookie, and the frontend is
+expected to store tokens in ``localStorage``, not cookies. That's what makes
+the API CSRF-safe without an explicit CSRF token: a cross-site forgery
+attempt cannot attach the bearer header because JS on an attacker-controlled
+origin has no access to our origin's ``localStorage``.
+
+If you ever add a cookie-based auth path here (session cookie, persistent
+login, OAuth proxy, etc.), you MUST also add CSRF protection — SameSite=Lax
+alone is not sufficient for state-changing endpoints.
 """
 
 from datetime import timedelta, datetime, timezone

backend/app/api/compliance.py

@@ -14,8 +14,8 @@
 from datetime import datetime, timezone
 import uuid
 
-from app.core.soc2_controls import SOC2Framework, SOC2Control, ControlCategory, create_soc2_framework
-from app.services.compliance_service import ComplianceService, ComplianceEvaluation, ComplianceStatus, create_compliance_service
+from app.core.soc2_controls import SOC2Control, create_soc2_framework
+from app.services.compliance_service import ComplianceStatus, create_compliance_service
 from app.core.database import get_db
 from app.api.deps import get_current_user, require_pro
 from app.models.user import User

backend/app/api/evidence.py

@@ -4,28 +4,29 @@
 REST API endpoints for managing and collecting compliance evidence.
 """
 
-from fastapi import APIRouter, Depends, HTTPException, status, UploadFile, File
-from fastapi.responses import FileResponse
-from sqlalchemy.orm import Session
-from typing import Dict, Any, Optional, List
-from pydantic import BaseModel, ConfigDict
-from datetime import datetime, timezone
 import logging
 import os
 import re
 import uuid
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional
 
-logger = logging.getLogger(__name__)
+from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
+from fastapi.responses import FileResponse
+from pydantic import BaseModel, ConfigDict
+from sqlalchemy.orm import Session
 
 from app.api.deps import get_current_user
-from app.core.database import get_db
 from app.core.config import settings
 from app.core.credential_crypto import decrypt_credential
-from app.models.user import User
-from app.models.evidence import EvidenceCollection, EvidenceItem
+from app.core.database import get_db
 from app.models.aws_credential import AwsCredential
+from app.models.evidence import EvidenceCollection, EvidenceItem
+from app.models.user import User
 from app.services.evidence_collector import EvidenceCollectionService
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(prefix="/evidence", tags=["evidence"])
 
 # Pre-compute max bytes once so it isn't recalculated per request

backend/app/api/machines.py

@@ -91,7 +91,7 @@ async def sync_machine(
         if limit is not None:
             current_count = (
                 db.query(Machine)
-                .filter(Machine.user_id == current_user.id, Machine.is_active == True)
+                .filter(Machine.user_id == current_user.id, Machine.is_active.is_(True))
                 .count()
             )
             if current_count >= limit:
@@ -155,7 +155,7 @@ async def get_fleet_stats(
             ).label("never_synced"),
             func.avg(Machine.last_score).label("avg_score"),
         )
-        .filter(Machine.user_id == current_user.id, Machine.is_active == True)  # noqa: E712
+        .filter(Machine.user_id == current_user.id, Machine.is_active.is_(True))
         .one()
     )
 
@@ -188,7 +188,7 @@ async def get_machines(
     """
     machines = (
         db.query(Machine)
-        .filter(Machine.user_id == current_user.id, Machine.is_active == True)  # noqa: E712
+        .filter(Machine.user_id == current_user.id, Machine.is_active.is_(True))
         .order_by(Machine.last_sync_at.desc().nullslast(), Machine.id.desc())
         .offset(offset)
         .limit(limit)

backend/app/core/config.py

@@ -364,4 +364,4 @@ def validate_production_settings() -> List[str]:
     if production_warnings:
         import warnings
         for warning in production_warnings:
-            warnings.warn(warning, UserWarning)
+            warnings.warn(warning, UserWarning)

backend/app/core/constants.py

@@ -20,7 +20,7 @@
       - frontend/package.json
 """
 
-VERSION = "2.9.0"
+VERSION = "3.0.0"
 
 VALID_LICENSE_TIERS = ("free", "pro", "enterprise")
 VALID_COMPLIANCE_LEVELS = ("compliant", "at_risk", "critical")

backend/app/core/database.py

@@ -8,7 +8,7 @@
 from sqlalchemy import create_engine
 from sqlalchemy.orm import declarative_base, sessionmaker
 from sqlalchemy.pool import StaticPool
-from typing import Generator, Optional
+from typing import Generator
 
 from app.core.config import get_database_url, settings
 
@@ -98,9 +98,38 @@ def get_session_factory():
 
 
 def create_test_database():
-    """Create a test database with all tables. Returns the test engine."""
+    """
+    Create a test database with the real schema by running Alembic migrations.
+
+    We deliberately avoid ``Base.metadata.create_all`` so CHECK constraints,
+    server defaults, and new indexes ship the same way tests see them —
+    migrations. If migrations ever break, the test suite fails loudly
+    instead of silently drifting.
+
+    Falls back to ``create_all`` only when ``alembic.ini`` is missing (ad-hoc
+    scripts running the module outside the repo tree).
+    """
+    import os
+
     test_engine = create_database_engine(testing=True)
-    Base.metadata.create_all(bind=test_engine)
+
+    alembic_ini = os.path.join(
+        os.path.dirname(__file__), "..", "..", "alembic.ini"
+    )
+    if not os.path.exists(alembic_ini):
+        Base.metadata.create_all(bind=test_engine)
+        return test_engine
+
+    from alembic import command as alembic_command
+    from alembic.config import Config as AlembicConfig
+
+    alembic_cfg = AlembicConfig(alembic_ini)
+    alembic_cfg.set_main_option("sqlalchemy.url", str(test_engine.url))
+    # Pin the same engine's connection so the migrations operate on the
+    # in-memory DB pytest is using, not a fresh file-backed one.
+    with test_engine.connect() as connection:
+        alembic_cfg.attributes["connection"] = connection
+        alembic_command.upgrade(alembic_cfg, "head")
     return test_engine