CultivaSaaS — Django Security Hardening

1# settings/production.py (ORIGINAL — VULNERABLE)
2
3DEBUG = True  # CRITICAL: exposes stack traces, env vars, SQL queries
4SECRET_KEY = 'django-insecure-abc123xyz789cultivasaas'  # hardcoded!
5
6ALLOWED_HOSTS = ['*']  # allows any host (Host header injection)
7
8# No SSL redirect
9# No HSTS
10# No security headers
11
12SESSION_COOKIE_SECURE   = False  # cookie sent over plain HTTP
13SESSION_COOKIE_HTTPONLY = False  # JS can steal session token!
14
15AUTH_PASSWORD_VALIDATORS = [
16    {
17        'NAME': 'MinimumLengthValidator',
18        'OPTIONS': {'min_length': 6}  # too short
19    },
20]
21
22REST_FRAMEWORK = {
23    # No throttle -- DDoS & brute-force freely allowed
24    # No default permissions -- endpoints open by default
25}
26
27# No security logging whatsoever

1from django.contrib.auth.models import AbstractUser
2from django.db import models
3
4class CultivaUser(AbstractUser):
5    """Custom user model with email login + RBAC for CultivaSaaS."""
6
7    ROLE_CHOICES = [
8        ('admin',            'Administrator'),
9        ('agency_owner',     'Agency Owner'),
10        ('campaign_manager', 'Campaign Manager'),
11        ('viewer',           'Viewer (read-only)'),
12    ]
13
14    email = models.EmailField(unique=True)  # ✓ unique email
15    USERNAME_FIELD  = 'email'              # ✓ login by email
16    REQUIRED_FIELDS = ['username']
17
18    role = models.CharField(
19        max_length=20,
20        choices=ROLE_CHOICES,
21        default='viewer',   # ✓ principle of least privilege
22    )
23    agency = models.ForeignKey(
24        'Agency', on_delete=models.SET_NULL,
25        null=True, blank=True, related_name='members',
26    )
27    is_verified = models.BooleanField(default=False)
28
29    def is_admin(self):
30        return self.role == 'admin' or self.is_superuser
31
32    def can_manage_campaigns(self):
33        return self.role in ['admin', 'agency_owner', 'campaign_manager']
34
35    def can_access_agency_data(self, agency_id):
36        """Tenant isolation: users see only their own agency's data."""
37        if self.is_admin():
38            return True
39        return self.agency_id == agency_id  # ✓ tenant isolation
40
41    class Meta:
42        db_table   = 'cultiva_users'
43        verbose_name = 'CultivaSaaS User'

1from rest_framework import permissions
2
3class IsVerifiedUser(permissions.BasePermission):
4    """Only users with verified email."""
5    message = 'Please verify your email address first.'
6    def has_permission(self, request, view):
7        return (request.user and request.user.is_authenticated
8                and request.user.is_verified)
9
10
11class IsCampaignManager(permissions.BasePermission):
12    """campaign_manager, agency_owner or admin."""
13    def has_permission(self, request, view):
14        return (request.user.is_authenticated
15                and request.user.can_manage_campaigns())
16
17
18class IsAgencyOwnerOrAdmin(permissions.BasePermission):
19    """Agency owner or global admin."""
20    def has_permission(self, request, view):
21        return (request.user.is_authenticated and
22                request.user.role in ['admin', 'agency_owner'])
23
24
25class IsAgencyMember(permissions.BasePermission):
26    """Object-level: access only to own agency data (tenant isolation)."""
27    def has_object_permission(self, request, view, obj):
28        if request.user.is_admin():
29            return True
30        agency_id = getattr(obj, 'agency_id', None)
31        return request.user.can_access_agency_data(agency_id)  # ✓ tenant check
32
33
34# ─── Usage example ────────────────────────────────────────
35# class CampaignViewSet(viewsets.ModelViewSet):
36#     permission_classes = [IsVerifiedUser, IsCampaignManager, IsAgencyMember]
37#     throttle_classes   = [BurstRateThrottle]
38#     queryset = Campaign.objects.select_related('agency')

1import hmac, hashlib, logging
2from django.utils.html import format_html, escape
3from rest_framework.throttling import UserRateThrottle
4
5security_logger = logging.getLogger('django.security')
6
7
8# ─── Custom throttles ─────────────────────────────────────
9
10class UploadRateThrottle(UserRateThrottle):
11    scope = 'upload'  # 5/hour — protects media uploads
12
13class BurstRateThrottle(UserRateThrottle):
14    scope = 'burst'   # 60/min — for heavy AI endpoints
15
16
17# ─── Security headers middleware ──────────────────────────
18
19class SecurityHeadersMiddleware:
20    def __init__(self, get_response):
21        self.get_response = get_response
22
23    def __call__(self, request):
24        response = self.get_response(request)
25        response['X-Content-Type-Options'] = 'nosniff'
26        response['X-Frame-Options']        = 'DENY'
27        response['X-XSS-Protection']       = '1; mode=block'
28        response['Referrer-Policy']        = 'strict-origin-when-cross-origin'
29        response['Permissions-Policy']     = 'camera=(), microphone=(), geolocation=()'
30        response['Content-Security-Policy'] = (
31            "default-src 'self'; script-src 'self' https://cdn.cultivasaas.io; "
32            "style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; "
33            "connect-src 'self' https://api.cultivasaas.io"
34        )
35        return response
36
37
38# ─── XSS-safe helpers ────────────────────────────────────
39
40def safe_user_html(username: str) -> str:
41    """Render user-supplied name without XSS risk."""
42    return format_html('<span class="user-badge">{}</span>', escape(username))
43
44
45# ─── Webhook HMAC signature verification ─────────────────
46
47def verify_webhook_signature(payload: bytes, sig_header: str, secret: str) -> bool:
48    """Verify HMAC-SHA256 signature (Meta Ads / Google Ads webhooks)."""
49    expected = hmac.new(
50        secret.encode(), payload, hashlib.sha256
51    ).hexdigest()
52    return hmac.compare_digest(expected, sig_header)  # ✓ timing-safe
53
54
55# ─── SQL injection-safe search ────────────────────────────
56
57def search_campaigns(query: str, user):
58    """Safe ORM search — never interpolate user input."""
59    from apps.campaigns.models import Campaign
60    from django.db.models import Q
61    return Campaign.objects.filter(  # ✓ ORM auto-escapes parameters
62        Q(name__icontains=query) | Q(description__icontains=query),
63        agency=user.agency,  # ✓ tenant scoping
64    )