Updates to securily harden our running service.

.dockerignore

@@ -0,0 +1,39 @@
+# Dependencies (reinstalled in image)
+node_modules
+**/node_modules
+
+# Version control and CI
+.git
+.gitignore
+.github
+
+# Local and sensitive files
+.env
+.env.*
+!.env.example
+*.log
+npm-debug.log*
+# Our services actually DO want to include this file.
+#config/local.js
+
+# Test and dev
+test
+*.test.js
+.mocharc.js
+coverage
+.nyc_output
+.eslintrc*
+eslint.config.mjs
+.prettier*
+
+# IDE and OS
+.vscode
+.idea
+*.swp
+.DS_Store
+
+# Docs and misc (optional: remove if you need these in image)
+README.md
+Makefile
+*.md
+!AppBuilder/**/*.md

Dockerfile

@@ -1,13 +1,22 @@
 ##
 ## digiserve/ab-file-processor
 ##
-## This is our microservice for our AppBuilder Definitions.
+## This is our microservice for our AppBuilder file processing.
+##
+## Security: image runs as non-root user (node). For production, prefer
+## pinning the base image by digest and overriding CMD to remove --inspect.
 ##
 ## Docker Commands:
 ## ---------------
 ## $ docker build -t digiserve/ab-file-processor:master .
 ## $ docker push digiserve/ab-file-processor:master
 ##
+## Multi-platform (M1/M2/M3 Mac → amd64 + arm64):
+## $ docker buildx create --use  # once, if no builder
+## $ docker buildx build --provenance=true --sbom=true --platform linux/amd64,linux/arm64 -t digiserve/ab-file-processor:master --push .
+## Or use: $ DOCKER_ARGS="--platform linux/amd64,linux/arm64 --push" ./build.sh
+## Supply chain: use --provenance=true --sbom=true when pushing to a registry for Docker Hub attestations and license visibility.
+##
 
 ARG BRANCH=master
 
@@ -20,16 +29,29 @@ RUN apt-get install -y clamav clamav-daemon imagemagick
 RUN mkdir /var/run/clamav
 RUN chown clamav:clamav /var/run/clamav
 
+# OCI labels for Docker Hub / Scout (license, description)
+LABEL org.opencontainers.image.title="File Processor" \
+   org.opencontainers.image.description="Service to manage uploaded files" \
+   org.opencontainers.image.licenses="MIT"
+
 COPY . /app
 
 WORKDIR /app
 
-RUN npm i -f
+# Reproducible install; use npm i -f only if npm ci fails (e.g. peer deps)
+RUN npm ci && npm cache clean --force
 
 WORKDIR /app/AppBuilder
 
-RUN npm i -f
+RUN npm ci && npm cache clean --force
 
 WORKDIR /app
 
+# Security: run as non-root (base image should provide node user)
+# Default FILE_PROCESSOR_PATH is /data; ensure node can create tenant dirs (e.g. /data/admin)
+RUN chown -R node:node /app \
+   && mkdir -p /data && chown node:node /data
+USER node
+
+# --inspect=0.0.0.0:9229 exposes debugger to the network; omit in production or bind to 127.0.0.1
 CMD [ "node", "--inspect=0.0.0.0:9229", "app.js" ]

app.js

@@ -11,7 +11,7 @@ if (AB.defaults.env("TELEMETRY_PROVIDER", "sentry") == "sentry") {
    AB.telemetry.init("sentry", {
       dsn: AB.defaults.env(
          "SENTRY_DSN",
-         "https://095e01fe2fc16e08935122417f0dbac2@o144358.ingest.sentry.io/4506143774998528"
+         "https://095e01fe2fc16e08935122417f0dbac2@o144358.ingest.sentry.io/4506143774998528",
       ),
       release: version,
    });
@@ -45,6 +45,6 @@ if (process.env.CLAMAV_ENABLED == "true") {
                }
             });
          }
-      }
+      },
    );
 }

build.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
+# Supply chain: --provenance and --sbom are required for Docker Hub attestations; they are preserved when using --push.
+
 git submodule update --init --recursive
 
-docker buildx build $DOCKER_ARGS \
-  .
+docker buildx build --provenance=true --sbom=true $DOCKER_ARGS .

eslint.config.mjs

@@ -0,0 +1,49 @@
+//   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐
+//   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│
+//  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘
+// Flat config for ESLint v9+. Replaces .eslintrc.js and test/.eslintrc.js.
+import js from "@eslint/js";
+import globals from "globals";
+import eslintConfigPrettier from "eslint-config-prettier/flat";
+import eslintPluginPrettier from "eslint-plugin-prettier";
+
+export default [
+   js.configs.recommended,
+
+   // Main project: Node + ES2022, Prettier, custom rules
+   {
+      files: ["**/*.js"],
+      languageOptions: {
+         ecmaVersion: 2022,
+         globals: { ...globals.node },
+      },
+      plugins: { prettier: eslintPluginPrettier },
+      rules: {
+         "prettier/prettier": [
+            "error",
+            {
+               arrowParens: "always",
+               endOfLine: "lf",
+               printWidth: 80,
+               tabWidth: 3,
+               trailingComma: "all",
+            },
+         ],
+         "no-console": "off", // allow console.log() in our services
+      },
+   },
+
+   // Test files: Mocha globals + no-unused-vars ignore for should/expect
+   {
+      files: ["test/**/*.js"],
+      languageOptions: {
+         globals: { ...globals.node, ...globals.mocha },
+      },
+      rules: {
+         "no-unused-vars": ["error", { varsIgnorePattern: "should|expect" }],
+      },
+   },
+
+   // Prettier disables conflicting rules — must be last
+   eslintConfigPrettier,
+];

handlers/file-base64-upload.js

@@ -54,7 +54,7 @@ module.exports = {
          var object = AB.objectByID(objID);
          if (!object) {
             var errObj = new Error(
-               "file_processor.file_upload: unknown object reference"
+               "file_processor.file_upload: unknown object reference",
             );
             req.notify.builder(errObj, {
                object: objID,
@@ -66,7 +66,7 @@ module.exports = {
          var field = object.fieldByID(fieldID);
          if (!field) {
             var errField = new Error(
-               "file_processor.file_upload: unknown field reference"
+               "file_processor.file_upload: unknown field reference",
             );
             req.notify.builder(errField, {
                object,
@@ -87,6 +87,8 @@ module.exports = {
          const fileName = req.param("fileName");
          const uploadedBy = req.param("uploadedBy") ?? req.user.username;
 
+         var pathFile;
+
          async.series(
             {
                // make sure destination directory is created
@@ -104,7 +106,9 @@ module.exports = {
                         });
                         next(err);
                      } else {
-                        req.log(`Service:${serviceKey}: File written successfully '${pathFile}'`);
+                        req.log(
+                           `Service:${serviceKey}: File written successfully '${pathFile}'`,
+                        );
                         next();
                      }
                   });
@@ -134,7 +138,7 @@ module.exports = {
                         } else {
                            next();
                         }
-                     }
+                     },
                   );
                },
                // store file entry in DB
@@ -185,9 +189,9 @@ module.exports = {
                   cb(err);
                } else {
                   let returnID = results?.uuid || uuid;
-                  cb(null, { uuid: returnID, file: fileName, type, });
+                  cb(null, { uuid: returnID, file: fileName, type });
                }
-            }
+            },
          );
       } catch (err) {
          req.notify.developer(err, {

handlers/file-base64.js

@@ -137,6 +137,7 @@ async function checkFileAccess(path) {
    try {
       await fs.access(path, fs.constants.R_OK);
       return true;
+      // eslint-disable-next-line no-unused-vars
    } catch (err) {
       return false;
    }

handlers/file_import.js

@@ -129,7 +129,7 @@ module.exports = {
                      return cb(err);
                   }
                   cb(null, { status: "success" });
-               }
+               },
             );
          })
          .catch((err) => {

handlers/file_upload.js

@@ -69,7 +69,7 @@ module.exports = {
             var object = AB.objectByID(objID);
             if (!object) {
                var errObj = new Error(
-                  "file_processor.file_upload: unknown object reference"
+                  "file_processor.file_upload: unknown object reference",
                );
                req.notify.builder(errObj, {
                   object: req.param("object"),
@@ -83,7 +83,7 @@ module.exports = {
                var field = object.fieldByID(fieldID);
                if (!field) {
                   var errField = new Error(
-                     "file_processor.file_upload: unknown field reference"
+                     "file_processor.file_upload: unknown field reference",
                   );
                   req.notify.builder(errField, {
                      object,
@@ -128,7 +128,7 @@ module.exports = {
                            } else {
                               next();
                            }
-                        }
+                        },
                      );
                   },
 
@@ -149,7 +149,7 @@ module.exports = {
                            });
                         } else {
                            req.log(
-                              `moved file [${tempPath}] -> [${pathFile}] `
+                              `moved file [${tempPath}] -> [${pathFile}] `,
                            );
                         }
                         next(err);
@@ -196,7 +196,7 @@ module.exports = {
                   } else {
                      cb(null, { uuid: results.uuid });
                   }
-               }
+               },
             );
          })
          .catch((err) => {