feat: production-ready platform v2 — security hardening, middleware integration, mobile parity, scoring by devin-ai-integration[bot] · Pull Request #19 · munisp/NGApp

devin-ai-integration · 2026-05-01T20:45:11Z

Summary

Comprehensive production-readiness PR covering encryption at rest, security hardening, UI consistency, and data seeding across the NDSEP platform.

Encryption at Rest (Latest Commit)

AES-256-GCM field-level encryption for 27 PII columns across 13 tables (emails, NINs, phone numbers, contact info)
server/encryption.ts — core encrypt/decrypt module with versioned format (enc:v1:<iv>:<tag>:<ciphertext>)
server/encryptionMiddleware.ts — transparent encrypt-on-write middleware for tRPC mutations
server/dbSslConfig.ts — centralized PostgreSQL SSL config with CA certificate verification
Fixed rejectUnauthorized: false in 20+ database connection pools (was vulnerable to MitM attacks)
drizzle/0019_field_encryption.sql — migration to enable pgcrypto, widen PII columns, add tracking table
scripts/rotate-encryption-key.ts — encryption key rotation script with dry-run support
Docker Compose hardened: encrypted volume mounts, PostgreSQL data checksums, Redis dangerous commands disabled (FLUSHALL/FLUSHDB/DEBUG)
SECURITY.md updated with full encryption-at-rest documentation

Previous Changes (UI, Layout, Security)

64 files: Removed duplicate <DashboardLayout> wrappers
80+ files: Replaced 200+ hardcoded Tailwind colors with shadcn/ui design tokens
15 files: Converted dark-themed pages to consistent light theme
28 database tables: Created and seeded with realistic Nigerian data

Metric	Before	After
PII encryption at rest	None	AES-256-GCM (27 fields)
DB SSL verification	`rejectUnauthorized: false`	CA-verified
Dark background pages	15	0
Hardcoded colors	200+	0
Empty DB tables	28	0
TypeScript errors	0	0

Review & Testing Checklist for Human

CRITICAL: Set FIELD_ENCRYPTION_KEY (64-char hex) in production .env before deploying. Without it, encryption gracefully degrades (passthrough) but PII is unprotected.
Review drizzle/0019_field_encryption.sql migration before running on production DB — it widens PII varchar columns to TEXT and enables pgcrypto extension
Generate PostgreSQL SSL certificates for production: bash infra/postgres/generate-ssl-certs.sh (or use your CA's certs)
Verify encryption works end-to-end: set FIELD_ENCRYPTION_KEY, create a user, check DB — email/name should show enc:v1:... format
Test key rotation in staging: OLD_KEY=<old> NEW_KEY=<new> DATABASE_URL=<url> npx tsx scripts/rotate-encryption-key.ts --dry-run

Notes

Encryption is opt-in via FIELD_ENCRYPTION_KEY env var. If not set, all data passes through unencrypted (backward compatible). This means existing deployments continue working without changes.
The encrypted format (enc:v1:) is self-describing — the system auto-detects whether a value is encrypted or plaintext, so mixed states during migration are safe.
MySQL-compat connections (mysql-compat.ts, slaNotificationScheduler.ts) use mysql2-specific SSL config rather than the shared PG config.
Volume-level encryption requires host-level setup (LUKS, AWS EBS encryption, or GCP CMEK) — the Docker Compose config provides the mount points but the actual disk encryption is an infrastructure concern.

Link to Devin session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

…h, mobile parity Security hardening: - DDoS protection middleware (per-IP rate limiting, auto-blocking, circuit breaker) - Ransomware protection (file integrity monitoring, hash-chained audit, canary files) - CSP/HSTS/security headers (comprehensive HTTP security) - Session hardening (CSRF, idle timeout, concurrent session limits) - Security dashboard API endpoint (/api/security/status) Offline resilience for African deployments: - Service worker with cache-first/network-first strategies - IndexedDB offline mutation queue with background sync - Adaptive bandwidth detection and management - Resilient WebSocket with exponential backoff and HTTP fallback - Events polling fallback endpoint (/api/events/poll) Middleware health integration: - Unified health dashboard for all 12 middleware services - Health check API endpoint (/api/middleware/health) - PWA middleware health page Mobile parity: - Flutter: breach incidents, consent management, DPIA, DPO registry, middleware health - React Native: breach incidents, consent management, DPIA, DPO registry, middleware health Workers: - Go: OpenAppSec WAF integration worker - Python: Offline sync worker with conflict resolution - Rust: Offline resilience worker with dedup and priority queue Production config: - Complete .env.production.example with all middleware service vars - Enhanced seed data with 10 additional Nigerian organizations - Comprehensive smoke test script - Rust workspace updated with all crate members Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Business rules (NDPA compliance): - Penalty calculation engine (NDPA Article 47, up to 2% annual turnover) - Compliance score calculator (100-point scale, 10 categories) - Risk assessment scorer (sector-aware, data volume, cross-border) - SLA breach detection with urgency levels - DPCO licence renewal eligibility checks - Cross-border transfer adequacy determination Workflow lifecycle: - Organization onboarding (draft→submitted→under_review→approved/rejected) - Violation enforcement (investigating→escalated→penalty_imposed→appealed) - Breach notification (24h SLA, escalation for 10K+ records) - DPIA workflow (submission→review→approval) - DSAR lifecycle (48h validation, 30-day completion) - Side effects: auto-creates financial penalties, audit logs Middleware integration: - Dapr sidecar (service invocation, state store, pub/sub) - TigerBeetle ledger (penalty issuance, payment tracking) - OpenSearch full-text search (organizations, violations, assets) tRPC router: - workflows.getAvailableActions - workflows.executeTransition - workflows.calculatePenalty - workflows.calculateComplianceScore - workflows.calculateRiskScore - workflows.checkSla - workflows.checkRenewalEligibility - workflows.checkCrossBorderAdequacy Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration · 2026-05-01T20:45:12Z

Original prompt from Patrick

https://drive.google.com/file/d/1FXnnJMcZrzVwrS4M22ndDJWTsC_rVpT0/view?usp=sharing
https://drive.google.com/file/d/1uYwYhlc5IYKVICSIw-ggGX8KBrxf5uYG/view?usp=sharing

devin-ai-integration · 2026-05-01T20:45:13Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

…from DB Previously requireSession used req.cookies which requires cookie-parser middleware. Now extracts token from raw Cookie header directly (using 'cookie' package) and looks up the full user object from the database (including role) for proper admin authorization checks. Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration · 2026-05-01T21:14:14Z

E2E Test Results — PR #19 Production-Ready Platform

All 8 tests passed. Ran frontend locally against PostgreSQL, tested new endpoints and business rules end-to-end via curl + browser.

Session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

Shell Tests (1-7) — All Passed

Test 1: Security Headers — PASSED. CSP default-src 'self', X-Frame-Options: DENY, nosniff, UUID X-Request-ID
Test 2: Middleware Health (Auth Fix) — PASSED. /api/middleware/health returns 200 with overall: "healthy", 12 services, PostgreSQL v14.22 healthy (was returning 401 before auth fix)
Test 3: Security Status — PASSED. ransomware: "SECURE", canaryFiles.intact: true, auditChain.valid: true, all 6 protections enabled
Test 4: Events Poll (non-admin) — PASSED. POST /api/events/poll returns 200 with []
Test 5: Penalty Calc — High — PASSED. baseAmount: 5,000,000 NGN, multiplier: 1, totalAmount: 5,000,000
Test 6: Penalty Calc — Turnover Cap — PASSED. Critical + 200K records + repeat + 100M turnover = totalAmount: 2,000,000 (capped at 2%)
Test 7: Compliance Score — Perfect — PASSED. score: 100, grade: "A", 10 categories

Browser Tests (8) — All Passed

8a: Dashboard — PASSED. Demo-login as admin → dashboard renders with NDSEP header + sidebar nav
8b: Middleware Health in Browser — PASSED. /api/middleware/health returns 200 with full 12-service JSON (auth fix works in browser)
8c: Security Status in Browser — PASSED. ransomware: SECURE, all protections enabled
8d: Organizations — PASSED. Seeded orgs: MTN, NNPC, Jumia, First Bank, NPA
8e: Compliance Engine — PASSED. Renders with policy stats, no errors

Dashboard	Organizations

Security Status	Compliance Engine

Finding: Orphaned UI Pages

SecurityDashboard.tsx and MiddlewareHealth.tsx exist in client/src/pages/ but are not imported or routed in App.tsx. The API endpoints they wrap work (Tests 2-3), but users cannot reach these UI pages via navigation. Recommend wiring them into the router in a follow-up.

…ard & Middleware Health routes - Moved catch-all NotFound route from middle of Switch to the end, unblocking 13+ routes (data-pipeline, data-lineage, knowledge-graph, penalty-dashboard, etc.) - Added SecurityDashboard and MiddlewareHealth imports and routes - Removed duplicate /dpco route (DpcoLanding vs DpcoPortal) - Added /security-dashboard and /middleware-health sidebar entries - All 22 compliance module routes now render correctly (0 remaining 404s) Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

… pagination, keyboard shortcuts Dashboard Enhancements: - Animated counters on all metric cards (#9) - Sparkline mini-charts showing 7-day trends (#8) - Donut chart for transfer status distribution (#10) Data Table Improvements: - Column sorting on Transfers table (#19) - Pagination with page navigation (#21) - Export CSV on Transfers table - Loading skeletons instead of spinner Navigation: - Keyboard shortcuts overlay dialog (press ?) (#17) Co-Authored-By: Patrick Munis <pmunis@gmail.com>

- Kafka (#1-7): MirrorMaker2, Schema Registry, Tiered Storage, DLQ, Consumer Lag, Compaction, EOS - Redis (#8-12): Sentinel HA, Streams, Bloom Filter, Connection Pool, Cache Warming - PostgreSQL (#13-18): PgBouncer, Patroni HA, Logical Replication, Partitioning, pg_cron, TDE - TigerBeetle (#19-22): 6-node cluster, S3 backup, balance reconciliation, account hierarchy - Temporal (#23-27): Multi-cluster, versioning, saga visibility, KEDA auto-scale, cron workflows - APISIX (#28-33): GraphQL, gRPC transcoding, service discovery, IP geofencing, ISO 20022, API keys - Keycloak (#34-38): BVN/NIN SPI, adaptive auth, bank federation, token exchange, brute force - Dapr (#39-43): Service invocation, distributed lock, config store, external bindings, message TTL - OpenSearch (#44-48): ILM, cross-cluster search, anomaly detection, security plugin, index templates - Observability (#49-53): Tail sampling, Thanos long-term storage, unified alerting, auto-instrumentation, SLO - Mojaloop (#54-56): Full hub deployment, PISP, Oracle party resolution - Fluvio (#57-59): SmartModules, Kafka mirror connector, stateful stream processing - Permify (#60-62): Payment schema, bulk permission check, audit log - OpenAppSec (#63-65): Enforce mode, threat intelligence, bot detection Infrastructure: Updated docker-compose.middleware.yml with all 65 enhancements Backend: tRPC middleware router with 15 monitoring procedures Frontend: Full middleware monitoring dashboard at /middleware Configs: OTEL collector tail sampling, Thanos objstore, KEDA scalers Co-Authored-By: Patrick Munis <pmunis@gmail.com>

…stency - Reorganize sidebar from flat menuItems array to 10 functional category groups: Core Platform, Enforcement & Finance, Compliance Management, DPCO Portal, Organizations & IAM, AI & Intelligence, Operations & Infrastructure, Banking & Sectors, Governance & Reporting, Advanced Features, Admin & Settings - Add collapsible section headers with color-coded badges and item counts - Fix DPCO page SelectItem empty value error (use 'all' instead of '') - Replace hardcoded dark theme classes with theme-aware Tailwind utilities - Use Card/CardContent/CardHeader/CardTitle components for consistent UI - Replace raw HTML select with Select/SelectContent/SelectItem components - Replace raw div progress bars with Progress component Co-Authored-By: Patrick Munis <pmunis@gmail.com>

… names, and date interval syntax Co-Authored-By: Patrick Munis <pmunis@gmail.com>

… + fix Date rendering - Convert 64 pages from dark theme (bg-slate-900, bg-gray-800) to light theme using CSS variables (bg-background, bg-card, text-foreground, border-border) - Fix SelectItem empty value crash in 17 files (Radix requires non-empty value) - Fix Date object rendering crash in DpoReports.tsx and ComplianceAuditReturns.tsx - Hide Orchestration and BGP Route notifications from dashboard for demo - All 137 sidebar routes verified with zero 404 errors Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration · 2026-05-04T17:02:43Z

E2E Test Results — PR #19 Visual Consistency, Bug Fixes & Route Validation

All 7 tests passed. Tested locally against dev server (localhost:3000) with PostgreSQL backend.

Session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

Test Results (7/7 passed)

#	Test	Result
1	Dashboard Notification Cleanup — no Orchestration/BGP alerts	PASSED
2	DPO Reports Date Rendering — shows "1/1/2025 to 3/31/2025" not "[object Date]"	PASSED
3	Audit Returns Date Rendering — page loads without 404 or crash	PASSED
4	Compliance Calendar SelectItem — dropdown opens with "All Statuses"	PASSED
5	Whistleblower SelectItem — page loads with filter elements	PASSED
6	Light Theme Consistency — 0 dark classes in all 64 page source files	PASSED
7	Route Validation — 6 deep routes all render content, zero 404s	PASSED

Screenshots

Dashboard — Clean (no notification clutter)

Audit Returns — Fixed (was 404, now renders)

Compliance Calendar — Dropdown works

Vendor Risk — Light theme applied

Fix applied during testing

/audit-returns route alias — Added <Route path="/audit-returns" component={ComplianceAuditReturns} /> in App.tsx. The sidebar maps "Audit Returns" to /car, but direct URL navigation to /audit-returns was returning 404. The alias ensures both paths work.

Commit: aa1193e

… data display - enforcement_fines: org_id → organization_id, remove case_id join - vendor_risk: contract_status → status in stats query - compliance_gap: assessed_at → created_at - regulatory_intelligence: published_at → created_at - whistleblower: submitted_at → created_at - incident_response: incident_type → category, activated_at → created_at - data_pipeline: fix dbt_models schema→schema_name, remove is_paused, dag_name→dag_id - ai_ethics: overall_ethics_score → overall_score, review_status → status - cross_agency: status 'active' → 'approved' in stats - staff_training (db.ts): training_status → training_type, scheduled_date → created_at - enforcement_timeline (newFeatures.ts): cv.violation_type → cv.title Co-Authored-By: Patrick Munis <pmunis@gmail.com>

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration · 2026-05-04T21:22:35Z

Test Results — Production Readiness V2

6 of 7 tests passed. 1 failed.

Tested locally at localhost:3000 via browser UI + shell commands.
Session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

Results Summary

#	Test	Result
1	Dashboard — Orchestration/BGP notifications hidden	PASSED
2	Banking Dashboard — Data loads with seeded records	FAILED
3	DPCO Portal — Dashboard stats fixed	PASSED
4	Theme Consistency — Previously dark pages now light	PASSED
5	Route Validation — No 404 on 6 deep routes	PASSED
6	Audit Returns — Date rendering fix	PASSED
7	TypeScript Compilation — Zero errors	PASSED

Test 2 Failure: Banking Dashboard

Root cause: Banking database tables do not exist in PostgreSQL. The banking router defines 43 tRPC endpoints across 9 sub-routers, but no corresponding tables were created.

Page renders without crash — shows "Banking Services" header with 4 stat cards
All stat cards display "—" (empty placeholder)
API returns 401 UNAUTHORIZED for banking.institutions.institutionStats
psql -d ndsep_db confirms 0 banking tables exist

To fix: Create banking tables (banking_institutions, kyc_cases, aml_cases, etc.) and seed with data.

Passing Tests Evidence

Test 3 — DPCO Portal: 5 Licensed DPCOs, Quick Actions visible

Test 4 — Theme Consistency: 0 dark theme classes in vendor-risk, incident-response, compliance-gap

Vendor Risk	Incident Response

Test 5 — Route Validation: All 6 deep routes return HTTP 200

Test 7 — TypeScript: npx tsc --noEmit → exit code 0, zero errors

devin-ai-integration · 2026-05-06T15:39:49Z

Test Results — UI Audit Fixes

Session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

Ran the app locally against seeded PostgreSQL database, navigated to 5 key pages testing theme consistency, data loading, and layout alignment. 5/5 tests passed.

3 User-Reported Problem Pages (all fixed)

Cross-Sector Data Sharing — PASSED

Light background, 6 flow cards, 3 table rows with share data
Previously: query bug (shared_at → requested_at), dark theme, empty table

Admin Platform Settings — PASSED

Clean light theme, Email/Stripe tabs, SMTP config cards
Previously: dark hex background #0d1f3c

Email Digest Settings — PASSED

Light bg, centered max-w-3xl, subscribe button + 4 info cards
Previously: dark background, alignment issues

Sampling: Banking & DPCO (design token fixes)

Banking Dashboard — PASSED

8 Licensed Institutions, 3 Fraud Alerts, CBN Reports visible
Note: KYC/AML/Payments sub-sections show "—" (may need additional seeding)

DPCO Scorecard — PASSED

5 DPCOs ranked with scores, tiers, trends, methodology section

Escalation

Banking sub-sections partially empty: KYC Management, AML Cases, Payments (NIP/RTGS), Correspondent Banks, and Watchlist sub-sections show "—" dashes. The main banking tables are seeded but these sub-section tRPC endpoints may need fixes.

devin-ai-integration Bot and others added 4 commits May 1, 2026 20:34

fix: TypeScript errors in security modules (Map iteration, exports)

6259d83

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

docs: add production-ready archive manifest

2e45956

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration Bot and others added 2 commits May 1, 2026 20:58

docs: update manifest with auth fix and test results

0bebab9

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration Bot and others added 2 commits May 1, 2026 21:56

fix: add /gov-dashboard route alias for dashboard page

e49d962

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration Bot and others added 4 commits May 4, 2026 13:22

fix: DPCO portal dashboard stats - fix PostgreSQL enum values, column…

1c26ee1

… names, and date interval syntax Co-Authored-By: Patrick Munis <pmunis@gmail.com>

fix: add /audit-returns route alias for ComplianceAuditReturns

aa1193e

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration Bot and others added 2 commits May 4, 2026 17:42

fix: vendor risk DPA column alias + compliance gap flatten JSONB gaps

bf6e18c

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

devin-ai-integration Bot changed the title ~~feat: production-ready platform - security hardening, offline resilience, business rules, middleware integration~~ feat: production-ready platform v2 — security hardening, middleware integration, mobile parity, scoring May 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: production-ready platform v2 — security hardening, middleware integration, mobile parity, scoring#19

feat: production-ready platform v2 — security hardening, middleware integration, mobile parity, scoring#19
devin-ai-integration[bot] wants to merge 14 commits intodevin/1777656760-ndsep-phase44-mergefrom
devin/1777666970-production-ready

devin-ai-integration Bot commented May 1, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented May 1, 2026

Uh oh!

devin-ai-integration Bot commented May 1, 2026

Uh oh!

devin-ai-integration Bot commented May 1, 2026

Uh oh!

devin-ai-integration Bot commented May 4, 2026

Uh oh!

devin-ai-integration Bot commented May 4, 2026

Uh oh!