Improper Inventory Management

// route-owners.json — committed, reviewed, and enforced in CI.
{
  "GET /api/invoices": {
    "owner": "@billing-team",
    "authentication": "required",
    "authorization": "user-scoped",
    "dataClassification": "pii",
    "version": "v2",
    "rateLimit": "standard",
    "publicIntentionally": false,
    "ownershipChecked": true,
    "lastReviewed": "2026-08-04"
  },
  "GET /api/health": {
    "owner": "@platform-team",
    "authentication": "none",
    "publicIntentionally": true,        // ← an explicit decision, not an omission
    "dataClassification": "none",
    "lastReviewed": "2026-08-04"
  },
  "POST /api/v1/invoices": {
    "owner": "@billing-team",
    "authentication": "required",
    "version": "v1",
    "deprecated": true,
    "deprecatedAt": "2026-01-01",
    "sunsetAt": "2026-12-31",           // ← a date, so it cannot drift forever
    "remainingClients": ["legacy-partner-A"],
    "lastReviewed": "2026-08-04"
  }
}

// The CI gate
import routes from './route-inventory.json' with { type: 'json' };
import owners from './route-owners.json' with { type: 'json' };

const problems = [];
const MAX_REVIEW_AGE_DAYS = 365;

for (const route of routes) {
  const key = `${route.method} ${route.path}`;
  const entry = owners[key];

  if (!entry) { problems.push(`UNOWNED: ${key}`); continue; }
  if (!entry.owner) problems.push(`NO OWNER: ${key}`);

  // An unauthenticated route must be an explicit decision
  if (!route.auth && !entry.publicIntentionally) {
    problems.push(`UNAUTHENTICATED without publicIntentionally: ${key}`);
  }
  // A route taking an object id must have had its ownership check reviewed
  if (route.takesId && !entry.ownershipChecked) {
    problems.push(`BOLA CANDIDATE unreviewed: ${key}`);
  }
  // A sunset date that has passed
  if (entry.sunsetAt && new Date(entry.sunsetAt) < new Date()) {
    problems.push(`PAST SUNSET, still deployed: ${key}`);
  }
  // A review that is a year old
  if (daysSince(entry.lastReviewed) > MAX_REVIEW_AGE_DAYS) {
    problems.push(`STALE REVIEW (${entry.lastReviewed}): ${key}`);
  }
}

// And the reverse direction: entries with no matching route are dead weight
const live = new Set(routes.map((r) => `${r.method} ${r.path}`));
for (const key of Object.keys(owners)) {
  if (!live.has(key)) problems.push(`ORPHANED ENTRY (route removed?): ${key}`);
}

if (problems.length) { console.error(problems.join('\n')); process.exit(1); }

#!/usr/bin/env bash
# Weekly. Each source misses what the others catch; the gaps are the findings.
set -uo pipefail

# ── 1. From code ─────────────────────────────────────────────────────
jq -r '.[] | "\(.method) \(.path)"' route-inventory.json | sort -u > /tmp/code.txt

# ── 2. From traffic (normalise ids so the lists are comparable) ───────
aws logs filter-log-events \
  --log-group-name /aws/apigateway/prod \
  --start-time $(( ($(date +%s) - 604800) * 1000 )) \
  | jq -r '.events[].message | fromjson | "\(.httpMethod) \(.path)"' \
  | sed -E 's|/[0-9a-f]{8}-[0-9a-f-]{27}|/:id|g; s|/[0-9]+|/:id|g' \
  | sort -u > /tmp/traffic.txt

# ── 3. The gap that matters most ─────────────────────────────────────
echo "=== Live traffic to paths this codebase does not serve ==="
comm -13 /tmp/code.txt /tmp/traffic.txt
#   → another deployment, an old version, or something nobody owns

echo "=== Routes nobody calls (deletion candidates) ==="
comm -23 /tmp/code.txt /tmp/traffic.txt
#   → the safest kind of fix: delete it

# ── 4. Hosts, not paths ──────────────────────────────────────────────
echo "=== Hosts in certificate transparency ==="
curl -s 'https://crt.sh/?q=%25.dfg.com&output=json' \
  | jq -r '.[].name_value' | tr ',' '\n' | sed 's/^\*\.//' | sort -u

# ── 5. And what is publicly reachable that should not be ─────────────
echo "=== Non-production hosts answering publicly ==="
for h in $(grep -E 'staging|dev|test|uat|demo|old|legacy' /tmp/hosts.txt); do
  code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 "https://$h/" || echo 000)
  [ "$code" != "000" ] && echo "  $h → $code  ⚠️ non-production, publicly reachable"
done

# Findings, in the order they usually matter:
#   1. non-production environments with production data, publicly reachable
#   2. traffic to code you do not have
#   3. old versions with no owner
#   4. routes nobody calls (delete them — free risk reduction)

// Traffic to an unlisted path means a probe, a forgotten client, or an
// endpoint you did not know you had. All three are worth a notification.
import inventory from './route-inventory.json' with { type: 'json' };

const known = new Set(inventory.map((r) => `${r.method} ${normalise(r.path)}`));

function normalise(path) {
  return path
    .replace(/:[^/]+/g, ':id')
    .replace(/\/[0-9a-f]{8}-[0-9a-f-]{27}/gi, '/:id')
    .replace(/\/\d+/g, '/:id');
}

app.use((req, res, next) => {
  const key = `${req.method} ${normalise(req.path)}`;
  if (!known.has(key)) {
    metrics.increment('api.unknown_path', {
      method: req.method,
      authenticated: String(Boolean(req.user)),
    });
    logger.warn({
      path: req.path, method: req.method, ip: req.ip,
      ua: req.get('user-agent'), userId: req.user?.id ?? null,
      status: 'pending',
    }, 'request to a path not in the inventory');
  }
  next();
});

// Two alerts, for two very different situations:
//
// 1. A SPIKE in api.unknown_path from few IPs
//    → someone is enumerating. Rate limit, and look at what they are trying.
//
// 2. A STEADY LOW RATE on ONE path, often AUTHENTICATED
//    → a real client you did not know about. Do not block it — find the owner.
//      This is the alert that discovers the integration another team built two
//      years ago and nobody has patched since.

// And a monthly report that turns it into work:
export async function unknownPathReport() {
  const rows = await metrics.query(`
    sum by (path, authenticated) (rate(api_unknown_path[30d]))
  `);
  return rows
    .filter((r) => r.value > 0.001)          // sustained, not a one-off probe
    .map((r) => ({
      path: r.path,
      authenticated: r.authenticated === 'true',
      requestsPerDay: Math.round(r.value * 86400),
      action: r.authenticated === 'true'
        ? 'IDENTIFY THE CLIENT — likely a real integration'
        : 'probably scanning — confirm and rate limit',
    }));
}