Meridian PMS
Security Assessment

const jwt = require('jsonwebtoken');

const verifyToken = (token) => {
  return jwt.verify(token, publicKey, {
    algorithms: ['RS256'], // Explicitly pin algorithm
    issuer: 'https://cognito-idp.us-east-1.amazonaws.com/YOUR_POOL_ID',
    audience: 'YOUR_CLIENT_ID'
  });
};

Additional Controls

• Rotate signing keys quarterly via Cognito key rotation
• Monitor for tokens with unexpected algorithm headers in ELK

// Express.js cookie configuration
res.cookie('accessToken', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  maxAge: 3600000 // 1 hour
});

CSP Header Configuration

Content-Security-Policy: default-src 'self'; script-src 'self'; connect-src 'self' wss://your-domain.com

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::meridian-pms-patient-docs",
        "arn:aws:s3:::meridian-pms-patient-docs/*"
      ],
      "Condition": {
        "Bool": { "aws:SecureTransport": "false" }
      }
    }
  ]
}

// Using mysql2 with prepared statements
const searchPatients = async (searchTerm) => {
  const [rows] = await pool.execute(
    'SELECT id, name, dob FROM patients WHERE name LIKE ? OR mrn = ?',
    [`%${searchTerm}%`, searchTerm]
  );
  return rows;
};

Input Validation Layer

const Joi = require('joi');

const patientSearchSchema = Joi.object({
  query: Joi.string().max(100).pattern(/^[a-zA-Z0-9\s\-]+$/).required()
});

const authorizePatientAccess = async (req, res, next) => {
  const requestedPatientId = req.params.patientId;
  const userId = req.user.sub; // From JWT
  
  const hasAccess = await checkPatientAccess(userId, requestedPatientId);
  
  if (!hasAccess) {
    logger.warn('IDOR attempt', { userId, requestedPatientId, ip: req.ip });
    return res.status(403).json({ error: 'Access denied' });
  }
  next();
};

app.get('/api/patients/:patientId', authorizePatientAccess, getPatientHandler);

// Rotate keys and use short-lived tokens where supported
const getScriptGuardClient = async () => {
  const apiKey = await getSecretValue('meridian-pms/scriptguard/apikey');
  return axios.create({
    baseURL: 'https://api.scriptguard.io/v2',
    headers: {
      'X-API-Key': apiKey,
      'X-Request-ID': crypto.randomUUID()
    },
    timeout: 5000
  });
};

Network Controls

• Configure VPC endpoints for outbound API calls
• Implement egress filtering to allow only ScriptGuard IP ranges
• Log all third-party API requests to ELK

const generateTurnCredentials = (userId) => {
  const timestamp = Math.floor(Date.now() / 1000) + 3600; // 1 hour validity
  const username = `${timestamp}:${userId}`;
  const credential = crypto
    .createHmac('sha1', TURN_SECRET)
    .update(username)
    .digest('base64');
  
  return {
    urls: ['turn:turn.meridian-pms.com:443?transport=tcp'],
    username,
    credential
  };
};

# .github/workflows/deploy.yml
name: Deploy
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production  # Requires approval
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::ACCOUNT:role/github-deploy
          aws-region: us-east-1

aws cognito-idp update-user-pool-client \
  --user-pool-id us-east-1_XXXXX \
  --client-id YOUR_CLIENT_ID \
  --prevent-user-existence-errors ENABLED

const logAuthEvent = (event, req) => {
  logger.info({
    type: 'AUTH_EVENT',
    action: event.action,
    userId: event.userId || 'unknown',
    sourceIp: req.ip,
    userAgent: req.headers['user-agent'],
    timestamp: new Date().toISOString(),
    failureReason: event.reason || null
  });
};

const rateLimit = require('express-rate-limit');

const apiLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: (req) => req.user?.sub || req.ip,
  handler: (req, res) => {
    logger.warn('Rate limit exceeded', { userId: req.user?.sub, ip: req.ip });
    res.status(429).json({ error: 'Too many requests' });
  }
});

app.use('/api/', apiLimiter);

const io = require('socket.io')(server, {
  cors: {
    origin: ['https://meridian-pms.com'],
    methods: ['GET', 'POST'],
    credentials: true
  }
});

io.use((socket, next) => {
  const token = socket.handshake.auth.token;
  try {
    const decoded = jwt.verify(token, publicKey, { algorithms: ['RS256'] });
    socket.user = decoded;
    next();
  } catch (err) {
    logger.warn('Socket.IO auth failed', { ip: socket.handshake.address, error: err.message });
    next(new Error('Authentication required'));
  }
});

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::meridian-pms-patient-docs/lab-results/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:ACCOUNT:secret:meridian-pms/mariadb/prod-*"
    }
  ]
}

server {
    listen 9090 ssl;
    server_name prometheus.internal.meridian-pms.com;

    ssl_certificate /etc/ssl/certs/prometheus.crt;
    ssl_certificate_key /etc/ssl/private/prometheus.key;

    location / {
        auth_basic "Prometheus";
        auth_basic_user_file /etc/nginx/.htpasswd;
        proxy_pass http://localhost:9091;
    }
}