Chat's updates for security, db and workflow

bin/check-production.py

@@ -0,0 +1,22 @@
+"""Read-only checks of a deployed HTTPS host; never sends account email or writes data."""
+import argparse,http.cookiejar,ssl,urllib.error,urllib.parse,urllib.request
+parser=argparse.ArgumentParser();parser.add_argument('url');args=parser.parse_args()
+url=args.url.rstrip('/');parts=urllib.parse.urlsplit(url)
+if parts.scheme!='https' or parts.query or parts.fragment or parts.username:raise SystemExit('Use the trusted HTTPS application base URL.')
+client=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),urllib.request.HTTPSHandler(context=ssl.create_default_context()))
+def get(path):
+    try:
+        with client.open(url+'/'+path,timeout=25) as response:return response.status,response.headers,response.read(),response.geturl()
+    except urllib.error.HTTPError as error:return error.code,error.headers,error.read(),error.geturl()
+failures=[]
+status,headers,body,final=get('main.php')
+if status!=200 or urllib.parse.urlsplit(final).scheme!='https':failures.append('HTTPS login page unavailable.')
+for name in ['Strict-Transport-Security','Content-Security-Policy','X-Content-Type-Options','Referrer-Policy','X-Frame-Options']:
+    if not headers.get(name):failures.append('Missing '+name)
+cookie=';'.join(headers.get_all('Set-Cookie') or [])
+if not all(flag in cookie.lower() for flag in ['secure','httponly','samesite=lax']):failures.append('Session cookie flags are missing.')
+for path in ['xml/settings.local.xml','xml/settings.xml','.tools/backups/probe.sql','.git/config','vendor/autoload.php','bin/migrate-production.php','classes/Base.php','tests/http_fixture.php','composer.lock','release-manifest.json']:
+    if get(path)[0] not in [403,404]:failures.append('Private path was not denied: '+path)
+for failure in failures:print('FAIL: '+failure)
+if failures:raise SystemExit(1)
+print('HTTPS, security headers, cookies, and private-path checks passed. Verify inbox delivery and operational jobs separately.')