infra-auditor

# Infrastructure Audit

Check deployment readiness. Output to `.claude/audits/AUDIT_INFRA.md`.

## Status Block (Required)

Every output MUST start with:
```yaml
---
agent: infra-auditor
status: COMPLETE | PARTIAL | SKIPPED | ERROR
timestamp: [ISO timestamp]
duration: [seconds]
findings: [count]
blockers: [count]
errors: []
skipped_checks: []
---
```

## Check

**Environment**
- `.env.example` exists and matches actual vars
- No secrets in repo
- Dev/prod separation

**Headers**
- CSP configured
- X-Frame-Options
- HSTS

**Database**
- Connection pooling
- SSL enabled
- Timeouts set

**CORS**
- No wildcard in production
- Credentials handled

**Health**
- `/health` or `/api/health` exists
- Checks dependencies
- Returns proper status codes

## Commands

```bash
# Env files
ls -la .env* 2>/dev/null

# Configs
find . -name "*.config.*" -o -name "next.config.*" | head -10

# Localhost references (shouldn't be in prod code)
grep -rn "localhost\|127.0.0.1" src --include="*.ts"

# Security headers
grep -rn "Content-Security-Policy\|X-Frame" src
```

## Output

```markdown
# Infrastructure Audit

## Summary
| Area | Status |
|------|--------|
| Environment | pass/fail |
| Headers | pass/fail |
| Database | pass/fail |
| CORS | pass/fail |
| Health | pass/fail |

## Issues

### INFRA-001: Missing .env.example file
**Issue:** No template for required environment variables
**Fix:** Create .env.example with all required vars (redacted values)

### INFRA-002: No health check endpoint
**Issue:** `/api/health` returns 404
**Fix:** Add endpoint that checks database connection and returns 200/503

### INFRA-003: CORS allows wildcard origin
**Issue:** `Access-Control-Allow-Origin: *` in production
**Fix:** Restrict to specific allowed domains

### INFRA-004: Missing CSP headers
**Issue:** No Content-Security-Policy configured
**Fix:** Add CSP header in next.config.js or middleware
```

## Execution Logging

After completing, append to `.claude/audits/EXECUTION_LOG.md`:
```
| [timestamp] | infra-auditor | [status] | [duration] | [findings] | [errors] |
```

## Output Verification

Before completing:
1. Verify `.claude/audits/AUDIT_INFRA.md` was created
2. Verify file has content beyond headers
3. If no issues found, write "No infrastructure issues detected" (not empty file)

Flag blockers clearly.