ATOM Documentation

# Get Redis URL from secrets
fly ssh console -c atom-saas

# In the console, run:
cd app
python3 -c "
import os
import redis

# Get Redis URL from environment
redis_url = os.getenv('UPSTASH_REDIS_URL')
print(f'Connecting to Redis...')

# Connect
r = redis.from_url(redis_url)

# Get all keys
all_keys = []
cursor = '0'
while cursor != 0:
    cursor, keys = r.scan(cursor=cursor, count=1000)
    all_keys.extend(keys)

print(f'Total keys: {len(all_keys)}')

# Delete all keys except Brennan's
brennan_id = '31c06fc4-db22-4740-83ea-48ac14f25810'
keys_to_delete = [k for k in all_keys if brennan_id not in str(k)]

print(f'Deleting {len(keys_to_delete)} keys...')

# Delete in batches
for i in range(0, len(keys_to_delete), 100):
    batch = keys_to_delete[i:i+100]
    r.delete(*batch)
    print(f'Deleted {min(i+100, len(keys_to_delete))}/{len(keys_to_delete)} keys')

# Verify
remaining = r.dbsize()
print(f'Remaining keys: {remaining}')
"

fly ssh console -c atom-saas
redis-cli -u $UPSTASH_REDIS_URL FLUSHALL

cd backend-saas
alembic upgrade head

from core.test_data_prevention_service import TestDataPreventionService, get_test_data_prevention_service

@router.post("/tenants")
async def create_tenant(
    request: Request,
    tenant_data: TenantCreate,
    prevention: TestDataPreventionService = Depends(get_test_data_prevention_service),
    db: Session = Depends(get_db)
):
    # Check for test data patterns
    is_suspicious, reason = prevention.check_tenant_creation(
        name=tenant_data.name,
        subdomain=tenant_data.subdomain,
        email=tenant_data.email
    )

    if is_suspicious:
        # Log the attempt
        prevention.log_suspicious_request(
            endpoint="/tenants",
            data=tenant_data.dict(),
            reason=reason,
            ip_address=request.client.host
        )

        # Block the request in production
        raise HTTPException(
            status_code=400,
            detail=f"Suspicious request detected. Please use a real business name and email."
        )

    # Proceed with normal tenant creation
    # ... existing code ...

# Should be blocked
curl -X POST http://localhost:8000/api/tenants \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Test Company",
    "subdomain": "test-company-123",
    "email": "test@example.com"
  }'

# Should be allowed
curl -X POST http://localhost:8000/api/tenants \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corporation",
    "subdomain": "acme-corp",
    "email": "contact@acme.com"
  }'

# Commit changes
git add .
git commit -m "feat: add test data prevention service"
git push origin main

# Deploy
fly deploy -a atom-saas

-- Should return 3
SELECT COUNT(*) FROM tenants;

-- Should list only Brennan + system tenants
SELECT name, subdomain FROM tenants ORDER BY created_at;

-- Check blocked test data attempts
SELECT
    endpoint,
    reason,
    ip_address,
    created_at
FROM test_data_prevention_logs
ORDER BY created_at DESC
LIMIT 20;

# Add tenant creation rate limit
MAX_TENANTS_PER_HOUR_PER_IP = 3
MAX_TENANTS_PER_HOUR_PER_EMAIL = 3

# Add to SUSPICIOUS_PATTERNS
'suspicious_email_domains': [
    'test.com', 'example.com', 'fake.com',
    'temp.com', 'throwaway.email', 'guerrillamail.com',
    'mailinator.com', '10minutemail.com'
]

// Add to signup form
import { HCaptcha } from '@hcaptcha/react-hcaptcha';

<HCaptcha
  sitekey="your-site-key"
  onVerify={handleCaptchaVerify}
/>

# Verify CAPTCHA token
import httpx

async def verify_captcha(token: str):
    async with httpx.AsyncClient() as client:
        response = await client.post(
            "https://hcaptcha.com/siteverify",
            data={
                "response": token,
                "secret": os.getenv("HCAPTCHA_SECRET")
            }
        )
        return response.json()["success"]

# Test Data Cleanup Procedure

## Detection
Run diagnostic: `python3 scripts/diagnostic_prevent_test_data.py`

## Cleanup
1. Backup Brennan tenant
2. Delete test tenants
3. Clear Redis keys
4. Verify only Brennan remains

## Prevention
- Test data prevention service active
- Rate limiting enabled
- CAPTCHA on signup
- Monitoring alerts configured

# Production Data Guidelines

## DO NOT
- Create test tenants in production
- Use test@example.com emails
- Use "test", "demo", "sample" in tenant names
- Create automated tenants without approval

## DO
- Use production-like test data (e.g., "Acme Test Corp")
- Use real email domains
- Run E2E tests against /api/test/* endpoints only
- Use test environment for actual testing