Security & Rate Limiting

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• supabase/functions/protocols-execute/index.ts
• supabase/functions/isabella-evaluate/index.ts
• supabase/functions/github-sync/index.ts
• supabase/migrations/20260512080845_110fe96e-4027-403f-98c8-f6d495c1bf4c.sql
• src/components/rdm/kernel.tsx
• scripts/001_rdm_schema.sql

Introduction

The security and rate limiting framework within RDM Digital (TAMV Online) is designed as a multi-layered architecture that combines standard web security practices with specialized "sovereign" protocols. It operates on a Zero-Trust principle where all microservices validate identities and enforce strict data isolation between federations. The system integrates Supabase Auth, Row Level Security (RLS), and a custom cognitive evaluation engine named Isabella to manage access and mitigate systemic risks.

The architecture prioritizes "forensic resilience" and "extreme defense" to protect the digital territory of Real del Monte. It includes mechanisms for payload validation, signature-based webhook security, and automated threat response through the TAMV MD-X4 kernel.
Sources: README.md:65-68, src/components/rdm/kernel.tsx:103-107

Authentication & Authorization Architecture

Access control is managed through a hierarchical system of roles and token-based authentication. The system distinguishes between public endpoints and those requiring specific administrative or user privileges.

Core Authentication Logic

Edge Functions utilize a requireUser or requireAdmin helper to validate incoming JWTs against the Supabase Auth service.

• User Validation: Checks for a valid "Bearer" token and retrieves user data.
• Admin Validation: Extends user validation by calling the has_role RPC function to verify administrative privileges.
• Public Access: Certain endpoints like federation-state and dashboard-summary are explicitly allowed for public read access.

Role-Based Access Control (RBAC)

Roles are enforced at the database level via PostgreSQL triggers and Row Level Security. New users are assigned a tourist role by default unless otherwise specified in metadata (subject to verification).

Role	Scope	Policy Restriction
admin / arquitecto	Global	Can bypass standard filters; writes to federations and pois.
user / ciudadano	Personal	Restricted to own profile, wallet, and transactions.
merchant	Business	Can manage own products and business listings.
operator	Technical	Restricted operational access.

Sources: supabase/migrations/20260512080845_110fe96e-4027-403f-98c8-f6d495c1bf4c.sql:109-130, scripts/001_rdm_schema.sql:16-25

Cognitive Defense & Payload Limiting

The system implements automated evaluation of request content to prevent common attack vectors and resource exhaustion.

Payload Size Constraints

To prevent Denial of Service (DoS) attacks via large payloads, Edge Functions strictly enforce size limits on incoming JSON bodies.

• Maximum Payload: 10,000 characters.
• Response: Requests exceeding this limit return a 413 Payload Too Large error.
  Sources: supabase/functions/protocols-execute/index.ts:50-52

Isabella Cognitive Evaluation

The Isabella engine (Kernel Isabella) evaluates actions such as repository syncing or business publishing. It uses regex-based detection to identify "blocked" patterns.

Pattern Type	Examples	Decision
Malicious	rat, malware, scraping, reverse shell	reject
Commercial	pago, comercio, publicar, sync	alert
Neutral	General actions	accept

Every evaluation is hashed (SHA-256) and signed, creating an immutable record in the bookpi_entries and protocol_executions tables for forensic auditing.
Sources: supabase/functions/isabella-evaluate/index.ts:22-31

TAMV MD-X4 Security Protocols

The TAMV MD-X4 kernel defines four specific protocols to handle system-wide security events.

Protocol Definitions

1. PROTO-01 Autopoiesis: Monitors "Integrity Temperature" (CPU, latency, PQC error rates). Triggers component regeneration if thresholds are exceeded.
2. PROTO-02 Modo Isla (Island Mode): Sustains essential services via P2P local mesh during total connectivity failure.
3. PROTO-03 Extreme Defense: Deploys containment layers (Tenochtitlan, Anubis) to block exfiltration and reinforce forensic logging.
4. PROTO-04 Fénix: Hardens encryption and deactivates non-vital services during global compromise, allowing restoration from snapshots.

External Integration Security

For third-party integrations like Stripe, the system bypasses standard JWT authentication in favor of signature verification.

• Webhook Validation: Incoming Stripe requests are validated using the stripe-signature header and a configured STRIPE_WEBHOOK_SECRET.
• Secret Management: Secrets are stored securely in Supabase vault and accessed via environment variables (Deno.env.get).
  Sources: supabase/functions/protocols-execute/index.ts:20-26

Forensic Auditing & Data Integrity

In accordance with the "Sovereign Fortress City" philosophy, the system maintains an immutable chain of custody for all critical operations.

• Audit Logs: The audit_log table captures actors, actions, and IP addresses. Access is restricted to users with arquitecto or gobierno roles.
• Digital Signatures: The audit_signatures table stores SHA-256 hashes of resources to detect unauthorized alterations.
  Sources: scripts/001_rdm_schema.sql:247-263, supabase/migrations/20260512080845_110fe96e-4027-403f-98c8-f6d495c1bf4c.sql:67-75

Conclusion

Security & Rate Limiting in RDM Digital is not merely a technical layer but a core architectural component of its "civilizational framework." By combining cognitive analysis (Isabella), forensic hashing, and hierarchical kernel protocols (TAMV MD-X4), the system ensures territorial sovereignty and operational continuity even in adversarial environments.