mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): scrub raw deployment secret values

Browse Source
This commit is contained in:
marcopan
2026-07-12 11:34:32 +02:00
parent d500563963
commit 8518a73685
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/pi/provider-credentials.ts
+5
View File
@@ -110,8 +110,13 @@ export function buildPiChildEnv(opts: {
delete env.THT_DWH_API_KEY; delete env.THT_DWH_API_KEY;
delete env.THT_VEC_API_KEY; delete env.THT_VEC_API_KEY;
delete env.THT_VEC_WRITE_API_KEY; delete env.THT_VEC_WRITE_API_KEY;
delete env.THT_MODEL_API_KEY;
delete env.THT_SSL_CA; delete env.THT_SSL_CA;
delete env.THT_CA; delete env.THT_CA;
delete env.THT_VECTOR_BOOTSTRAP_PASSWORD;
delete env.THT_VECTOR_MIGRATOR_PASSWORD;
delete env.THT_VECTOR_READER_PASSWORD;
delete env.THT_VECTOR_WRITER_PASSWORD;
delete env.THT_MODEL_API_KEY_FILE; delete env.THT_MODEL_API_KEY_FILE;
delete env.THT_DWH_API_KEY_SECRET_FILE; delete env.THT_DWH_API_KEY_SECRET_FILE;
delete env.THT_VEC_API_KEY_SECRET_FILE; delete env.THT_VEC_API_KEY_SECRET_FILE;
backend/test/provider-credentials.test.ts
+3
View File
@@ -123,6 +123,7 @@ test("bundle value is injected without exposing bundle metadata to Pi", () => {
THT_DWH_API_KEY: "dwh-secret", THT_VEC_API_KEY: "vec-reader-secret", THT_DWH_API_KEY: "dwh-secret", THT_VEC_API_KEY: "vec-reader-secret",
THT_VEC_WRITE_API_KEY: "vec-writer-secret", THT_SSL_CA: "/run/secrets/ca.pem", THT_VEC_WRITE_API_KEY: "vec-writer-secret", THT_SSL_CA: "/run/secrets/ca.pem",
THT_CA: "/run/secrets/ca.pem", THT_DWH_API_KEY_SECRET_FILE: "/run/secrets/dwh", THT_CA: "/run/secrets/ca.pem", THT_DWH_API_KEY_SECRET_FILE: "/run/secrets/dwh",
THT_MODEL_API_KEY: "model-secret", THT_VECTOR_READER_PASSWORD: "reader-secret",
THT_VECTOR_READER_PASSWORD_FILE: "/tmp/thothii-secrets/reader", THT_VECTOR_READER_PASSWORD_FILE: "/tmp/thothii-secrets/reader",
THT_VECTOR_WRITER_PASSWORD_FILE: "/tmp/thothii-secrets/writer", THT_VECTOR_WRITER_PASSWORD_FILE: "/tmp/thothii-secrets/writer",
THT_DWH_API_KEY_FILE: "/run/secrets/dwh", THT_VEC_API_KEY_FILE: "/run/secrets/vec", THT_DWH_API_KEY_FILE: "/run/secrets/dwh", THT_VEC_API_KEY_FILE: "/run/secrets/vec",
@@ -135,8 +136,10 @@ test("bundle value is injected without exposing bundle metadata to Pi", () => {
expect(env).not.toHaveProperty("THT_DWH_API_KEY"); expect(env).not.toHaveProperty("THT_DWH_API_KEY");
expect(env).not.toHaveProperty("THT_VEC_API_KEY"); expect(env).not.toHaveProperty("THT_VEC_API_KEY");
expect(env).not.toHaveProperty("THT_VEC_WRITE_API_KEY"); expect(env).not.toHaveProperty("THT_VEC_WRITE_API_KEY");
expect(env).not.toHaveProperty("THT_MODEL_API_KEY");
expect(env).not.toHaveProperty("THT_SSL_CA"); expect(env).not.toHaveProperty("THT_SSL_CA");
expect(env).not.toHaveProperty("THT_CA"); expect(env).not.toHaveProperty("THT_CA");
expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD");
expect(env).not.toHaveProperty("THT_DWH_API_KEY_SECRET_FILE"); expect(env).not.toHaveProperty("THT_DWH_API_KEY_SECRET_FILE");
expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD_FILE"); expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD_FILE");
expect(env).not.toHaveProperty("THT_VECTOR_WRITER_PASSWORD_FILE"); expect(env).not.toHaveProperty("THT_VECTOR_WRITER_PASSWORD_FILE");