mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): scrub deployment secrets from Pi child

Browse Source
This commit is contained in:
marcopan
2026-07-12 11:33:13 +02:00
parent 70a19f290d
commit d500563963
3 changed files with 51 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/pi/provider-credentials.ts
+13
View File
@@ -107,6 +107,11 @@ export function buildPiChildEnv(opts: {
const env = { ...(opts.ambient ?? process.env), ...opts.additions };
delete env.PI_PROVIDER_API_KEY;
delete env.THT_SECRETS_FILE;
delete env.THT_DWH_API_KEY;
delete env.THT_VEC_API_KEY;
delete env.THT_VEC_WRITE_API_KEY;
delete env.THT_SSL_CA;
delete env.THT_CA;
delete env.THT_MODEL_API_KEY_FILE;
delete env.THT_DWH_API_KEY_SECRET_FILE;
delete env.THT_VEC_API_KEY_SECRET_FILE;
@@ -116,6 +121,14 @@ export function buildPiChildEnv(opts: {
delete env.THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_READER_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_WRITER_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_BOOTSTRAP_PASSWORD_FILE;
delete env.THT_VECTOR_MIGRATOR_PASSWORD_FILE;
delete env.THT_VECTOR_READER_PASSWORD_FILE;
delete env.THT_VECTOR_WRITER_PASSWORD_FILE;
delete env.THT_DWH_API_KEY_FILE;
delete env.THT_VEC_API_KEY_FILE;
delete env.THT_VEC_WRITE_API_KEY_FILE;
delete env.THT_SSL_CA_FILE;
for (const name of PI_0803_CREDENTIAL_ENV_NAMES) delete env[name];
const provider = canonicalPiProvider(opts.provider);
if (provider && COMPOUND_PROVIDERS.has(provider)) {