mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): scrub deployment secrets from Pi child

Browse Source
This commit is contained in:
marcopan
2026-07-12 11:33:13 +02:00
parent 70a19f290d
commit d500563963
3 changed files with 51 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/test/provider-credentials.test.ts
+19 -1
View File
@@ -118,10 +118,28 @@ test("single-key providers scrub ambient compound companions before injecting th
test("bundle value is injected without exposing bundle metadata to Pi", () => {
const env = buildPiChildEnv({
ambient: { THT_SECRETS_FILE: "/run/secrets/thothii.secrets", THT_MODEL_API_KEY_FILE: "/run/secrets/model" },
ambient: {
THT_SECRETS_FILE: "/run/secrets/thothii.secrets", THT_MODEL_API_KEY_FILE: "/run/secrets/model",
THT_DWH_API_KEY: "dwh-secret", THT_VEC_API_KEY: "vec-reader-secret",
THT_VEC_WRITE_API_KEY: "vec-writer-secret", THT_SSL_CA: "/run/secrets/ca.pem",
THT_CA: "/run/secrets/ca.pem", THT_DWH_API_KEY_SECRET_FILE: "/run/secrets/dwh",
THT_VECTOR_READER_PASSWORD_FILE: "/tmp/thothii-secrets/reader",
THT_VECTOR_WRITER_PASSWORD_FILE: "/tmp/thothii-secrets/writer",
THT_DWH_API_KEY_FILE: "/run/secrets/dwh", THT_VEC_API_KEY_FILE: "/run/secrets/vec",
},
provider: "openai", credentialValue: "bundle-secret",
});
expect(env.OPENAI_API_KEY).toBe("bundle-secret");
expect(env).not.toHaveProperty("THT_SECRETS_FILE");
expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
expect(env).not.toHaveProperty("THT_DWH_API_KEY");
expect(env).not.toHaveProperty("THT_VEC_API_KEY");
expect(env).not.toHaveProperty("THT_VEC_WRITE_API_KEY");
expect(env).not.toHaveProperty("THT_SSL_CA");
expect(env).not.toHaveProperty("THT_CA");
expect(env).not.toHaveProperty("THT_DWH_API_KEY_SECRET_FILE");
expect(env).not.toHaveProperty("THT_VECTOR_READER_PASSWORD_FILE");
expect(env).not.toHaveProperty("THT_VECTOR_WRITER_PASSWORD_FILE");
expect(env).not.toHaveProperty("THT_DWH_API_KEY_FILE");
expect(env).not.toHaveProperty("THT_VEC_API_KEY_FILE");
});