mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: close evidence credential disclosure gaps

Browse Source
This commit is contained in:
marcopan
2026-08-09 19:15:00 +02:00
parent 7126b567b0
commit df8dc1e219
7 changed files with 100 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/test/routes-sessions.test.ts
+12 -5
View File
@@ -2800,15 +2800,19 @@ test("POST /sessions bootstrap failure emits only a fixed recovery message", asy
test.each([
{ mode: "missing signed Evidence file", evidence: true, safe: false, expectedStatus: 409, reachesReadiness: false },
{ mode: "safe signed Evidence file", evidence: true, safe: true, expectedStatus: 503, reachesReadiness: true },
{ mode: "no Evidence descriptor", evidence: false, safe: false, expectedStatus: 503, reachesReadiness: true },
{ mode: "missing signed Evidence file", evidence: true, binding: "missing", expectedStatus: 409, reachesReadiness: false },
{ mode: "unsafe signed Evidence file", evidence: true, binding: "unsafe", expectedStatus: 409, reachesReadiness: false },
{ mode: "safe signed Evidence file", evidence: true, binding: "safe", expectedStatus: 503, reachesReadiness: true },
{ mode: "no Evidence descriptor", evidence: false, binding: "missing", expectedStatus: 503, reachesReadiness: true },
])("real buildApp admission handles $mode before Pi spawn", async ({
evidence, safe, expectedStatus, reachesReadiness,
evidence, binding, expectedStatus, reachesReadiness,
}) => {
const root = mkdtempSync(path.join(tmpdir(), "thoth-evidence-admission-"));
const unsafeRoot = mkdtempSync(path.join(tmpdir(), "thoth-evidence-unsafe-"));
const signedFile = path.join(root, "signed-urls.json");
const unsafeFile = path.join(unsafeRoot, "signed-urls.json");
writeFileSync(signedFile, '["CANARY-SIGNED-QUERY"]');
writeFileSync(unsafeFile, '["CANARY-UNSAFE-SIGNED-QUERY"]');
const variable = "THT_WS_PSD_CLINICAL_EVIDENCE_SIGNED_URLS_FILE";
const previous = {
transport: process.env.THT_WS_PSD_CLINICAL_DWH_TRANSPORT,
@@ -2817,7 +2821,8 @@ test.each([
};
process.env.THT_WS_PSD_CLINICAL_DWH_TRANSPORT = "rest_api";
process.env.THT_WS_PSD_CLINICAL_DWH_BASE_URL = "https://dwh.example.test";
if (safe) process.env[variable] = signedFile;
if (binding === "safe") process.env[variable] = signedFile;
else if (binding === "unsafe") process.env[variable] = unsafeFile;
else delete process.env[variable];
const descriptor = {
@@ -2882,6 +2887,7 @@ test.each([
expect(JSON.stringify(descriptor)).toBe(canonicalBefore);
expect(revision.commit).toBe("a".repeat(40));
expect(response.body).not.toContain("CANARY-SIGNED-QUERY");
expect(response.body).not.toContain("CANARY-UNSAFE-SIGNED-QUERY");
} finally {
const restore = (name: string, value: string | undefined) => {
if (value === undefined) delete process.env[name];
@@ -2891,5 +2897,6 @@ test.each([
restore("THT_WS_PSD_CLINICAL_DWH_BASE_URL", previous.baseUrl);
restore(variable, previous.signed);
rmSync(root, { recursive: true, force: true });
rmSync(unsafeRoot, { recursive: true, force: true });
}
});