Moheeb Zara
f2df287b35
Independent adversarial audit verdict was NOT SAFE; fixed: - P0-1 /auth/confirm no longer trusts the query `type` (pinned to 'email_change'); a public endpoint feeding an attacker-chosen OTP type into verifyOtp was an unintended auth entrypoint. - P0-2 email sync uses the verifyOtp response user, not a follow-up getUser() that may not reflect the just-verified identity; /me now reconciles space_members.email against the authoritative auth email on load, so a missed sync self-heals (no permanent stale email). - P1-1 requestEmailChange builds the confirm origin from NEXT_PUBLIC_APP_URL only, never request headers (forged Host could redirect the confirmation link / capture token_hash). - P2-1 isSecretConfigField also catches password/token/private_key/ *_token/*_password so non-conventionally-named credentials can't be stored in plaintext integrations.config. 521 tests; build clean.
27 lines
1023 B
TypeScript
27 lines
1023 B
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { isSecretConfigField } from '@/lib/secrets/vault'
|
|
|
|
describe('isSecretConfigField', () => {
|
|
it('treats credential-named fields as secrets to vault', () => {
|
|
for (const k of [
|
|
'client_secret', 'api_key', 'secret_key', 'webhook_secret', 'signing_secret',
|
|
'password', 'token', 'private_key', 'access_token', 'refresh_token',
|
|
'admin_password', 'bot_token', 'CLIENT_SECRET',
|
|
]) {
|
|
expect(isSecretConfigField(k)).toBe(true)
|
|
}
|
|
})
|
|
|
|
it('leaves non-secret config fields in plaintext config', () => {
|
|
for (const k of ['client_id', 'sandbox', 'mode', 'publishable_key', 'username', 'tokenize_mode']) {
|
|
expect(isSecretConfigField(k)).toBe(false)
|
|
}
|
|
})
|
|
|
|
it('never vaults derived flag/ref keys (no recursion on re-save)', () => {
|
|
expect(isSecretConfigField('client_secret_set')).toBe(false)
|
|
expect(isSecretConfigField('client_secret_ref')).toBe(false)
|
|
expect(isSecretConfigField('api_key_ref')).toBe(false)
|
|
})
|
|
})
|