pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-25 16:42:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): stop pre-filling the secrets the server owns (#11436)

Browse Source 
Retargetado para release/v3.8.51 (release/v3.8.50 está congelada — freeze issue #11439). Resolvido um conflito de merge não-relacionado em src/shared/utils/wsPath.ts (originado de um refactor já mergeado nessa branch depois do fork deste PR; o diff real deste PR — scripts/dev/sync-env.mjs + tests/unit/sync-env.test.ts — ficou intacto) e revalidado: typecheck:core limpo, 13/13 testes focados passando.

Segue o precedente correto do #1622 (STORAGE_ENCRYPTION_KEY) para os dois secrets restantes que a postinstall preenchia por engano, defeituando o mecanismo de ensureSecrets(). Obrigado pela contribuição!
This commit is contained in:
Dizzle
2026-08-25 01:04:11 +02:00
committed by GitHub
parent 66ecc09050
commit 6e8fc94732
33 changed files with 914 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
scripts/dev/sync-env.mjs
View File

@@ -37,13 +37,23 @@ function resolveRootDir(rootDir) {
}
}
// Secrets this file may fill in when `.env.example` ships them blank.
//
// JWT_SECRET, API_KEY_SECRET and STORAGE_ENCRYPTION_KEY are deliberately NOT
// here: the server owns them. It restores each one from its durable store, or
// generates and persists it there on first use — STORAGE_ENCRYPTION_KEY in
// bin/omniroute.mjs (guarded by bin/cli/utils/storageKeyProvision.mjs), the
// other two in src/instrumentation-node.ts::ensureSecrets(), which persists to
// the `secrets` namespace of the database under DATA_DIR.
//
// Filling any of them here defeats that: this file lives inside the installed
// package, so `npm i -g` replaces it and postinstall writes a *different*
// value, while ensureSecrets() — which only acts on an empty variable — never
// gets to restore the real one. The secret then rotates silently on every
// update, invalidating dashboard sessions (JWT_SECRET) and API-key CRCs
// (API_KEY_SECRET). STORAGE_ENCRYPTION_KEY was pulled out first, for the same
// reason, when it cost users their encrypted credentials (issue #1622).
const CRYPTO_SECRETS = {
JWT_SECRET: () => randomBytes(64).toString("hex"),
API_KEY_SECRET: () => randomBytes(32).toString("hex"),
// STORAGE_ENCRYPTION_KEY: Generated at server startup instead of postinstall.
// Generated in bin/omniroute.mjs:ensureStorageEncryptionKey() and persisted to
// ~/.omniroute/.env to survive across upgrades. This prevents credential loss
// when upgrading OmniRoute (issue #1622).
MACHINE_ID_SALT: () => `omniroute-${randomBytes(8).toString("hex")}`,
};