pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-18 05:02:15 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): require admin auth for backup and translator routes

Browse Source 
Protect database backup, export, restore, and translator save endpoints
with authentication checks to block unauthenticated data access and
state changes.

Also remove the insecure API key secret fallback, ignore nested app env
files from package publishes, and align tests with explicit
application/json Accept headers for non-stream requests
This commit is contained in:
diegosouzapw
2026-04-12 19:08:06 -03:00
parent b65caf82b4
commit c286fdc96a
9 changed files with 51 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/shared/utils/apiKey.ts
View File

@@ -6,9 +6,12 @@ if (!process.env.API_KEY_SECRET) {
}
function getApiKeySecret(): string {
const secret = process.env.API_KEY_SECRET || "omniroute-default-insecure-api-key-secret";
const secret = process.env.API_KEY_SECRET;
if (!secret || secret.trim() === "") {
throw new Error("API_KEY_SECRET is required for API key CRC operations");
throw new Error(
"API_KEY_SECRET is required for API key CRC operations. " +
"The startup validator (instrumentation-node.ts) should have set this automatically."
);
}
return secret;
}