mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 11:22:15 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
104 lines
2.7 KiB
TypeScript
104 lines
2.7 KiB
TypeScript
/**
|
|
* Secrets Validator — FASE-01 Security Hardening
|
|
*
|
|
* Validates that required secrets are configured with strong values.
|
|
* Called during server initialization (fail-fast on missing or weak secrets).
|
|
*
|
|
* @module secretsValidator
|
|
*/
|
|
|
|
const KNOWN_WEAK_SECRETS = [
|
|
"omniroute-default-secret-change-me",
|
|
"change-me-to-a-long-random-secret",
|
|
"endpoint-proxy-api-key-secret",
|
|
"change-me-storage-encryption-key",
|
|
"your-secret-here",
|
|
"secret",
|
|
"password",
|
|
"changeme",
|
|
];
|
|
|
|
/**
|
|
* @typedef {Object} SecretRule
|
|
* @property {string} name - Environment variable name
|
|
* @property {number} minLength - Minimum acceptable length
|
|
* @property {boolean} required - Whether the secret is required for startup
|
|
* @property {string} description - Human-readable description
|
|
* @property {string} generateHint - Command to generate a strong value
|
|
*/
|
|
|
|
/** @type {SecretRule[]} */
|
|
const SECRET_RULES = [
|
|
{
|
|
name: "JWT_SECRET",
|
|
minLength: 32,
|
|
required: false,
|
|
description: "JWT signing secret for dashboard authentication (auto-generated if not set)",
|
|
generateHint: "openssl rand -base64 48",
|
|
},
|
|
{
|
|
name: "API_KEY_SECRET",
|
|
minLength: 16,
|
|
required: true,
|
|
description: "HMAC secret for API key CRC generation",
|
|
generateHint: "openssl rand -hex 32",
|
|
},
|
|
];
|
|
|
|
/**
|
|
* @typedef {Object} ValidationResult
|
|
* @property {boolean} valid
|
|
* @property {Array<{name: string, issue: string, hint: string}>} errors
|
|
* @property {Array<{name: string, issue: string}>} warnings
|
|
*/
|
|
|
|
/**
|
|
* Validate all required secrets.
|
|
* @param {NodeJS.ProcessEnv} [env]
|
|
* @returns {ValidationResult}
|
|
*/
|
|
export function validateSecrets(env = process.env) {
|
|
const errors = [];
|
|
const warnings = [];
|
|
|
|
for (const rule of SECRET_RULES) {
|
|
const value = env[rule.name];
|
|
|
|
// Missing entirely
|
|
if (!value || value.trim() === "") {
|
|
if (rule.required) {
|
|
errors.push({
|
|
name: rule.name,
|
|
issue: `Required environment variable "${rule.name}" is not set.`,
|
|
hint: `Generate with: ${rule.generateHint}`,
|
|
});
|
|
}
|
|
continue;
|
|
}
|
|
|
|
// Too short
|
|
if (value.length < rule.minLength) {
|
|
errors.push({
|
|
name: rule.name,
|
|
issue: `"${rule.name}" is too short (${value.length} chars, minimum ${rule.minLength}).`,
|
|
hint: `Generate with: ${rule.generateHint}`,
|
|
});
|
|
continue;
|
|
}
|
|
|
|
// Known weak value
|
|
if (KNOWN_WEAK_SECRETS.includes(value.toLowerCase())) {
|
|
warnings.push({
|
|
name: rule.name,
|
|
issue: `"${rule.name}" appears to use a default/weak value. Please generate a strong secret.`,
|
|
});
|
|
}
|
|
}
|
|
|
|
return {
|
|
valid: errors.length === 0,
|
|
errors,
|
|
warnings,
|
|
};
|
|
}
|