mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 22:32:22 +03:00
becbc049ef
resolveSelfLoopBearer() in chatAdmissionIdentity.ts fell back to the checked-in literal "sk_omniroute" whenever OMNIROUTE_API_KEY/ROUTER_API_KEY were unset. Anyone reading the source knew this shared secret and could send x-omniroute-admission-bypass: internal + Authorization: Bearer sk_omniroute to skip the heavyweight admission/queueing lease. Traced every caller of isInternalAdmissionBypass(): it only gates the per-connection admission lease in admitChatRequest(), not authentication/authorization, so the real-world blast radius was narrow (capacity-reservation bypass, still subject to the hard byte-size cap) but the predictable literal was still bad practice. Fix: generate a random 32-byte secret at first use, memoized in memory for the process lifetime, used only as the last-resort fallback. Both the in-process caller (audioBridgeHelpers/visionBridgeHelpers) and the verifier (isInternalAdmissionBypass) call the same resolveSelfLoopBearer(), so they still agree on the value within one process. Regression test: tests/unit/chat-admission-selfloop-random-bearer-13679.test.ts Aligned tests/unit/chat-body-admission.test.ts's existing "resolveSelfLoopBearer falls back to..." assertion to the new contract (it previously asserted the old literal). Refs #13679 (PR C of 6 — self-loop bearer default; the umbrella covers 15 other independent findings shipped as separate PRs).