Nick SzaunigandClaude Opus 5.5
c01a38835a
Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks: - run roles api/worker/job/all with shared startup checks (Task 1) - schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2) - audit, notifications and domain events written in the same transaction (Task 3) - dispatcher with SKIP LOCKED claims, retries and stale release (Task 4) - worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5) - worker process and entry points (Task 6) - throttler counters in Postgres (Task 19) - separate keys per purpose with key ring (Task 20) - public origin page without exact location (Task 22) - shop keys split into read and write (Task 23) - Kustomize base, components, overlay encry, CI validation (Task 26) Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks: - brood frames, read endpoints, apiary overview and offline pack - network basics, offline queue v3, navigation sheets, form building blocks - new inspection with last-time hints and weather, varroa per day, treatment prefill, apiary page with round - inspection photo (Task 10) is implemented, review pending Not rolled out. Remaining tasks follow in later commits. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
92 lines
3.4 KiB
TypeScript
92 lines
3.4 KiB
TypeScript
import { Logger } from '@nestjs/common';
|
|
import { encryptMfaSecret } from '../auth/mfa/mfa-crypto.util';
|
|
import { KEY_ID_PATTERN } from '../common/crypto/key-ring';
|
|
import {
|
|
openWebhookSecret,
|
|
sealWebhookSecret,
|
|
webhookSecretNeedsRekey,
|
|
} from './webhook-secret';
|
|
|
|
// Written by the code before the key ring: "enc:v1:" + AES-256-GCM with
|
|
// sha256(JWT_ACCESS_SECRET), JWT_ACCESS_SECRET = 'x' * 40.
|
|
const LEGACY_SEALED =
|
|
'enc:v1:MlOPzAuy67RTMMb9.YslrBRO2dTYumby+P28INg==.KFmilRVOsJtQ';
|
|
// Rows from before webhook secrets were encrypted at all.
|
|
const LEGACY_PLAIN = '3f9c2a7d41e8b6c05a1d9e7f3b2c8a64';
|
|
|
|
describe('webhook-secret', () => {
|
|
const originalEnv = { ...process.env };
|
|
|
|
beforeEach(() => {
|
|
process.env.JWT_ACCESS_SECRET = 'x'.repeat(40);
|
|
process.env.WEBHOOK_ENCRYPTION_KEY = 'w'.repeat(40);
|
|
delete process.env.WEBHOOK_ENCRYPTION_KEY_PREVIOUS;
|
|
delete process.env.MFA_ENCRYPTION_KEY;
|
|
jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
|
|
});
|
|
|
|
afterEach(() => {
|
|
process.env = { ...originalEnv };
|
|
jest.restoreAllMocks();
|
|
});
|
|
|
|
it('seals with the webhook key and a key id', () => {
|
|
const stored = sealWebhookSecret('topsecret');
|
|
|
|
expect(stored).toMatch(KEY_ID_PATTERN);
|
|
expect(stored).not.toContain('topsecret');
|
|
expect(openWebhookSecret(stored)).toBe('topsecret');
|
|
expect(webhookSecretNeedsRekey(stored)).toBe(false);
|
|
});
|
|
|
|
it('opens legacy enc:v1 and plaintext webhook secrets and flags them for rekey', () => {
|
|
expect(openWebhookSecret(LEGACY_SEALED)).toBe('topsecret');
|
|
expect(openWebhookSecret(LEGACY_PLAIN)).toBe(LEGACY_PLAIN);
|
|
expect(webhookSecretNeedsRekey(LEGACY_SEALED)).toBe(true);
|
|
expect(webhookSecretNeedsRekey(LEGACY_PLAIN)).toBe(true);
|
|
});
|
|
|
|
it('opens a secret sealed with WEBHOOK_ENCRYPTION_KEY_PREVIOUS and flags it for rekey', () => {
|
|
const stored = sealWebhookSecret('topsecret');
|
|
process.env.WEBHOOK_ENCRYPTION_KEY_PREVIOUS =
|
|
process.env.WEBHOOK_ENCRYPTION_KEY;
|
|
process.env.WEBHOOK_ENCRYPTION_KEY = 'v'.repeat(40);
|
|
|
|
expect(openWebhookSecret(stored)).toBe('topsecret');
|
|
expect(webhookSecretNeedsRekey(stored)).toBe(true);
|
|
});
|
|
|
|
it('fails closed on a legacy enc:v1 secret once JWT_ACCESS_SECRET changed', () => {
|
|
process.env.JWT_ACCESS_SECRET = 'z'.repeat(40);
|
|
|
|
expect(() => openWebhookSecret(LEGACY_SEALED)).toThrow(
|
|
'ciphertext failed authentication',
|
|
);
|
|
});
|
|
|
|
it('never retries a k…: value that fails authentication as legacy or plain secret', () => {
|
|
const warn = jest.spyOn(Logger.prototype, 'warn');
|
|
const currentKeyId = sealWebhookSecret('topsecret').split(':')[0];
|
|
// A valid legacy ciphertext behind the current key id: only a retry with
|
|
// sha256(JWT_ACCESS_SECRET) could open it, and only the plaintext
|
|
// fallback would hand the stored string back.
|
|
const legacyPayload = LEGACY_SEALED.slice('enc:v1:'.length);
|
|
|
|
expect(() => openWebhookSecret(`${currentKeyId}:${legacyPayload}`)).toThrow(
|
|
'ciphertext failed authentication',
|
|
);
|
|
expect(() => openWebhookSecret(`k00000000:${legacyPayload}`)).toThrow(
|
|
'unknown key id',
|
|
);
|
|
expect(warn).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('keeps MFA and webhook keys apart, even on the shared dev fallback', () => {
|
|
delete process.env.WEBHOOK_ENCRYPTION_KEY;
|
|
|
|
expect(() => openWebhookSecret(encryptMfaSecret('topsecret'))).toThrow(
|
|
'unknown key id',
|
|
);
|
|
});
|
|
});
|