fix(config): refuse to boot with a dev-default JWT_SECRET outside dev/test (PMS-497) #370
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/PMS-497-jwt-secret-production-guard"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
JWT_SECRET fell back to the hardcoded "development-secret-change-in-production" sentinel with no production guard, so a staging/production deploy that forgot to set it would sign session cookies with a publicly known key and let anyone forge sessions.
AppConfig::from_env now calls a new validate_jwt_secret guard that, for any ENVIRONMENT not in {development,dev,test}, returns Err (the server refuses to boot via the existing .expect at startup, consistent with the fail-loud treatment of ENCRYPTION_KEY/SMTP/CORS/migrations) when JWT_SECRET is unset, equals the built-in dev sentinel, or is shorter than 32 bytes. is_production() is wired into the guard as the strictest-environment label so the previously dead method now gates the secret. Dev/test keep the convenience default unchanged.
Adds unit tests covering dev/test pass-through, production rejection of unset/sentinel/too-short secrets, production acceptance of a strong secret, and staging fail-safe. Documents the requirement in .env.example.
#PMS-497
JWT_SECRET fell back to the hardcoded "development-secret-change-in-production" sentinel with no production guard, so a staging/production deploy that forgot to set it would sign session cookies with a publicly known key and let anyone forge sessions. AppConfig::from_env now calls a new validate_jwt_secret guard that, for any ENVIRONMENT not in {development,dev,test}, returns Err (the server refuses to boot via the existing .expect at startup, consistent with the fail-loud treatment of ENCRYPTION_KEY/SMTP/CORS/migrations) when JWT_SECRET is unset, equals the built-in dev sentinel, or is shorter than 32 bytes. is_production() is wired into the guard as the strictest-environment label so the previously dead method now gates the secret. Dev/test keep the convenience default unchanged. Adds unit tests covering dev/test pass-through, production rejection of unset/sentinel/too-short secrets, production acceptance of a strong secret, and staging fail-safe. Documents the requirement in .env.example. #PMS-497The conflict-resolution commit captured a stale staged copy: the from_env struct close was left as the old `let config = Self {...};` tail with a dead `config.validate_jwt_secret(...)` call and the orphaned method, clashing with main's `Ok(Self {...})`. Close with `})`, drop the dead method (PMS-499's resolve_secret supersedes it); the PMS-497 contribution is the retained check_jwt_secret_len guard. #PMS-497