psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

fix(config): refuse dev JWT_SECRET/ENCRYPTION_KEY outside dev/test (PMS-499) #378

Merged
Claude-Run merged 1 commit from fix/PMS-499-guard-dev-secrets-in-prod into main 2026-06-26 12:36:47 +02:00
Conversation 0 Commits 1 Files changed 1 +124 -5
Claude-Run commented 2026-06-26 12:26:07 +02:00
Member
Copy link

AppConfig::from_env silently fell back to the hardcoded dev constants for JWT_SECRET and ENCRYPTION_KEY in any environment, so a production or staging deployment that forgot to set them (or copied the dev defaults) booted with a publicly-known signing secret and at-rest encryption key.

Resolve both secrets through a new resolve_secret helper before the struct is built. In development/dev/test an unset var still falls back to the dev constant. In every other environment (production, staging, or any unrecognized value, which fails safe) an unset var - or one explicitly set to the known dev constant - is now a fatal boot error, mirroring the existing fail-loud SMTP/Google/migrations startup checks. Adds unit tests covering the dev fallback, the unset-in-prod error, the explicit-dev-value-in-prod error, and the real-secret-accepted path.

#PMS-499

AppConfig::from_env silently fell back to the hardcoded dev constants for JWT_SECRET and ENCRYPTION_KEY in any environment, so a production or staging deployment that forgot to set them (or copied the dev defaults) booted with a publicly-known signing secret and at-rest encryption key. Resolve both secrets through a new resolve_secret helper before the struct is built. In development/dev/test an unset var still falls back to the dev constant. In every other environment (production, staging, or any unrecognized value, which fails safe) an unset var - or one explicitly set to the known dev constant - is now a fatal boot error, mirroring the existing fail-loud SMTP/Google/migrations startup checks. Adds unit tests covering the dev fallback, the unset-in-prod error, the explicit-dev-value-in-prod error, and the real-secret-accepted path. #PMS-499
fix(config): refuse dev JWT_SECRET/ENCRYPTION_KEY outside dev/test (PMS-499)
All checks were successful
E2E / Playwright against staging (pull_request) Successful in 26s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 1m55s
Details
Integration / integration tests (pull_request) Successful in 10m17s
Details
Create release / Gate (release-branch merges only) (pull_request) Successful in 1s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
aaad18cd64 
AppConfig::from_env silently fell back to the hardcoded dev constants for JWT_SECRET and ENCRYPTION_KEY in any environment, so a production or staging deployment that forgot to set them (or copied the dev defaults) booted with a publicly-known signing secret and at-rest encryption key.

Resolve both secrets through a new resolve_secret helper before the struct is built. In development/dev/test an unset var still falls back to the dev constant. In every other environment (production, staging, or any unrecognized value, which fails safe) an unset var - or one explicitly set to the known dev constant - is now a fatal boot error, mirroring the existing fail-loud SMTP/Google/migrations startup checks. Adds unit tests covering the dev fallback, the unset-in-prod error, the explicit-dev-value-in-prod error, and the real-secret-accepted path.

#PMS-499
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!378
No description provided.