jochen
eb42806379
mesh/merge-gate head eb4280637906 merged into trunk 53e51864969f — pass: builds baserow, gitea, grafana, home-assistant, icecast, influxdb, letta, mailu, n…
mesh/repo-check head eb4280637906 merged into trunk 53e51864969f — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the ch…
mesh/delivery delivered
mesh/delivery-group group fix/342-a-secret-is-never-a-setting delivered: every member is delivered
grafana's client logged in with a token setting ahead of the vault's admin password, and its runtime config let a layer set token. The token setting is now ignored and said, token is protected, and the vault's password comes first. checks/secrets/known could gain a line hiding a newly unprotected key. merge-check.sh now judges it against the trunk's copy at the merge base, and refuses an added line.
41 lines
2.0 KiB
TypeScript
41 lines
2.0 KiB
TypeScript
// A password, a token or an API key is the vault's, never a setting (novox/hq issue 342): grafana logs in
|
|
// with the vault's admin password, a `token` in the settings file is ignored, and that is said once, by the
|
|
// key alone. The runtime config keeps both keys protected, so the controller refuses a layer setting either.
|
|
|
|
import { test, mock } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
|
|
import { GrafanaClient } from "../dist/client.js";
|
|
|
|
const SETTING = "one-a-setting-carried";
|
|
const VAULT = "the-vault-made-this";
|
|
|
|
test("the vault's admin password is used, a token setting is ignored and said once, without its value", () => {
|
|
const said: string[] = [];
|
|
const err = mock.method(console, "error", (...args: unknown[]) => { said.push(args.join(" ")); });
|
|
try {
|
|
const dir = mkdtempSync(join(tmpdir(), "grafana-342-"));
|
|
// What the runtime config holds once the vault filled it, with a token a layer carried beside it.
|
|
writeFileSync(join(dir, "config.json"), JSON.stringify({ user: "admin", password: VAULT, token: SETTING }));
|
|
const env = { MESH_GRAFANA_CONFIG_FILE: join(dir, "config.json") };
|
|
const basic = "Basic " + Buffer.from(`admin:${VAULT}`).toString("base64");
|
|
assert.equal((GrafanaClient.fromEnv(env) as any).authHeader, basic);
|
|
assert.equal((GrafanaClient.fromEnv(env) as any).authHeader, basic);
|
|
assert.deepEqual(said, ["the setting token is ignored: it comes from the vault"]);
|
|
assert.ok(!said.join("\n").includes(SETTING), "the setting's value is never said");
|
|
} finally {
|
|
err.mock.restore();
|
|
}
|
|
});
|
|
|
|
test("the runtime config keeps password and token protected", () => {
|
|
const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8")) as {
|
|
resources: { id: string; protected?: string[] }[];
|
|
};
|
|
const runtime = manifest.resources.find((r) => r.id === "runtime-config");
|
|
assert.deepEqual(runtime?.protected, ["password", "token"]);
|
|
});
|