go/outward: the content rule in one place, for the operator channel and node-reads (hq ADR 0310 §4, issue 418) #23

Merged

mesh-admin merged 2 commits from fix/418-node-reads into main 2026-10-12 13:20:23 +00:00

Conversation 5 Commits 2 Files Changed 2

+440

2 Commits

Author	SHA1	Message	Date
jochen	67bfa22132	go/outward: refuse a password in an address, a value given to an env-style secret name, and base64 wherever its slashes fall (review 53, issue 418) ... node-reads applies CheckSecret to env, unit and configuration files, where user:pass@ in a URL, DB_PASS=, MESH_TOKEN= and name = value with spaces passed, and a random base64 value passed when its slashes or dashes cut it into short pieces. A run is now judged in pieces only where it is a path, base64 padding marks a value, and letters alone are random when the case changes as a random string's does, so a CamelCase name still passes.	2026-10-12 14:27:49 +02:00
jochen	4dc5f29d3e	go/outward: the content rule in one place, so the operator channel and node-reads apply the same one (hq ADR 0310 §4, issue 418) ... The operator channel's rule (messenger's content.go, with the secret class split out as in issue 383's branch) moves here as package outward: Check for what may leave on a channel, CheckSecret for a secret's shape alone, which is what a node-reads answer is held to. The messenger switches to it once mesh-catalog #178, which changes that file, has merged.	2026-10-12 13:52:57 +02:00