pastilhas
16369f3570
putSecret/getSecret, `bun run secret:set`, and notify taking its credentials from the store with env as the fallback. this was described two messages ago as a later thing; it is about fifteen lines and it was blocking the honest answer to "where does the .p8 go", so it is done. getKey was the wrong door for anything supplied from outside — it MINTS a random 32-byte value when the purpose is absent, which for a foreign credential means silently authenticating to apple with a fake. getSecret returns null instead, which is what lets the env fallback work. putSecret retires the previous row rather than deleting it: a mistyped paste over a working key should be recoverable, and retiredKeys already exists for that shape. one transaction, because the partial unique index means the retire has to land before the insert. the CLI reads stdin and has deliberately no --value flag: a secret in argv is in shell history, in ps output, and in any audit log that records command lines. offering the flag would make the convenient path the leaky one. it prints a length and the last four characters, never the value. also `bun run notify:test`, which fires officer/core:test at a registered device. the sidecar's port is ephemeral, so it now writes its address to data/notify-server.url on boot and removes it on clean shutdown; the CLI treats an unreachable address as "not running" rather than trusting the file, because a crash leaves one behind. the script says what actually happened, because the day-waster here is that a send with nothing configured returns success and delivers nothing — it refuses up front when channels is empty, and calls out sent:0/failed:0 as "no device registered" rather than letting it read as success. verified end to end with a p-256 key generated locally and then deleted from the store: zero APNS vars in .env, sidecar reported channels: apns, and the send reached the channel. store is back to jwt and offscale only.
51 lines
2.1 KiB
TypeScript
51 lines
2.1 KiB
TypeScript
#!/usr/bin/env bun
|
|
/**
|
|
* Put a secret the platform did not generate into the secret store.
|
|
*
|
|
* bun run secret:set apns-p8 < AuthKey_ABCD123456.p8
|
|
* pbpaste | bun run secret:set fcm-service-account
|
|
*
|
|
* ── Why stdin, and no value argument ──
|
|
*
|
|
* A secret passed as `argv` is in the shell history, in `ps` output for the life of the process, and in
|
|
* any audit log that records command lines. Stdin is none of those. There is deliberately no `--value`
|
|
* flag: offering one would mean the convenient path is the leaky one.
|
|
*
|
|
* Multi-line input is kept verbatim, which is what a PEM needs — no escaping, unlike `.env`.
|
|
*/
|
|
import { putSecret, getSecret, secretStorePath } from '../src/databases/officer_db/src/secret-store';
|
|
|
|
const purpose = process.argv[2];
|
|
|
|
if (!purpose || purpose.startsWith('-')) {
|
|
console.error('usage: bun run secret:set <purpose> < file');
|
|
console.error(' cat AuthKey_ABCD123456.p8 | bun run secret:set apns-p8');
|
|
process.exit(2);
|
|
}
|
|
|
|
const value = (await Bun.stdin.text()).trim();
|
|
|
|
if (!value) {
|
|
console.error(`[secret:set] nothing on stdin — refusing to store an empty secret for '${purpose}'`);
|
|
console.error(' (did you mean `bun run secret:set <purpose> < file`?)');
|
|
process.exit(1);
|
|
}
|
|
|
|
const previous = putSecret(purpose, value);
|
|
|
|
// The value itself is never printed, here or anywhere. Enough to confirm the right thing landed:
|
|
// the length and last four characters identify a paste without reproducing it.
|
|
const fingerprint = `${value.length} chars, ending …${value.slice(-4)}`;
|
|
|
|
if (previous === null) {
|
|
console.log(`[secret:set] '${purpose}' stored — ${fingerprint}`);
|
|
} else if (previous === value) {
|
|
console.log(`[secret:set] '${purpose}' unchanged — ${fingerprint}`);
|
|
} else {
|
|
console.log(`[secret:set] '${purpose}' REPLACED — ${fingerprint}`);
|
|
console.log(` the previous value is retired, not deleted (retiredKeys('${purpose}') has it)`);
|
|
}
|
|
|
|
console.log(`[secret:set] store: ${secretStorePath()}`);
|
|
console.log(`[secret:set] read back: ${getSecret(purpose) === value ? 'ok' : 'MISMATCH — do not restart anything'}`);
|