eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 15 Wiki Activity

Harden API key file loading

Browse Source
This commit is contained in:
Eric Rakestraw
2026-08-10 18:24:29 +00:00
parent 363313d99c
commit 99b2e1cd81
13 changed files with 370 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

157
internal/app/secrets_env_test.go
View File

@@ -12,6 +12,8 @@ import (
func TestLoadSecretsFromConfigLoadsValidFiles(t *testing.T) {
dir := t.TempDir()
unsetSecretEnvironment(t, "NARRATIO_TEST_SECRET_A")
unsetSecretEnvironment(t, "NARRATIO_TEST_SECRET_B")
mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_A"), "value-1\n")
mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_B"), "value-2\r\n")
mustWriteSecretFile(t, filepath.Join(dir, "not-valid-name.txt"), "ignored")
@@ -73,7 +75,7 @@ func TestLoadSecretsFromConfigPreservesExistingEnv(t *testing.T) {
func TestLoadSecretsFromConfigRelativeDirUsesCWD(t *testing.T) {
cwd := t.TempDir()
secretsDir := filepath.Join(cwd, "secrets")
if err := os.MkdirAll(secretsDir, 0o755); err != nil {
if err := os.MkdirAll(secretsDir, secretDirectoryPrivateMode); err != nil {
t.Fatalf("MkdirAll(%q): %v", secretsDir, err)
}
mustWriteSecretFile(t, filepath.Join(secretsDir, "OBJECT_STORAGE_KEY_ID"), "id-123\n")
@@ -113,8 +115,8 @@ func TestLoadSecretsFromConfigMissingDirFails(t *testing.T) {
if err == nil {
t.Fatal("expected error, got nil")
}
if !strings.Contains(err.Error(), "read secrets env_dir") {
t.Fatalf("error = %q, want read-dir context", err.Error())
if !strings.Contains(err.Error(), "API-key loader") {
t.Fatalf("error = %q, want API-key loader context", err.Error())
}
}
@@ -124,6 +126,7 @@ func TestLoadSecretsFromConfigUnreadableValidEntryFails(t *testing.T) {
}
dir := t.TempDir()
ensureSecretDirectory(t, dir)
broken := filepath.Join(dir, "OPENROUTER_API_KEY")
if err := os.Symlink(filepath.Join(dir, "does-not-exist"), broken); err != nil {
t.Fatalf("Symlink(%q): %v", broken, err)
@@ -139,17 +142,159 @@ func TestLoadSecretsFromConfigUnreadableValidEntryFails(t *testing.T) {
if err == nil {
t.Fatal("expected error, got nil")
}
if !strings.Contains(err.Error(), "read secret file") {
t.Fatalf("error = %q, want read secret file context", err.Error())
if !strings.Contains(err.Error(), "API-key loader") {
t.Fatalf("error = %q, want API-key loader context", err.Error())
}
}
func TestLoadSecretsFromConfigRejectsUnsafeModes(t *testing.T) {
if runtime.GOOS == "windows" {
t.Skip("Windows access control is verified with ACLs")
}
for _, tc := range []struct {
name string
directory os.FileMode
file os.FileMode
wantSecret string
}{
{name: "directory", directory: 0o750, file: secretFilePrivateMode, wantSecret: "directory-secret"},
{name: "file", directory: secretDirectoryPrivateMode, file: 0o640, wantSecret: "file-secret"},
} {
t.Run(tc.name, func(t *testing.T) {
dir := t.TempDir()
unsetSecretEnvironment(t, "OPENROUTER_API_KEY")
path := filepath.Join(dir, "OPENROUTER_API_KEY")
mustWriteSecretFile(t, path, tc.wantSecret)
if err := os.Chmod(dir, tc.directory); err != nil {
t.Fatalf("Chmod(directory) error = %v", err)
}
if err := os.Chmod(path, tc.file); err != nil {
t.Fatalf("Chmod(file) error = %v", err)
}
_, err := loadSecretsFromConfig(secretConfig(dir), nil)
if err == nil || !strings.Contains(err.Error(), "API-key loader") {
t.Fatalf("loadSecretsFromConfig() error = %v, want API-key loader failure", err)
}
if strings.Contains(err.Error(), tc.wantSecret) {
t.Fatalf("error leaked secret content: %q", err)
}
})
}
}
func TestLoadSecretsFromConfigRejectsNonRegularAndOversizedEntries(t *testing.T) {
dir := t.TempDir()
ensureSecretDirectory(t, dir)
unsetSecretEnvironment(t, "OPENROUTER_API_KEY")
if err := os.Mkdir(filepath.Join(dir, "OPENROUTER_API_KEY"), secretDirectoryPrivateMode); err != nil {
t.Fatalf("Mkdir(non-regular entry) error = %v", err)
}
if _, err := loadSecretsFromConfig(secretConfig(dir), nil); err == nil || !strings.Contains(err.Error(), "not a regular file") {
t.Fatalf("loadSecretsFromConfig(non-regular) error = %v, want regular-file failure", err)
}
if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
t.Fatalf("Remove(non-regular entry) error = %v", err)
}
overLimit := strings.Repeat("credential-value-", int(APIKeyFileByteLimit/17)+1)
mustWriteSecretFile(t, filepath.Join(dir, "OPENROUTER_API_KEY"), overLimit)
_, err := loadSecretsFromConfig(secretConfig(dir), nil)
if err == nil || !strings.Contains(err.Error(), "API-key loader") || !strings.Contains(err.Error(), "8192-byte limit") {
t.Fatalf("loadSecretsFromConfig(over-limit) error = %v, want bounded API-key loader failure", err)
}
if strings.Contains(err.Error(), overLimit[:32]) {
t.Fatalf("error leaked secret content: %q", err)
}
}
func TestLoadSecretsFromConfigRejectsSymlinkAndAncestorReplacement(t *testing.T) {
if runtime.GOOS == "windows" {
t.Skip("symlink behavior differs on windows")
}
dir := t.TempDir()
outside := t.TempDir()
ensureSecretDirectory(t, dir)
unsetSecretEnvironment(t, "OPENROUTER_API_KEY")
outsideValue := "outside-secret-value"
mustWriteSecretFile(t, filepath.Join(outside, "OPENROUTER_API_KEY"), outsideValue)
if err := os.Symlink(filepath.Join(outside, "OPENROUTER_API_KEY"), filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
t.Fatalf("Symlink(leaf) error = %v", err)
}
_, err := loadSecretsFromConfig(secretConfig(dir), nil)
if err == nil || !strings.Contains(err.Error(), "API-key loader") {
t.Fatalf("loadSecretsFromConfig(symlink) error = %v, want failure", err)
}
if strings.Contains(err.Error(), outsideValue) {
t.Fatalf("error leaked secret content: %q", err)
}
if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
t.Fatalf("Remove(leaf symlink) error = %v", err)
}
mustWriteSecretFile(t, filepath.Join(dir, "OPENROUTER_API_KEY"), "inside-secret")
original := readSecretsDirectoryEntries
readSecretsDirectoryEntries = func(path string) ([]os.DirEntry, error) {
entries, err := original(path)
if err != nil {
return nil, err
}
if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
return nil, err
}
if err := os.Remove(dir); err != nil {
return nil, err
}
if err := os.Symlink(outside, dir); err != nil {
return nil, err
}
return entries, nil
}
t.Cleanup(func() { readSecretsDirectoryEntries = original })
_, err = loadSecretsFromConfig(secretConfig(dir), nil)
if err == nil || !strings.Contains(err.Error(), "API-key loader") {
t.Fatalf("loadSecretsFromConfig(ancestor replacement) error = %v, want failure", err)
}
if _, exists := os.LookupEnv("OPENROUTER_API_KEY"); exists {
t.Fatal("ancestor replacement loaded a secret value")
}
}
func mustWriteSecretFile(t *testing.T, path, contents string) {
t.Helper()
if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
if err := os.MkdirAll(filepath.Dir(path), secretDirectoryPrivateMode); err != nil {
t.Fatalf("MkdirAll(%q): %v", path, err)
}
if err := os.Chmod(filepath.Dir(path), secretDirectoryPrivateMode); err != nil {
t.Fatalf("Chmod(%q): %v", filepath.Dir(path), err)
}
if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
t.Fatalf("WriteFile(%q): %v", path, err)
}
}
func secretConfig(dir string) *config.Config {
return &config.Config{Pipeline: &config.PipelineConfig{Secrets: &config.SecretsConfig{EnvDir: dir}}}
}
func unsetSecretEnvironment(t *testing.T, name string) {
t.Helper()
previous, existed := os.LookupEnv(name)
if err := os.Unsetenv(name); err != nil {
t.Fatalf("Unsetenv(%q): %v", name, err)
}
t.Cleanup(func() {
if existed {
_ = os.Setenv(name, previous)
return
}
_ = os.Unsetenv(name)
})
}
func ensureSecretDirectory(t *testing.T, directory string) {
t.Helper()
if err := os.Chmod(directory, secretDirectoryPrivateMode); err != nil {
t.Fatalf("Chmod(%q): %v", directory, err)
}
}