Claude
5df943095d
The GET /internal/bot-config route returns the DECRYPTED Discord bot token and was mounted on the same Express app / port 3000 that Pangolin proxies publicly. Its only guard was the BOT_INTERNAL_KEY shared secret, and .env.example shipped a placeholder default — so a forwarded path or a weak/unrotated key would expose the plaintext token to the internet. Move server<->bot internal traffic onto its own listener and fail fast on a weak key: - Add server/src/internalApp.js: a standalone Express app mounting requireInternalKey + /internal (and a no-secret /health), mirroring the bot's unpublished port-4100 pattern. - server.js starts a second listener on INTERNAL_PORT (default 3001), closed on graceful shutdown. - Remove the /internal mount from the public v1.router; the public app now 404s /api/v1/internal/bot-config even with a valid key. - Fail fast: new utils/botInternalKey.js rejects an empty, placeholder, or <16-char BOT_INTERNAL_KEY — fatal in production (exit 1), warning in dev. - docker-compose: bot SITE_INTERNAL_URL -> app:3001/internal/bot-config; document that INTERNAL_PORT stays unpublished. - .env.example (root/server/bot): document INTERNAL_PORT, the fail-fast behavior, and a defense-in-depth Pangolin deny rule for /api/v1/internal. Tests: add requireInternalKey.test.js and botInternalKey.test.js (node --test: 93 pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV
27 lines
1.2 KiB
JavaScript
27 lines
1.2 KiB
JavaScript
// Standalone Express app for server<->bot internal traffic. It is mounted on its
|
|
// OWN http listener (INTERNAL_PORT, default 3001) in server.js — an unpublished,
|
|
// compose-network-only port, mirroring how the bot exposes its internal API on
|
|
// 4100. Crucially it is NOT part of the public API app (app.js), so /internal/*
|
|
// (which returns the DECRYPTED Discord bot token) can never ride the same
|
|
// listener Pangolin proxies to the world. Shared-secret gated by
|
|
// requireInternalKey inside internal.routes. See issue #33.
|
|
const express = require('express')
|
|
|
|
const internalRouter = require('./router/v1/internal/internal.routes')
|
|
|
|
const internalApp = express()
|
|
|
|
internalApp.use(express.json())
|
|
|
|
// Liveness probe for this listener (no secret required); mirrors the bot's
|
|
// /health on 4100. Useful for compose healthchecks without exposing anything.
|
|
internalApp.get('/health', (req, res) => res.json({ status: 'ok' }))
|
|
|
|
// requireInternalKey is applied inside internal.routes.
|
|
internalApp.use('/internal', internalRouter)
|
|
|
|
// Anything else on this listener is not a real internal route.
|
|
internalApp.use((req, res) => res.status(404).json({ message: 'Not found' }))
|
|
|
|
module.exports = internalApp
|