Claude
5df943095d
The GET /internal/bot-config route returns the DECRYPTED Discord bot token and was mounted on the same Express app / port 3000 that Pangolin proxies publicly. Its only guard was the BOT_INTERNAL_KEY shared secret, and .env.example shipped a placeholder default — so a forwarded path or a weak/unrotated key would expose the plaintext token to the internet. Move server<->bot internal traffic onto its own listener and fail fast on a weak key: - Add server/src/internalApp.js: a standalone Express app mounting requireInternalKey + /internal (and a no-secret /health), mirroring the bot's unpublished port-4100 pattern. - server.js starts a second listener on INTERNAL_PORT (default 3001), closed on graceful shutdown. - Remove the /internal mount from the public v1.router; the public app now 404s /api/v1/internal/bot-config even with a valid key. - Fail fast: new utils/botInternalKey.js rejects an empty, placeholder, or <16-char BOT_INTERNAL_KEY — fatal in production (exit 1), warning in dev. - docker-compose: bot SITE_INTERNAL_URL -> app:3001/internal/bot-config; document that INTERNAL_PORT stays unpublished. - .env.example (root/server/bot): document INTERNAL_PORT, the fail-fast behavior, and a defense-in-depth Pangolin deny rule for /api/v1/internal. Tests: add requireInternalKey.test.js and botInternalKey.test.js (node --test: 93 pass). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV
67 lines
2.1 KiB
JavaScript
67 lines
2.1 KiB
JavaScript
const { test } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
|
|
const requireInternalKey = require('../src/middleware/requireInternalKey')
|
|
const { startApp } = require('./_helper')
|
|
|
|
const KEY = 'test-internal-key-1234567890'
|
|
|
|
async function withApp(run) {
|
|
const prev = process.env.BOT_INTERNAL_KEY
|
|
process.env.BOT_INTERNAL_KEY = KEY
|
|
const app = await startApp((a) => {
|
|
a.get('/internal/thing', requireInternalKey, (req, res) => res.json({ ok: true }))
|
|
})
|
|
try {
|
|
await run(app)
|
|
} finally {
|
|
await app.close()
|
|
if (prev === undefined) delete process.env.BOT_INTERNAL_KEY
|
|
else process.env.BOT_INTERNAL_KEY = prev
|
|
}
|
|
}
|
|
|
|
test('requireInternalKey: 401 when no key header is sent', async () => {
|
|
await withApp(async (app) => {
|
|
const res = await fetch(`${app.url}/internal/thing`)
|
|
assert.equal(res.status, 401)
|
|
})
|
|
})
|
|
|
|
test('requireInternalKey: 401 on a wrong key', async () => {
|
|
await withApp(async (app) => {
|
|
const res = await fetch(`${app.url}/internal/thing`, {
|
|
headers: { 'X-Internal-Key': 'nope' },
|
|
})
|
|
assert.equal(res.status, 401)
|
|
})
|
|
})
|
|
|
|
test('requireInternalKey: 200 with the correct key', async () => {
|
|
await withApp(async (app) => {
|
|
const res = await fetch(`${app.url}/internal/thing`, {
|
|
headers: { 'X-Internal-Key': KEY },
|
|
})
|
|
assert.equal(res.status, 200)
|
|
const body = await res.json()
|
|
assert.deepEqual(body, { ok: true })
|
|
})
|
|
})
|
|
|
|
test('requireInternalKey: 401 when the expected key is empty (never a wildcard)', async () => {
|
|
const prev = process.env.BOT_INTERNAL_KEY
|
|
process.env.BOT_INTERNAL_KEY = ''
|
|
const app = await startApp((a) => {
|
|
a.get('/internal/thing', requireInternalKey, (req, res) => res.json({ ok: true }))
|
|
})
|
|
try {
|
|
// Even sending an empty key must not match an empty expected key.
|
|
const res = await fetch(`${app.url}/internal/thing`, { headers: { 'X-Internal-Key': '' } })
|
|
assert.equal(res.status, 401)
|
|
} finally {
|
|
await app.close()
|
|
if (prev === undefined) delete process.env.BOT_INTERNAL_KEY
|
|
else process.env.BOT_INTERNAL_KEY = prev
|
|
}
|
|
})
|