Spaces:
Paused
Paused
File size: 4,497 Bytes
b152fd5 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 | import { randomBytes } from "node:crypto";
import fs from "node:fs";
import path from "node:path";
import type { PaperclipConfig } from "../config/schema.js";
import type { CheckResult } from "./index.js";
import { resolveRuntimeLikePath } from "./path-resolver.js";
function decodeMasterKey(raw: string): Buffer | null {
const trimmed = raw.trim();
if (!trimmed) return null;
if (/^[A-Fa-f0-9]{64}$/.test(trimmed)) {
return Buffer.from(trimmed, "hex");
}
try {
const decoded = Buffer.from(trimmed, "base64");
if (decoded.length === 32) return decoded;
} catch {
// ignored
}
if (Buffer.byteLength(trimmed, "utf8") === 32) {
return Buffer.from(trimmed, "utf8");
}
return null;
}
function withStrictModeNote(
base: Pick<CheckResult, "name" | "status" | "message" | "canRepair" | "repair" | "repairHint">,
config: PaperclipConfig,
): CheckResult {
const strictModeDisabledInDeployedSetup =
config.database.mode === "postgres" && config.secrets.strictMode === false;
if (!strictModeDisabledInDeployedSetup) return base;
if (base.status === "fail") return base;
return {
...base,
status: "warn",
message: `${base.message}; strict secret mode is disabled for postgres deployment`,
repairHint: base.repairHint
? `${base.repairHint}. Consider enabling secrets.strictMode`
: "Consider enabling secrets.strictMode",
};
}
export function secretsCheck(config: PaperclipConfig, configPath?: string): CheckResult {
const provider = config.secrets.provider;
if (provider !== "local_encrypted") {
return {
name: "Secrets adapter",
status: "fail",
message: `${provider} is configured, but this build only supports local_encrypted`,
canRepair: false,
repairHint: "Run `paperclipai configure --section secrets` and set provider to local_encrypted",
};
}
const envMasterKey = process.env.PAPERCLIP_SECRETS_MASTER_KEY;
if (envMasterKey && envMasterKey.trim().length > 0) {
if (!decodeMasterKey(envMasterKey)) {
return {
name: "Secrets adapter",
status: "fail",
message:
"PAPERCLIP_SECRETS_MASTER_KEY is invalid (expected 32-byte base64, 64-char hex, or raw 32-char string)",
canRepair: false,
repairHint: "Set PAPERCLIP_SECRETS_MASTER_KEY to a valid key or unset it to use a key file",
};
}
return withStrictModeNote(
{
name: "Secrets adapter",
status: "pass",
message: "Local encrypted provider configured via PAPERCLIP_SECRETS_MASTER_KEY",
},
config,
);
}
const keyFileOverride = process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
const configuredPath =
keyFileOverride && keyFileOverride.trim().length > 0
? keyFileOverride.trim()
: config.secrets.localEncrypted.keyFilePath;
const keyFilePath = resolveRuntimeLikePath(configuredPath, configPath);
if (!fs.existsSync(keyFilePath)) {
return withStrictModeNote(
{
name: "Secrets adapter",
status: "warn",
message: `Secrets key file does not exist yet: ${keyFilePath}`,
canRepair: true,
repair: () => {
fs.mkdirSync(path.dirname(keyFilePath), { recursive: true });
fs.writeFileSync(keyFilePath, randomBytes(32).toString("base64"), {
encoding: "utf8",
mode: 0o600,
});
try {
fs.chmodSync(keyFilePath, 0o600);
} catch {
// best effort
}
},
repairHint: "Run with --repair to create a local encrypted secrets key file",
},
config,
);
}
let raw: string;
try {
raw = fs.readFileSync(keyFilePath, "utf8");
} catch (err) {
return {
name: "Secrets adapter",
status: "fail",
message: `Could not read secrets key file: ${err instanceof Error ? err.message : String(err)}`,
canRepair: false,
repairHint: "Check file permissions or set PAPERCLIP_SECRETS_MASTER_KEY",
};
}
if (!decodeMasterKey(raw)) {
return {
name: "Secrets adapter",
status: "fail",
message: `Invalid key material in ${keyFilePath}`,
canRepair: false,
repairHint: "Replace with valid key material or delete it and run doctor --repair",
};
}
return withStrictModeNote(
{
name: "Secrets adapter",
status: "pass",
message: `Local encrypted provider configured with key file ${keyFilePath}`,
},
config,
);
}
|