mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
42425d6bcd
QStash was already gone — `lib/cron/index.ts` shipped a stub whose publishJSON
logged a warning, returned `{ messageId: "noop" }` and DISCARDED the event. Every
customer webhook has been silently dropped since. Its sibling stub, `receiver`,
returned `true` for any signature.
Deliveries now go to a KV list (lib/kv-queue/webhooks.ts): rpush to enqueue, lpop
to take, failures returned with a raised attempt count until MAX_ATTEMPTS so a
customer endpoint that is briefly down keeps its event and one that is gone does
not spin. The signature is computed at enqueue and carried with the item, so a
retry re-sends identical bytes rather than re-signing a payload whose shape may
have moved. Enqueue never throws: a KV outage must not fail the caller's write.
/api/cron/webhooks drains it.
The cron guard was worse than the stub. It read
if (process.env.VERCEL === "1") { ...verify Upstash-Signature... }
and this app runs on Kubernetes, so the branch was ALWAYS false — every
/api/cron/* route was reachable by anyone with the path, and the verifier behind
it asserted nothing anyway. Replaced with a shared secret that FAILS CLOSED: no
CRON_SECRET, no cron. Nothing schedules these today, so a missing secret costs
nothing where the old behaviour cost everything. It is a secret, not an identity —
user-facing auth stays with Hanzo IAM.
Also drops the QStash env block, the dead Upstash locker vars, and the vendor
vocabulary in lib/kv.ts, where the shims describe a SHAPE (options object,
{ score, member }) rather than whoever shipped it.
Verified with npx tsc --noEmit: 100 errors before and after, 0 introduced,
compared set-wise by file:line:code.
Co-authored-by: Hanzo Dev <[email protected]>
35 lines
1.6 KiB
TypeScript
35 lines
1.6 KiB
TypeScript
/**
|
|
* Guard for the internal cron endpoints.
|
|
*
|
|
* What this replaces: an Upstash-Signature check that could not run. It sat
|
|
* behind `if (process.env.VERCEL === "1")`, and this app runs on Kubernetes —
|
|
* so the branch was always false and every /api/cron/* route was reachable by
|
|
* anyone who knew the path. The signature verifier behind it was a stub that
|
|
* returned `true` unconditionally, so even on Vercel it asserted nothing.
|
|
*
|
|
* This is a shared secret between the scheduler and these routes — not an
|
|
* identity, and deliberately not a second auth system. Anything user-facing
|
|
* goes through Hanzo IAM.
|
|
*
|
|
* It FAILS CLOSED: no CRON_SECRET configured means no cron may run. That is the
|
|
* safe direction — nothing schedules these today, so a missing secret costs
|
|
* nothing, while the old behaviour left them open to the internet.
|
|
*/
|
|
export function verifyCron(req: Request): { ok: true } | { ok: false; status: number } {
|
|
const expected = process.env.CRON_SECRET;
|
|
if (!expected) return { ok: false, status: 503 };
|
|
|
|
const header = req.headers.get("authorization") ?? "";
|
|
const presented = header.startsWith("Bearer ") ? header.slice(7) : header;
|
|
if (!presented) return { ok: false, status: 401 };
|
|
|
|
// Length-independent compare: bail on length first, then diff every byte so
|
|
// the loop cannot return early on the first mismatch.
|
|
if (presented.length !== expected.length) return { ok: false, status: 401 };
|
|
let diff = 0;
|
|
for (let i = 0; i < expected.length; i++) {
|
|
diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);
|
|
}
|
|
return diff === 0 ? { ok: true } : { ok: false, status: 401 };
|
|
}
|