Files

T

cgalo5758 b245bdb0a9 Fix security audit findings from 2026-09-21 scan

Remediate six confirmed security issues: deployment-only config keys,
bounded provider responses, short-lived registration sessions, private
init file mode, FedWiki workflow authorization, and switch preview
gates.

- Add DeploymentOnly config key declaration; refuse runtime overrides
  for keys that decide where secrets are sent
- Create httplimit package; bound all provider response reads at 8 MiB
- Set fifteen-minute deadline on /register sessions
- Write mc-config.yaml with 0600 permissions
- Derive FedWiki workflow IDs from site IDs; re-authorize sites before
  mutating activities
- Apply switch authorization gates to the proration preview

2026-09-21 13:57:57 -05:00

2.2 KiB

Raw Blame History

console-init Specification

Purpose

TBD - created by archiving change member-console-init-scaffold. Update Purpose after archive.

Requirements

Requirement: `init` scaffolds a usable starter config

member-console init <path> SHALL write a starter mc-config.yaml to the target directory composed of the embedded core configuration template (embeds.Config) plus one generated section per registered integration that declares configuration (config.ConfigProvider), not a placeholder stub. The scaffolded file SHALL be valid YAML containing every configuration key that member-console start requires, with commented placeholder values the operator fills in. Each generated integration section SHALL list that integration's ConfigSpec keys as commented lines carrying the key's usage text, its default when one is declared, and a file-based alternative note for secret keys. The embedded core template SHALL NOT hand-list keys that an integration's ConfigSpec declares. The template's OIDC issuer example SHALL reference a dedicated application realm placeholder, never an administration realm such as Keycloak's master. The file SHALL be created with mode 0600: it is where the deployment's credentials are entered.

Scenario: init writes the embedded starter template

WHEN an operator runs member-console init ./my-instance
THEN ./my-instance/mc-config.yaml SHALL be created from the embedded template
AND it SHALL parse as YAML and contain the required keys (base-url, db-dsn, valkey-addr, valkey-password, oidc-idp-issuer-url, oidc-sp-client-id)
AND its mode SHALL be 0600

Scenario: Every declaring integration appears in the scaffold

WHEN the scaffolded config is inspected
THEN it SHALL contain one commented section per registered integration that declares configuration, including every key from that integration's ConfigSpec
AND no registered declaring integration SHALL be absent

Scenario: Integration sections are generated, not hand-maintained

WHEN a new integration registering a ConfigSpec is added to the integration registry
THEN init's scaffold SHALL include its section with no change to the embedded template or init code

2.2 KiB Raw Blame History