@brydio/manifest 0.1.0-alpha.0 → 0.1.0-alpha.11

package/src/secrets.js

@@ -35,21 +35,21 @@ const isRealValue = (value) => {
         return false;
     return true;
 };
-function walk(node, at, found) {
+function walk(node, at, found, publicValue = () => false) {
     if (Array.isArray(node)) {
-        node.forEach((one, index) => walk(one, `${at}[${index}]`, found));
+        node.forEach((one, index) => walk(one, `${at}[${index}]`, found, publicValue));
         return;
     }
     if (!node || typeof node !== 'object')
         return;
     for (const [key, value] of Object.entries(node)) {
         const path = at ? `${at}.${key}` : key;
-        if (VALUE_KEYS.has(key) && isRealValue(value)) {
+        if (VALUE_KEYS.has(key) && isRealValue(value) && !publicValue(path)) {
             // Never quoted back: a report that repeated the secret would copy it somewhere else.
             found.push({ code: 'secret_in_bundle', message: SECRET_MESSAGE, path });
             continue;
         }
-        walk(value, path, found);
+        walk(value, path, found, publicValue);
     }
 }
 /**
@@ -59,7 +59,7 @@ function walk(node, at, found) {
  */
 export function secretsInJson(document, at) {
     const found = [];
-    walk(document, at, found);
+    walk(document, at, found, path => /(?:^|\.)placements\[\d+\]\.key$/.test(path));
     return found;
 }
 /** Every secret declared in a bundle's files, as the server finds them. */
@@ -79,3 +79,25 @@ export function findSecrets(files, root = '') {
     }
     return found;
 }
+/**
+ * The server's sentence for `developer_key_in_bundle` (ADR-A22), word for
+ * word: `DEVELOPER_KEY_IN_BUNDLE` in Brydio's `app-publish.service.ts`.
+ */
+export const DEVELOPER_KEY_MESSAGE = 'That package contains a Brydio developer API key. A key belongs on your own server, never in an app: revoke it in Settings › Developer, and call Brydio’s model from a handler with the model grant instead.';
+/** A developer API key's exact shape, anywhere in a text. */
+const DEVELOPER_KEY = /bry_live_[0-9a-f]{12}_[A-Za-z0-9_-]{43}/;
+/** Whether a text holds a Brydio developer API key. */
+export const holdsDeveloperKey = (text) => DEVELOPER_KEY.test(text);
+/**
+ * The first file holding a developer API key, by path, as Brydio's publish
+ * route finds it (`developerKeyIn`). Unlike the declaration scan, every file
+ * is read, scripts included: the key's shape is exact enough that a match is
+ * a key, not a guess, and no part of an app may hold one (ADR-A24).
+ */
+export function developerKeyIn(files) {
+    for (const [path, bytes] of files) {
+        if (holdsDeveloperKey(new TextDecoder('latin1').decode(bytes)))
+            return path;
+    }
+    return null;
+}