@cytario/web 2.2.7 → 2.3.0

package/app/.server/db/redis.ts

@@ -14,6 +14,7 @@ import { buildRedisOptions } from "./redisOptions";
  * - REDIS_PORT: Server port (default: 6379)
  * - REDIS_USERNAME: Optional username for authenticated connections (Redis 6+ / Valkey)
  * - REDIS_PASSWORD: Optional password for authenticated connections
+ * - REDIS_KEY_PREFIX: Optional prefix prepended to every key (e.g. "cytario-web:")
  * - REDIS_TLS: Set to "true" to wrap the connection in TLS (required in production)
  * - REDIS_CA_CERT: Optional PEM-encoded CA certificate (string) for self-signed deployments
  * - REDIS_TLS_SERVER_NAME: Optional SNI / certificate hostname override
@@ -35,6 +36,14 @@ import { buildRedisOptions } from "./redisOptions";
 
 const options = buildRedisOptions(process.env);
 
+const auth = options.password ? "on" : "off";
+const tls = options.tls ? "on" : "off";
+const who = options.username ? ` as ${options.username}` : "";
+const prefix = options.keyPrefix ? `, prefix "${options.keyPrefix}"` : "";
+console.log(
+  `Redis/Valkey config: ${options.host}:${options.port}${who} (AUTH ${auth}, TLS ${tls}${prefix})`,
+);
+
 export const redis = new Redis(options);
 
 redis.on("error", (err) => {
@@ -42,11 +51,5 @@ redis.on("error", (err) => {
 });
 
 redis.on("connect", () => {
-  const authInfo = options.username
-    ? ` (authenticated as ${options.username})`
-    : options.password
-      ? " (authenticated)"
-      : "";
-  const tlsInfo = options.tls ? " over TLS" : "";
-  console.log(`Connected to Redis/Valkey at ${options.host}:${options.port}${authInfo}${tlsInfo}`);
+  console.log(`Connected to Redis/Valkey at ${options.host}:${options.port}`);
 });

package/app/.server/db/redisOptions.ts

@@ -7,7 +7,10 @@ import type { RedisOptions } from "ioredis";
  * - `REDIS_HOST` (default: `localhost`)
  * - `REDIS_PORT` (default: `6379`)
  * - `REDIS_USERNAME` — optional ACL username
- * - `REDIS_PASSWORD` — optional password
+ * - `REDIS_PASSWORD` — password; required outside development
+ * - `REDIS_KEY_PREFIX` — optional prefix prepended to every key issued by
+ *   this client (e.g. `"cytario-web:"`). Lets operators scope the app to a
+ *   single ACL keyspace pattern without code changes.
  * - `REDIS_TLS` — `"true"` to wrap the connection in TLS
  * - `REDIS_CA_CERT` — PEM-encoded CA certificate (string) used to verify
  *   the server when the cert chain is not in the system trust store
@@ -16,9 +19,13 @@ import type { RedisOptions } from "ioredis";
  *   production TLS requirement (escape hatch for trusted in-cluster
  *   networks; logs a warning)
  *
- * Fails fast outside development if TLS is off and the opt-out flag is
- * not set — session blobs contain OAuth tokens and STS credentials and
- * must not traverse plaintext links in production. See C-204.
+ * Fails fast outside development if:
+ *   - TLS is off and the opt-out flag is not set, or
+ *   - `REDIS_PASSWORD` is empty.
+ *
+ * Session blobs contain OAuth tokens and STS credentials and must never
+ * traverse plaintext links or be readable by anonymous clients in
+ * production.
  */
 export function buildRedisOptions(env: Record<string, string | undefined>): RedisOptions {
   const host = env.REDIS_HOST || "localhost";
@@ -29,15 +36,22 @@ export function buildRedisOptions(env: Record<string, string | undefined>): Redi
   const caCert = env.REDIS_CA_CERT;
   const tlsServerName = env.REDIS_TLS_SERVER_NAME;
   const allowPlaintext = env.REDIS_INSECURE_ALLOW_PLAINTEXT === "true";
+  const keyPrefix = env.REDIS_KEY_PREFIX;
   const nodeEnv = env.NODE_ENV;
 
   const isLocalEnv = nodeEnv === "development" || nodeEnv === "test";
 
+  if (!isLocalEnv && !password) {
+    throw new Error(
+      "Refusing to start: Redis/Valkey AUTH is disabled. Set REDIS_PASSWORD " +
+        "to a non-empty value so the session store rejects anonymous clients.",
+    );
+  }
+
   if (!tlsEnabled && !isLocalEnv && !allowPlaintext) {
     throw new Error(
       "Refusing to start: Redis/Valkey TLS is disabled. Set REDIS_TLS=true " +
-        "(recommended) or REDIS_INSECURE_ALLOW_PLAINTEXT=true to opt out. " +
-        "See C-204 / OWASP A02:2021.",
+        "(recommended) or REDIS_INSECURE_ALLOW_PLAINTEXT=true to opt out.",
     );
   }
 
@@ -53,6 +67,7 @@ export function buildRedisOptions(env: Record<string, string | undefined>): Redi
     port,
     ...(username && { username }),
     ...(password && { password }),
+    ...(keyPrefix && { keyPrefix }),
     maxRetriesPerRequest: 3,
     retryStrategy(times) {
       const delay = Math.min(times * 50, 2000);

package/app/config.ts

@@ -22,7 +22,7 @@ interface CytarioConfig {
     host: string;
     /** Optional username for authenticated connections (Redis 6+ ACL / Valkey) */
     username?: string;
-    /** Optional password for authenticated connections */
+    /** Password for authenticated connections. Optional in development only */
     password?: string;
   };
   cookie: CookieOptions;

package/bin/cytario-web.mjs

@@ -85,7 +85,7 @@ function runStart(forwardedArgs) {
   const child = spawn(process.execPath, [serverEntry, ...forwardedArgs], {
     cwd: PACKAGE_ROOT,
     stdio: "inherit",
-    env: { ...process.env, NODE_ENV: "production" },
+    env: { ...process.env, NODE_ENV: process.env.NODE_ENV ?? "production" },
   });
   child.on("exit", (code, signal) => {
     if (signal) process.kill(process.pid, signal);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cytario/web",
-  "version": "2.2.7",
+  "version": "2.3.0",
   "description": "Cytario Web — scientific imaging data browser and viewer for OME-TIFF, OME-Zarr, Parquet and GeoTIFF on S3-compatible storage.",
   "license": "AGPL-3.0",
   "sideEffects": false,