@dhyasama/totem-merge 7.1.1 → 7.1.2

package/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## What and why
+
+<!-- What does this change do, and why is it needed? -->
+
+## Author self-review
+
+Totem has a single engineer, so this PR is self-reviewed under the single-engineer exception in the Change Management Policy. Before merging:
+
+- [ ] I re-read the full diff after the last push
+- [ ] The change was tested (how: )
+- [ ] No secrets, credentials, or customer data are added (`gitleaks` passing)
+- [ ] Access, IAM, or security-group changes are least-privilege and explained above
+- [ ] Rollback plan is clear (revert this PR, or: )
+
+After merge without peer approval, justify this PR on Vanta's Code Changes page.

package/.github/workflows/secret-scan.yml

@@ -0,0 +1,42 @@
+name: Secret scan
+# Fails if a push or pull request adds a credential. Scans only the new commits,
+# with the rules in .gitleaks.toml; findings are redacted in the log.
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install gitleaks 8.30.1 (checksum verified)
+        run: |
+          curl -sSfL -o gitleaks.tgz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tgz" | sha256sum -c -
+          tar -xzf gitleaks.tgz gitleaks
+      - name: Scan the new commits
+        env:
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
+          AFTER: ${{ github.sha }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if [ "$EVENT" = "pull_request" ]; then
+            RANGE="$PR_BASE..$PR_HEAD"
+          elif [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
+            RANGE="$BEFORE..$AFTER"
+          elif git rev-parse --verify -q "origin/$DEFAULT_BRANCH" >/dev/null && [ "$(git rev-parse "origin/$DEFAULT_BRANCH")" != "$AFTER" ]; then
+            RANGE="origin/$DEFAULT_BRANCH..$AFTER"
+          else
+            RANGE="-1 $AFTER"
+          fi
+          echo "Scanning: $RANGE"
+          ./gitleaks git . --config .gitleaks.toml --log-opts="$RANGE" --redact --no-banner --exit-code 1

package/.gitleaks.toml

@@ -0,0 +1,197 @@
+# Secret scanning rules for gitleaks (https://github.com/gitleaks/gitleaks).
+# Used by .github/workflows/secret-scan.yml on every push and pull request.
+# Defaults plus Totem-specific rules; values are never stored here, only patterns.
+title = "Totem secret scan"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "totem-personal-api-key"
+description = "Totem personal API key (opaque tvc_ key)"
+regex = '''\btvc_[A-Za-z0-9_-]{43}\b'''
+keywords = ["tvc_"]
+
+[[rules]]
+id = "mongodb-uri-creds"
+description = "MongoDB connection string with embedded credentials"
+regex = '''mongodb(?:\+srv)?://([^:/\s'"@]+):([^@/\s'"]+)@'''
+secretGroup = 2
+keywords = ["mongodb"]
+
+[[rules]]
+id = "redis-uri-creds"
+description = "Redis/Valkey URI with embedded password"
+regex = '''rediss?://[^:/\s'"@]*:([^@/\s'"]+)@'''
+secretGroup = 1
+keywords = ["redis://", "rediss://"]
+
+[[rules]]
+id = "aiven-service-password"
+description = "Aiven service password"
+regex = '''AVNS_[A-Za-z0-9_-]{12,}'''
+keywords = ["AVNS_"]
+
+[[rules]]
+id = "basic-auth-url"
+description = "HTTP(S) URL with embedded basic-auth password"
+regex = '''https?://[A-Za-z0-9._%+-]+:([^@/\s'"]{6,})@[A-Za-z0-9.-]+'''
+secretGroup = 1
+keywords = ["http://", "https://"]
+
+[[rules]]
+id = "google-api-key-any"
+description = "Google API key (Maps, Gemini, etc.)"
+regex = '''AIza[0-9A-Za-z_-]{35}'''
+keywords = ["AIza"]
+
+[[rules]]
+id = "google-oauth-client-secret"
+description = "Google OAuth client secret (new or legacy format)"
+regex = '''(?i)(?:client_?secret|clientSecret)['"]?\s*[:=]\s*['"](GOCSPX-[A-Za-z0-9_-]{20,}|[A-Za-z0-9_-]{24})['"]'''
+secretGroup = 1
+keywords = ["client_secret", "clientsecret", "gocspx"]
+
+[[rules]]
+id = "gocspx-anywhere"
+description = "Google OAuth client secret prefix"
+regex = '''GOCSPX-[A-Za-z0-9_-]{20,}'''
+keywords = ["GOCSPX-"]
+
+[[rules]]
+id = "openai-key-any"
+description = "OpenAI API key"
+regex = '''sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{48}'''
+keywords = ["sk-"]
+
+[[rules]]
+id = "aws-access-key-id-any"
+description = "AWS access key ID"
+regex = '''\b((?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA)[A-Z0-9]{16})\b'''
+keywords = ["AKIA", "ASIA", "AGPA", "AIDA", "AROA", "AIPA", "ANPA", "ANVA"]
+
+[[rules]]
+id = "aws-secret-access-key"
+description = "AWS secret access key assignment"
+regex = '''(?i)(?:aws)?_?secret_?(?:access)?_?key['"]?\s*[:=]\s*['"]([A-Za-z0-9/+=]{40})['"]'''
+secretGroup = 1
+keywords = ["secret"]
+
+[[rules]]
+id = "private-key-block"
+description = "PEM private key"
+regex = '''-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY'''
+keywords = ["PRIVATE KEY"]
+
+[[rules]]
+id = "gcp-service-account"
+description = "GCP service account JSON"
+regex = '''"private_key_id"\s*:\s*"[a-f0-9]{40}"'''
+keywords = ["private_key_id"]
+
+[[rules]]
+id = "npm-token"
+description = "npm access token"
+regex = '''npm_[A-Za-z0-9]{36}|//registry\.npmjs\.org/:_authToken\s*=\s*([A-Za-z0-9-]{20,})'''
+keywords = ["npm_", "_authToken"]
+
+[[rules]]
+id = "github-token"
+description = "GitHub token"
+regex = '''\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|github_pat_[A-Za-z0-9_]{50,}'''
+keywords = ["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"]
+
+[[rules]]
+id = "slack-token"
+description = "Slack token or webhook"
+regex = '''xox[baprs]-[A-Za-z0-9-]{10,}|https://hooks\.slack\.com/services/T[A-Za-z0-9]+/B[A-Za-z0-9]+/[A-Za-z0-9]+'''
+keywords = ["xox", "hooks.slack.com"]
+
+[[rules]]
+id = "stripe-key"
+description = "Stripe live/test secret key"
+regex = '''\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b'''
+keywords = ["sk_live", "sk_test", "rk_live", "rk_test"]
+
+[[rules]]
+id = "sendgrid-key"
+description = "SendGrid API key"
+regex = '''SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}'''
+keywords = ["SG."]
+
+[[rules]]
+id = "twilio-key"
+description = "Twilio SID/key"
+regex = '''\b(?:SK|AC)[a-f0-9]{32}\b'''
+keywords = ["SK", "AC"]
+entropy = 3.0
+
+[[rules]]
+id = "uuid-token-assignment"
+description = "UUID-shaped token assigned near a secret-like keyword (Postmark, Logentries, Fixer, etc.)"
+regex = '''(?i)(?:token|api_?key|apikey|secret|logentries|postmark|le_token)['"]?\s*[:=]\s*['"]([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]'''
+secretGroup = 1
+keywords = ["token", "key", "secret", "logentries", "postmark"]
+
+[[rules]]
+id = "hex-or-b64-token-assignment"
+description = "Long token/secret/apikey literal assigned in code"
+regex = '''(?i)(?:api_?key|apikey|api_?secret|access_?token|auth_?token|secret_?key|client_?secret|private_?key|signing_?secret|jwt_?secret|session_?secret|cookie_?secret|encryption_?key|webhook_?secret)['"]?\s*[:=]\s*['"]([A-Za-z0-9_\-/+=.]{16,})['"]'''
+secretGroup = 1
+entropy = 3.2
+keywords = ["key", "secret", "token"]
+
+[[rules]]
+id = "password-assignment"
+description = "Password literal assigned in code"
+regex = '''(?i)(?:password|passwd|pwd|pass)['"]?\s*[:=]\s*['"]([^'"\s]{8,})['"]'''
+secretGroup = 1
+entropy = 3.0
+keywords = ["password", "passwd", "pwd", "pass"]
+
+[[rules]]
+id = "jwt-literal"
+description = "JSON Web Token literal"
+regex = '''\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b'''
+keywords = ["eyJ"]
+
+[[rules]]
+id = "azure-storage-key"
+description = "Azure storage account key"
+regex = '''(?i)AccountKey\s*=\s*([A-Za-z0-9+/=]{86,88})'''
+secretGroup = 1
+keywords = ["AccountKey"]
+
+[[rules]]
+id = "generic-bearer"
+description = "Hardcoded bearer token"
+regex = '''(?i)['"]?authorization['"]?\s*[:=]\s*['"]Bearer\s+([A-Za-z0-9_\-.=]{20,})['"]'''
+secretGroup = 1
+keywords = ["bearer"]
+
+[[allowlists]]
+description = "Paths that are never source secrets"
+paths = [
+  '''(^|/)node_modules/''',
+  '''(^|/)bower_components/''',
+  '''(^|/)\.next/''',
+  '''(^|/)dist/''',
+  '''(^|/)build/''',
+  '''(^|/)vendor/''',
+  '''package-lock\.json$''',
+  '''yarn\.lock$''',
+  '''pnpm-lock\.yaml$''',
+  '''\.min\.js$''',
+  '''\.map$''',
+  '''\.(png|jpg|jpeg|gif|svg|ico|woff2?|ttf|eot|pdf|xlsx|docx|mp3|wav|zip)$''',
+]
+
+[[allowlists]]
+description = "Obvious placeholders"
+regexes = [
+  '''(?i)process\.env''',
+  '''(?i)(your|my|example|sample|dummy|fake|placeholder|changeme|xxx+|\*{4,}|<[^>]+>)''',
+  '''(?i)mongodb(\+srv)?://(user|username|USER|USERNAME|<user>)[:@]''',
+  '''(?i)localhost''',
+  '''(?i)synthetic''',
+]

package/cli.js

@@ -85,8 +85,8 @@ var buildProgram = function buildProgram() {
       console.log('Getting orgs...');
 
       async.parallel([
-        Organization.getById.bind(Organization, target, { role: 'none' }),
-        Organization.getById.bind(Organization, source, { role: 'none' })
+        Organization.getById.bind(Organization, target, { isWorkerProcess: true, includeLPs: false }),
+        Organization.getById.bind(Organization, source, { isWorkerProcess: true, includeLPs: false })
       ], function(err, results) {
 
         if (err) { done(err); }

package/index.js

@@ -21,7 +21,6 @@ var Merge = function(mongoose, config) {
   this.Organization = mongoose.model('Organization');
   this.Person = mongoose.model('Person');
   this.Round = mongoose.model('Round');
-  this.Snapshot = mongoose.model('Snapshot');
 
   // turn on debug if in development and not explicitly turned off
   mongoose.set('debug', (!config.suppressDebugLog && this.env == 'development'));

package/infrastructure/security-checks/runtime-secrets.md

@@ -13,4 +13,4 @@ fallback in production or Lambda. Explicit development defaults remain unchanged
 
 See the [shared restart and cleanup runbook](https://github.com/Totem-VC/totem-services/blob/main/infrastructure/security-checks/runtime-secrets.md) for release verification, credential cleanup, and remaining limitations.
 
-Run `node --test infrastructure/security-checks/runtime-secret-contract.cjs` for isolated loader checks. These source changes require the normal application release to affect running processes. No credential was rotated.
+Run `node --test infrastructure/security-checks/runtime-secret-contract.cjs` for isolated loader checks. Loader changes require a normal application release and process replacement to affect running processes.

package/lib/helpers.js

@@ -4,20 +4,6 @@ var _ = require('underscore');
 var utilities = require('@dhyasama/totem-utilities');
 var phoneFormatter = require('phone-formatter');
 
-var createSnapshot = module.exports.createSnapshot = function createSnapshot(context, collectionName, doc, createdBy, cb) {
-
-  context.logger.writeToInfoLog('Creating snapshot - ' + collectionName + ' - ' + createdBy + ' - ' + doc._id);
-
-  var snapshot = new context.Snapshot({
-    createdBy: createdBy,
-    collectionName: collectionName,
-    doc: doc
-  });
-
-  context.Snapshot.upsert(snapshot, cb);
-
-};
-
 // Generic, recursive object merging
 var mergeObjects = function mergeObjects(target, source, doNotMergeKeys) {
 

package/lib/organizations.js

@@ -40,12 +40,6 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
 
     verifyOkToMerge.bind(null, target, source),
 
-    // Create a snapshot of the target
-    helpers.createSnapshot.bind(null, context, 'Organization', target, username),
-
-    // Create a snapshot of the source
-    helpers.createSnapshot.bind(null, context, 'Organization', source, username),
-
     // Merge the source into the target
     mergeSourceIntoTarget.bind(null, target, source),
 
@@ -64,10 +58,10 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
     if (err) { return cb(err, null); }
 
     // result from saveOrganization
-    var updatedTarget = results[5];
+    var updatedTarget = results[3];
 
     // result from updateOrganizations within updateReferences
-    var updatedReferencesOrgs = results[6][5];
+    var updatedReferencesOrgs = results[4][5];
 
     // Check if target had reference(s) updated
     var targetIdStr = target.id && target.id.toString();

package/lib/people.js

@@ -33,12 +33,6 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
 
   async.series([
 
-    // Create a snapshot of the target
-    helpers.createSnapshot.bind(null, context, 'Person', target, username),
-
-    // Create a snapshot of the source
-    helpers.createSnapshot.bind(null, context, 'Person', source, username),
-
     // Merge the source into the target
     mergeSourceIntoTarget.bind(null, target, source),
 
@@ -57,7 +51,7 @@ var merge = function merge(context, target, source, mergedBy, customerId, cb) {
     if (err) return cb(err, null);
 
     // result from savePerson
-    var updatedTarget = results[4];
+    var updatedTarget = results[2];
 
     // return updated target
     return cb(null, updatedTarget);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dhyasama/totem-merge",
-  "version": "7.1.1",
+  "version": "7.1.2",
   "description": "Org and person merging package",
   "main": "index.js",
   "scripts": {
@@ -27,18 +27,9 @@
     "mongoose": "^8.24.3"
   },
   "devDependencies": {
-    "@dhyasama/totem-models": "^12.14.0",
+    "@dhyasama/totem-models": "14.0.0",
     "mocha": "^12.0.2",
     "mocha-mongoose": "^1.1.1",
     "should": "^8.2.2"
-  },
-  "overrides": {
-    "r7insight_node": {
-      "lodash": "4.18.1",
-      "semver": "5.7.2",
-      "codependency": {
-        "semver": "5.7.2"
-      }
-    }
   }
 }

package/test/index.js

@@ -175,7 +175,7 @@ describeMerge('Merge', function() {
       should.not.exist(err);
       should.exist(newOrg1);
 
-      Organization.getById(newOrg1.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result1) {
+      Organization.getById(newOrg1.id, { CUSTOMER_ID: customer._id }, function(err, result1) {
 
         should.not.exist(err);
         should.exist(result1);
@@ -187,7 +187,7 @@ describeMerge('Merge', function() {
           should.not.exist(err);
           should.exist(newOrg2);
 
-          Organization.getById(newOrg2.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result2) {
+          Organization.getById(newOrg2.id, { CUSTOMER_ID: customer._id }, function(err, result2) {
 
             should.not.exist(err);
             should.exist(result2);
@@ -199,7 +199,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(newOrg3);
 
-              Organization.getById(newOrg3.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result3) {
+              Organization.getById(newOrg3.id, { CUSTOMER_ID: customer._id }, function(err, result3) {
 
                 should.not.exist(err);
                 should.exist(result3);
@@ -211,7 +211,7 @@ describeMerge('Merge', function() {
                   should.not.exist(err);
                   should.exist(newOrg4);
 
-                  Organization.getById(newOrg4.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result4) {
+                  Organization.getById(newOrg4.id, { CUSTOMER_ID: customer._id }, function(err, result4) {
 
                     should.not.exist(err);
                     should.exist(result4);
@@ -223,7 +223,7 @@ describeMerge('Merge', function() {
                       should.not.exist(err);
                       should.exist(newOrg5);
 
-                      Organization.getById(newOrg5.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result5) {
+                      Organization.getById(newOrg5.id, { CUSTOMER_ID: customer._id }, function(err, result5) {
 
                         should.not.exist(err);
                         should.exist(result5);
@@ -235,7 +235,7 @@ describeMerge('Merge', function() {
                           should.not.exist(err);
                           should.exist(newOrg6);
 
-                          Organization.getById(newOrg6.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, result6) {
+                          Organization.getById(newOrg6.id, { CUSTOMER_ID: customer._id }, function(err, result6) {
 
                             should.not.exist(err);
                             should.exist(result6);
@@ -822,7 +822,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(merged);
 
-              Organization.getById(result.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, finalResult) {
+              Organization.getById(result.id, { CUSTOMER_ID: customer._id }, function(err, finalResult) {
 
                 should.not.exist(err);
                 should.exist(finalResult);
@@ -883,7 +883,7 @@ describeMerge('Merge', function() {
               should.not.exist(err);
               should.exist(merged);
 
-              Organization.getById(result.id, { CUSTOMER_ID: customer._id, role: 'none' }, function(err, finalResult) {
+              Organization.getById(result.id, { CUSTOMER_ID: customer._id }, function(err, finalResult) {
 
                 should.not.exist(err);
                 should.exist(finalResult);