@flowfuse/nr-launcher 2.33.3-d4a4590-202608060916.0 → 3.0.0

package/CHANGELOG.md

@@ -1,3 +1,6 @@
+#### 3.0.0: Release
+
+
 #### 2.33.2: Release
 
  - Bump brace-expansion (#597)

package/lib/auth/httpAuthMiddleware.js

@@ -11,6 +11,12 @@ let httpNodeApp
 let client
 const httpTokenCache = {}
 
+function deriveSessionSecret (credentialSecret) {
+    return credentialSecret
+        ? crypto.createHmac('sha256', credentialSecret).update('nr-launcher:httpAuth:session').digest('hex')
+        : crypto.randomBytes(20).toString('hex')
+}
+
 module.exports = {
     init (_options) {
         options = _options
@@ -79,9 +85,7 @@ module.exports = {
 
         const crossSiteCookie = (options.baseURL || '').startsWith('https://')
         httpNodeApp.use(session({
-        // As the session is only used across the life-span of an auth
-        // hand-shake, we can use a instance specific random string
-            secret: crypto.randomBytes(20).toString('hex'),
+            secret: deriveSessionSecret(options.credentialSecret),
             resave: false,
             saveUninitialized: false,
             store: new MemoryStore({
@@ -140,5 +144,7 @@ module.exports = {
                 request: 500
             }
         })
-    }
+    },
+
+    deriveSessionSecret
 }

package/lib/runtimeSettings.js

@@ -53,7 +53,8 @@ function getSettingsFile (settings) {
     clientID: '${settings.clientID}',
     clientSecret: '${settings.clientSecret}',
     teamID: '${settings.teamID}',
-    projectId: '${settings.projectID}'
+    projectId: '${settings.projectID}',
+    credentialSecret: '${settings.credentialSecret || ''}'
 })`
             projectSettings.httpNodeMiddleware = 'httpNodeMiddleware: flowforgeAuthMiddleware,'
         }