@reefclaw/connect 0.1.34 → 0.1.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -34,12 +34,31 @@ import { parseVenue } from '../venues/registry.js';
|
|
|
34
34
|
import { unsealCredentials, SealedEnvelopeError } from '../security/sealed-credentials.js';
|
|
35
35
|
import { logger } from '../logger.js';
|
|
36
36
|
const TAG = 'set-exchange-credentials';
|
|
37
|
+
/** Non-secret CONTROL flags honored from the PLAINTEXT SIBLINGS of a sealed
|
|
38
|
+
* envelope (E2E audit 2026-08-11 #5). The envelope's anti-smuggle property —
|
|
39
|
+
* "plaintext siblings are ignored" — exists so a mixed payload can't override
|
|
40
|
+
* sealed CREDENTIAL values. But the dashboard sends `confirm_venue_switch`
|
|
41
|
+
* as a sibling NEXT TO `sealed` (it is not a secret and the sealer encrypts
|
|
42
|
+
* only the per-venue credential payload), so dropping every sibling made the
|
|
43
|
+
* confirm retry look unconfirmed forever: any live venue-switcher on a box
|
|
44
|
+
* with a transport key hit an infinite confirm loop. The flags below are
|
|
45
|
+
* safe to honor from plaintext because they cannot change WHAT gets stored
|
|
46
|
+
* (the sealed payload alone decides that) — they only acknowledge a warn
|
|
47
|
+
* step for the request the operator themselves sealed. A value INSIDE the
|
|
48
|
+
* envelope still wins (sealed-beats-plaintext is preserved). */
|
|
49
|
+
const SEALED_SIBLING_CONTROL_FLAGS = ['confirm_venue_switch'];
|
|
37
50
|
/** Open a sealed envelope into plain args, or return a renderable error. */
|
|
38
51
|
export function resolveSealedArgs(args, configDir) {
|
|
39
52
|
if (args?.sealed == null)
|
|
40
53
|
return { args, sealed: false };
|
|
41
54
|
try {
|
|
42
55
|
const plain = unsealCredentials(args.sealed, configDir);
|
|
56
|
+
for (const flag of SEALED_SIBLING_CONTROL_FLAGS) {
|
|
57
|
+
const sibling = args[flag];
|
|
58
|
+
if (plain[flag] === undefined && sibling !== undefined) {
|
|
59
|
+
plain[flag] = sibling;
|
|
60
|
+
}
|
|
61
|
+
}
|
|
43
62
|
return { args: plain, sealed: true };
|
|
44
63
|
}
|
|
45
64
|
catch (err) {
|