gina 0.6.8 → 0.6.9

package/framework/{v0.6.8 → v0.6.9}/lib/secrets/src/backends/env.js

@@ -53,10 +53,21 @@
  * }
  */
 function resolve(key) {
-    // #B156 — framework-environment tier first. Boolean values a sweep may
-    // have coerced ("true"/"false") fail the string check below, keeping the
-    // non-empty-STRING contract identical on both tiers.
-    var value = (typeof getEnvVar === 'function' && getEnvVar(key)) || process.env[key];
+    // #B156 — framework-environment tier first, then process.env.
+    //
+    // #B270 — the two tiers are read INDEPENDENTLY, never joined with `||`.
+    // The sweep does not store the STRINGS "true"/"false" as an earlier comment
+    // here claimed: filterArgs() coerces them to REAL booleans, which
+    // test/integration/helper.test.js pins ("converts \"true\" string to boolean
+    // true"). A truthy boolean therefore satisfied `||` and process.env was
+    // never consulted — so a perfectly good environment string lost to the file
+    // tier, inverting the precedence this backend exists to enforce. Only a
+    // non-empty STRING from the framework tier may win; anything else (a
+    // boolean, a number, undefined, '') falls through to process.env.
+    var value = (typeof getEnvVar === 'function') ? getEnvVar(key) : undefined;
+    if (typeof value !== 'string' || value === '') {
+        value = process.env[key];
+    }
     if (typeof value !== 'string' || value === '') {
         var err = new Error('Secret resolution failed');
         Object.defineProperty(err, '_ginaSecretKey', {

package/framework/{v0.6.8 → v0.6.9}/lib/secrets/src/main.js

@@ -28,7 +28,18 @@
  *
  * **Path tracking.** The dotted paths that were substituted are recorded
  * in an internal `WeakMap`; callers can retrieve them via
- * `getResolvedPaths(config)` to support future log-redaction wrappers.
+ * `getResolvedPaths(config)`.
+ *
+ * Scope of that hook, measured (#B274) — it is NOT a general redaction
+ * substrate, and in particular it cannot serve the Inspector. Two reasons,
+ * either sufficient: the paths address the config object itself, while the
+ * Inspector redacts a payload built from the controller's VIEW data
+ * (`{gina, user}`), a different coordinate space in which `db.password`
+ * names nothing; and the lookup is keyed on object IDENTITY, while that
+ * payload is a `JSON.parse(JSON.stringify(...))` clone, so the WeakMap
+ * returns `[]` for it by construction. Redacting a surface that holds
+ * VALUES rather than the config needs a value-based pass — see
+ * `core/connectors/param-redact.js`, built for exactly that reason.
  *
  * **Introspection.** `getRequiredKeys(config)` enumerates the placeholder
  * keys a config requires without resolving them — read-only and
@@ -220,12 +231,17 @@ function resolve(config, backend) {
 
 /**
  * Return the dotted paths that were substituted in `config` during the
- * most recent `resolve(config)` call. Used by future log-redaction
- * wrappers to know which fields originated as secrets.
+ * most recent `resolve(config)` call, so a caller holding that config can
+ * tell which of its fields originated as secrets.
  *
  * Paths use dotted notation for object keys (`'db.password'`) and
  * bracketed indices for array elements (`'items[0]'`).
  *
+ * The lookup is keyed on the IDENTITY of `config` (#B274), so a caller must
+ * pass the very object `resolve()` mutated — a structural clone returns `[]`.
+ * The paths likewise address that object and no other, which is why this is
+ * not a redaction hook for downstream payloads; see the module note above.
+ *
  * @memberof module:lib/secrets
  * @function getResolvedPaths
  * @param {object|Array} config - The resolved config object
@@ -331,12 +347,22 @@ function selectBackend(config) {
 
     var paths = Array.isArray(declared) ? declared : [declared];
     if (!paths.length) {
+        // #B271 — `[]` disables the whole file tier exactly like `null`, but it is
+        // not one of the documented shapes, so an operator emptying the array to
+        // drop ONE layer silently drops the tier. Keep accepting it — an empty
+        // list genuinely means "no files", and refusing boot over an undocumented
+        // spelling would be a total outage for a harmless config — but say so once
+        // rather than disabling a security tier without a word.
+        console.warn('[ secrets ] `settings.secrets.file` is an empty array — the file tier is disabled. Use `null` to opt out explicitly, or list at least one path.');
         return defaultBackend;
     }
 
     for (var i = 0; i < paths.length; i++) {
         var p = paths[i];
-        if (typeof p !== 'string' || p === '') {
+        // #B271 — trim before the empty check: the schema's `minLength: 1` counts a
+        // space, so `[" "]` cleared both layers and built a tier that could never
+        // resolve anything, visible only as a suppressed debug line.
+        if (typeof p !== 'string' || p.trim() === '') {
             throw new Error('`settings.secrets.file` must be a non-empty string or an array of them');
         }
         // A secrets file cannot itself be named by a secret — the backend that
@@ -351,6 +377,24 @@ function selectBackend(config) {
         if (/\$\{[^}]*\}/.test(p)) {
             throw new Error('`settings.secrets.file` contains an unresolved `${…}` token: ' + p);
         }
+        // #B272 — a token that resolved to an EMPTY string leaves nothing for the
+        // check above to catch: `${homedir}/${scope}/secrets.env` with an empty
+        // scope collapses to `<home>//secrets.env`, which POSIX reads as
+        // `<home>/secrets.env` — a silent read of the WRONG file, one directory up
+        // from the intended one. The empty segment is the only surviving trace.
+        //
+        // This CANNOT distinguish that from the benign cause — a token carrying a
+        // trailing slash, e.g. GINA_HOMEDIR=/opt/gina/ (operator-supplied, and
+        // nothing in the path chain normalises it) — because by here both have
+        // collapsed to the same string. It refuses either way, deliberately: the
+        // dangerous case runs the bundle on the wrong credential in silence, and
+        // this file already refuses on the same reasoning when a declared layer
+        // exists but cannot be read. The benign case costs one character to fix
+        // and the message names it, so the error must NOT assert a cause it
+        // cannot know.
+        if (p.indexOf('//') > -1) {
+            throw new Error('`settings.secrets.file` contains an empty path segment (`//`), so it does not name the file it appears to — POSIX reads `<a>//<b>` as `<a>/<b>`. Either a `${…}` token resolved to an empty value (the path then silently drops a directory), or a token carries a trailing slash. Remove the doubled separator or fix the token: ' + p);
+        }
     }
 
     return fileBackend.build(paths);

package/framework/{v0.6.8 → v0.6.9}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.6.8/core/gna');
+var _gna = require('./framework/v0.6.9/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.6.8/core/controller');
-var EntitySuper     = require('./framework/v0.6.8/core/model/entity');
+var SuperController = require('./framework/v0.6.9/core/controller');
+var EntitySuper     = require('./framework/v0.6.9/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.6.8/lib/uuid');
+var uuid = require('./framework/v0.6.9/lib/uuid');
 
 module.exports = {