fix(security/gcp): drop plaintext SCHEDULED_TASK_SECRET — rely on OIDC + Cloud Run IAM (closes #159) #161
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| package scheduledauth | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strings" | ||
| ) | ||
|
|
||
| // EnvSource is the minimal interface NewFromEnv depends on. The default | ||
| // implementation (envOS) reads from os.Getenv; tests inject a map. | ||
| type EnvSource interface { | ||
| Get(string) string | ||
| } | ||
|
|
||
| // EnvMap is an EnvSource backed by a map. Useful in tests. | ||
| type EnvMap map[string]string | ||
|
|
||
| // Get returns the value for key, or "" if absent. | ||
| func (m EnvMap) Get(key string) string { return m[key] } | ||
|
|
||
| // Environment variable names. Centralised so tests and Terraform stay | ||
| // aligned with the Go code. | ||
| const ( | ||
| EnvAuthMode = "SCHEDULED_TASK_AUTH_MODE" // "oidc" | "bearer" | "disabled" | ||
| EnvOIDCIssuer = "SCHEDULED_TASK_OIDC_ISSUER" // default GoogleIssuer | ||
| EnvOIDCJWKSURL = "SCHEDULED_TASK_OIDC_JWKS_URL" // default GoogleJWKSURL | ||
| EnvOIDCAudience = "SCHEDULED_TASK_OIDC_AUDIENCE" // comma-separated | ||
| EnvOIDCSubjects = "SCHEDULED_TASK_OIDC_SUBJECTS" // comma-separated; REQUIRED in oidc mode | ||
| EnvBearerSecret = "SCHEDULED_TASK_SECRET" // bearer mode only | ||
| ) | ||
|
|
||
| // LoadConfig parses Config from env. SCHEDULED_TASK_AUTH_MODE MUST be | ||
| // set explicitly to one of "oidc", "bearer", or "disabled" — an unset | ||
| // value returns ErrConfigInvalid so a missed Terraform/Kubernetes env | ||
| // wiring fails server startup instead of silently booting | ||
| // /api/scheduled/* unauthenticated. "disabled" is reserved for an | ||
| // explicit local-dev choice and must be opted into deliberately. | ||
| func LoadConfig(env EnvSource) (Config, error) { | ||
| mode := strings.ToLower(strings.TrimSpace(env.Get(EnvAuthMode))) | ||
| if mode == "" { | ||
| return Config{}, fmt.Errorf("%w: %s is unset (set to oidc, bearer, or disabled)", | ||
| ErrConfigInvalid, EnvAuthMode) | ||
| } | ||
|
|
||
| cfg := Config{Mode: Mode(mode)} | ||
|
|
||
| switch cfg.Mode { | ||
| case ModeOIDC: | ||
| cfg.Issuer = strings.TrimSpace(env.Get(EnvOIDCIssuer)) | ||
| cfg.JWKSURL = strings.TrimSpace(env.Get(EnvOIDCJWKSURL)) | ||
| cfg.Audiences = splitCSV(env.Get(EnvOIDCAudience)) | ||
| cfg.Subjects = splitCSV(env.Get(EnvOIDCSubjects)) | ||
|
|
||
| case ModeBearer: | ||
| cfg.Bearer = env.Get(EnvBearerSecret) | ||
| // Permit other env vars to be set without complaint — the | ||
| // terraform module ships SCHEDULED_TASK_OIDC_* across all | ||
| // platforms and they should be ignored on Azure. | ||
|
|
||
| case ModeDisabled: | ||
| // Nothing to parse. | ||
|
|
||
| default: | ||
| return Config{}, fmt.Errorf("%w: %s=%q (expected oidc, bearer, or disabled)", | ||
| ErrConfigInvalid, EnvAuthMode, mode) | ||
| } | ||
|
|
||
| return cfg, nil | ||
| } | ||
|
|
||
| // splitCSV splits a comma-separated value into a trimmed list, dropping | ||
| // empty entries (so trailing commas / whitespace are tolerated). | ||
| func splitCSV(raw string) []string { | ||
| if raw == "" { | ||
| return nil | ||
| } | ||
| parts := strings.Split(raw, ",") | ||
| out := make([]string, 0, len(parts)) | ||
| for _, p := range parts { | ||
| p = strings.TrimSpace(p) | ||
| if p != "" { | ||
| out = append(out, p) | ||
| } | ||
| } | ||
| return out | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't fail open when
SCHEDULED_TASK_AUTH_MODEis missing.buildScheduledAuthgoes throughscheduledauth.LoadConfig, which currently maps an unset mode todisabled. In the production constructor, that turns a missed Terraform/env wiring into a live validator that allows every/api/scheduled/*request instead of failing startup, which is the exact regression this PR is trying to prevent.🔒 Proposed guard
func buildScheduledAuth(cfg ApplicationConfig) (*scheduledauth.Validator, error) { + if strings.TrimSpace(os.Getenv(scheduledauth.EnvAuthMode)) == "" { + return nil, fmt.Errorf( + "%w: %s must be explicitly set (use disabled only for local dev)", + scheduledauth.ErrConfigInvalid, + scheduledauth.EnvAuthMode, + ) + } saCfg, err := scheduledauth.LoadConfig(envSourceOS{}) if err != nil { return nil, err }📝 Committable suggestion
🤖 Prompt for AI Agents