wmantly
59d4b65195
- Boot: bao-conf.init('sso-manager') replaces conf_manager; deep-merges
secret/sso-manager/conf over file config (fail-soft). Scoped VAULT_TOKEN
(policy sso-broker), never root.
- /api/vault reworked: middleware.auth -> scopeGuard -> token-injecting
proxy. vault_broker.js mints Redis-cached per-user (user-<uid>) /
per-admin (sso-admin) tokens via the sso-broker role; scopeGuard enforces
path prefix on top of the OpenBao policy. Client auth-token stripped.
- vault UI renamed (vaultwarden.ejs -> vault.ejs), /vault route auth-gated,
role-scoped: users see only secret/users/<uid>/, admins get free-form +
Apps mint tab (secret/apps/<name>/*, token shown once).
- api_conf.js writes via bao-conf.set('sso-manager', ...).
- Remediation: config/*-secrets.js untracked+gitignored, test_plugins.js
deleted, proxy-secrets.js.example placeholder added. Secrets remain in
git history; provider-side rotation is the real fix.
Co-Authored-By: Claude <noreply@anthropic.com>
99 lines
1.5 KiB
Plaintext
Executable File
99 lines
1.5 KiB
Plaintext
Executable File
# ---> Node
|
|
# Logs
|
|
logs
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
|
|
# Runtime data
|
|
pids
|
|
*.pid
|
|
*.seed
|
|
*.pid.lock
|
|
|
|
# Directory for instrumented libs generated by jscoverage/JSCover
|
|
lib-cov
|
|
|
|
# Coverage directory used by tools like istanbul
|
|
coverage
|
|
|
|
# nyc test coverage
|
|
.nyc_output
|
|
|
|
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
|
|
.grunt
|
|
|
|
# Bower dependency directory (https://bower.io/)
|
|
bower_components
|
|
|
|
# node-waf configuration
|
|
.lock-wscript
|
|
|
|
# Compiled binary addons (http://nodejs.org/api/addons.html)
|
|
build/Release
|
|
|
|
# Dependency directories
|
|
node_modules/
|
|
jspm_packages/
|
|
|
|
# Typescript v1 declaration files
|
|
typings/
|
|
|
|
# Optional npm cache directory
|
|
.npm
|
|
|
|
# Optional eslint cache
|
|
.eslintcache
|
|
|
|
# Optional REPL history
|
|
.node_repl_history
|
|
|
|
# Output of 'npm pack'
|
|
*.tgz
|
|
|
|
# Yarn Integrity file
|
|
.yarn-integrity
|
|
|
|
# dotenv environment variables file
|
|
.env
|
|
|
|
.vagrant
|
|
*~
|
|
*#
|
|
.#*
|
|
\#*#
|
|
.*.sw[a-z]
|
|
*.un~
|
|
|
|
# Bundler
|
|
Gemfile.lock
|
|
gems.locked
|
|
bin/*
|
|
.bundle/*
|
|
|
|
# test kitchen
|
|
.kitchen/
|
|
.kitchen.local.yml
|
|
|
|
# Chef
|
|
Berksfile.lock
|
|
.zero-knife.rb
|
|
Policyfile.lock.json
|
|
|
|
ops/cookbooks/vendor
|
|
|
|
secrets.json
|
|
secrets.js
|
|
|
|
# Per-deployment secret files (real LDAP/SMTP/jwtSecret + generated OAuth
|
|
# creds). theta-env bind-mounts ./config and generates/fills these at setup;
|
|
# they must never be committed. The empty *.example templates ARE tracked.
|
|
config/*-secrets.js
|
|
|
|
# Jekyll build artifact (GitHub Pages builds remotely; ignore locally)
|
|
docs/_site
|
|
|
|
# Jekyll build artifact (GitHub Pages builds remotely; ignore locally)
|
|
docs/_site
|