wmantly
59d4b65195
- Boot: bao-conf.init('sso-manager') replaces conf_manager; deep-merges
secret/sso-manager/conf over file config (fail-soft). Scoped VAULT_TOKEN
(policy sso-broker), never root.
- /api/vault reworked: middleware.auth -> scopeGuard -> token-injecting
proxy. vault_broker.js mints Redis-cached per-user (user-<uid>) /
per-admin (sso-admin) tokens via the sso-broker role; scopeGuard enforces
path prefix on top of the OpenBao policy. Client auth-token stripped.
- vault UI renamed (vaultwarden.ejs -> vault.ejs), /vault route auth-gated,
role-scoped: users see only secret/users/<uid>/, admins get free-form +
Apps mint tab (secret/apps/<name>/*, token shown once).
- api_conf.js writes via bao-conf.set('sso-manager', ...).
- Remediation: config/*-secrets.js untracked+gitignored, test_plugins.js
deleted, proxy-secrets.js.example placeholder added. Secrets remain in
git history; provider-side rotation is the real fix.
Co-Authored-By: Claude <noreply@anthropic.com>
18 lines
784 B
Plaintext
18 lines
784 B
Plaintext
'use strict';
|
|
|
|
// Example proxy secrets file. theta-env generates a real ./config/proxy-secrets.js
|
|
// from this shape at setup (with empty clientId/clientSecret), then bootstrap.js
|
|
// writes the SSO-generated OAuth client creds into it AND into OpenBao
|
|
// (secret/proxy/conf). The proxy loads it via @simpleworkjs/conf, then overlays
|
|
// secret/proxy/conf from OpenBao via @simpleworkjs/bao-conf at boot.
|
|
//
|
|
// The real file is gitignored (config/*-secrets.js) — never commit live creds.
|
|
// This .example is tracked to document the expected shape only.
|
|
module.exports = {
|
|
oidc: {
|
|
// The SSO registers the proxy as an OAuth client and writes the real
|
|
// values here (and into OpenBao). "set-me" is the bootstrap placeholder.
|
|
clientId: 'set-me',
|
|
clientSecret: 'set-me',
|
|
},
|
|
}; |