Repository navigation
fix: hide shared env and git url credentials in service responses - #10
Merged
agentHits merged 1 commit intoOct 7, 2026
Merged
Conversation
Что: - redactDeployableServiceSecrets теперь маскирует логин и токен в customGitUrl и скрывает env окружения и проекта (environment.env, environment.project.env). redactDatabaseServiceSecrets тоже скрывает env окружения и проекта. Это касается всех ответов, где есть вложенное окружение. - Новые варианты redactDeployableServiceSecretsFor и redactDatabaseServiceSecretsFor оставляют те общие переменные, которые вызывающему разрешено читать. Их вызывают .one у application, compose и шести баз. Права берутся из environmentEnvVars.read и projectEnvVars.read (getSharedEnvReadAccess), как в роутере окружений. - Локальные копии redactCustomGitUrl в роутерах compose и environment удалены: маскирование теперь в общей функции. - Тесты: модульные для функций скрытия; роутеры application и compose (.one без прав и с правами, ответ stop); шесть баз (.one без прав и с правами). Зачем: - find*ById всех восьми типов сервисов подгружает environment.project целиком. Ответы .one, а у приложений ещё stop, start, delete и move, отдавали env окружения и проекта открытым текстом всем, кто видит сервис, в том числе кастомным ролям без права читать общие переменные. - application.one и другие ответы приложений отдавали customGitUrl с токеном внутри адреса. У compose это закрыл PR #5. Риски: - Без environmentEnvVars.read или projectEnvVars.read редактор переменных сервиса больше не подсказывает имена общих переменных: раньше такой пользователь получал и их значения. Владельцы и админы видят всё как раньше. - Если форма git сохраняется с замаскированным адресом, сохранённый адрес остаётся: saveGitProvider и update уже вызывают preserveSecretPlaceholderFields для customGitUrl. Проверки: - Команды и результаты: CI=true bunx vitest run --config __test__/vitest.config.ts __test__/security/secret-redaction.test.ts __test__/security/service-environment-reveal.test.ts __test__/security/database-environment-reveal.test.ts - на старом коде 13 новых тестов падают, после правки все проходят; __test__/security и __test__/environment: 13 файлов, 105 тестов прошли. Полный прогон: 2089 прошли, 1 пропущен, 8 упали только в *.real.test.ts (нет сокета Docker Desktop). bun run typecheck - 4/4 без ошибок. bun run format-and-lint - 0 ошибок, в изменённых файлах нет предупреждений. - Ограничения: в интерфейсе вручную не проверялось; на dev не выкатывалось. What: - redactDeployableServiceSecrets now masks the login and token in customGitUrl and hides the environment and project env (environment.env, environment.project.env). redactDatabaseServiceSecrets hides the environment and project env too. This covers every response that carries the nested environment. - New variants redactDeployableServiceSecretsFor and redactDatabaseServiceSecretsFor keep the shared env the caller may read. The .one procedures of application, compose and the six databases use them. Access comes from environmentEnvVars.read and projectEnvVars.read (getSharedEnvReadAccess), as in the environment router. - The local redactCustomGitUrl copies in the compose and environment routers are removed: the shared function masks the URL now. - Tests: unit tests for the redaction helpers; application and compose routers (.one with and without access, the stop response); six databases (.one with and without access). Why: - find*ById for all eight service types loads environment.project in full. The .one responses, plus stop, start, delete and move for applications, returned the environment and project env in plain text to anyone who can see the service, including custom roles without permission to read shared env. - application.one and other application responses returned customGitUrl with the token inside the URL. PR #5 already fixed this for compose. Risks: - Without environmentEnvVars.read or projectEnvVars.read, the service env editor no longer suggests shared variable names: such users used to get their values as well. Owners and admins see everything as before. - Saving the git form with a masked URL keeps the stored URL: saveGitProvider and update already call preserveSecretPlaceholderFields for customGitUrl. Checks: - Commands and results: CI=true bunx vitest run --config __test__/vitest.config.ts __test__/security/secret-redaction.test.ts __test__/security/service-environment-reveal.test.ts __test__/security/database-environment-reveal.test.ts - on the old code 13 new tests fail, after the fix all pass; __test__/security and __test__/environment: 13 files, 105 tests passed. Full run: 2089 passed, 1 skipped, 8 failed only in *.real.test.ts (no Docker Desktop socket). bun run typecheck - 4/4 clean. bun run format-and-lint - 0 errors, no warnings in the changed files. - Limitations: not checked by hand in the UI; not deployed to dev. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
Service responses leaked two kinds of secrets.
Shared env.
find*ByIdfor all eight service types (application, compose, postgres, mysql, mariadb, mongo, redis, libsql) loadsenvironment.projectin full, and the responses returnedenvironment.envandenvironment.project.envin plain text. That covers.onefor every type, plusstop,start,deleteandmovefor applications. Anyone who can see the service got them, including custom roles withoutenvironmentEnvVars.read/projectEnvVars.read.Git URL credentials.
application.oneand the other application responses returnedcustomGitUrlwith the token inside the URL. #5 already fixed this for compose.Changes:
redactDeployableServiceSecretsnow masks the userinfo incustomGitUrland hides the environment and project env.redactDatabaseServiceSecretshides the environment and project env too. Every response that goes through them is covered by default.redactDeployableServiceSecretsFor/redactDatabaseServiceSecretsForkeep the shared env the caller may read. The.oneprocedures passgetSharedEnvReadAccess(ctx)(environmentEnvVars.read,projectEnvVars.read), the same permissions the environment router uses. The service env editor reads these fields for shared-variable suggestions, so owners and admins see no change.redactCustomGitUrlcopies in compose and environment are removed: the shared function masks the URL now.saveGitProviderandupdatealready runpreserveSecretPlaceholderFieldsoncustomGitUrl.No migrations and no new environment variables; only the
dokployservice image changes.Checks
.onewith and without shared env access, the applicationstopresponse, and.onefor all six databases.__test__/securityand__test__/environment: 13 files, 105 tests pass.vitest run: 2089 pass, 1 skipped; the 8 failures are only in*.real.test.ts(no local Docker socket).bun run typecheck: 4/4 packages pass.bun run format-and-lint: no errors, no warnings in the changed files.Rollout notes
After rollout, with an owner account the service env editor still suggests
${{project.*}}and${{environment.*}}variables, and the git settings of an application with a tokenized custom URL show__DOKPLOY_REDACTED_SECRET__in place of the token. Saving that form without changes keeps the original URL.🤖 Generated with Claude Code