mirror of
https://github.com/hansjone/oclaw.git
synced 2026-10-13 04:40:44 +08:00
oliver
df97c5e042
Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw "sign-in failed / add API key" on DSH Desktop because the remote.mux opens anonymously at boot and every early call was rejected terminally. - gateway: anonymous workspace/follow reaches dsh-acl's empty baseline; anonymous streams are parked until the carrier aborts instead of failing; anonymous workspace/initializeDefault answers "nothing created" - request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket or bridge (sync + async variants used by all callers) - dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup instead of 403, so the Desktop welcome read no longer fails - desktop-bootstrap: key/account projection is best-effort per reference - client: emit connection/reset after login so boot-time caches (settings describe mirror -> Settings > Models) re-read under the real principal - sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min); bridge expiry slides with its session; MemoryStore persisted to sessions.json (bearer hash only, userData AES-256-GCM sealed) - README: session lifetime/persistence and DSH compatibility notes Also includes previously uncommitted uds-auth 0.3.x work in this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.6 KiB
JavaScript
59 lines
1.6 KiB
JavaScript
/**
|
|
* SEC-25: structured security audit events (no secrets).
|
|
*/
|
|
import { randomBytes } from 'node:crypto'
|
|
|
|
const SECRET_KEYS = /^(token|password|passphrase|authorization|cookie|authvalue|sso|bearer|secret|key)$/i
|
|
|
|
/**
|
|
* @param {unknown} value
|
|
* @returns {unknown}
|
|
*/
|
|
export function redactValue(value) {
|
|
if (value == null) return value
|
|
if (typeof value === 'string') {
|
|
if (value.length > 64) return value.slice(0, 8) + '…(' + value.length + ')'
|
|
return value
|
|
}
|
|
if (Array.isArray(value)) return value.map(redactValue)
|
|
if (typeof value === 'object') {
|
|
const out = {}
|
|
for (const [k, v] of Object.entries(value)) {
|
|
if (SECRET_KEYS.test(k) || /token|password|cookie|secret|auth/i.test(k)) {
|
|
out[k] = '[redacted]'
|
|
} else {
|
|
out[k] = redactValue(v)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
return value
|
|
}
|
|
|
|
/**
|
|
* @param {object} event
|
|
* @param {{ logger?: Console }} [opts]
|
|
*/
|
|
export function audit(event, opts = {}) {
|
|
const logger = opts.logger || console
|
|
const row = {
|
|
ts: new Date().toISOString(),
|
|
type: 'uds-auth.audit',
|
|
correlationId: event.correlationId || randomBytes(8).toString('hex'),
|
|
action: event.action,
|
|
decision: event.decision || 'info',
|
|
reasonCode: event.reasonCode || null,
|
|
actor: event.actor || null,
|
|
target: event.target || null,
|
|
resource: event.resource || null,
|
|
service: event.service || 'uds-auth',
|
|
meta: event.meta ? redactValue(event.meta) : undefined,
|
|
}
|
|
const line = JSON.stringify(row)
|
|
if (event.decision === 'deny' || event.decision === 'error') {
|
|
logger.warn?.(line)
|
|
} else {
|
|
logger.info?.(line)
|
|
}
|
|
return row
|
|
}
|