admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): make the AUTH_ENFORCE default fail-closed -- 0pt.app was answering anonymously #4

Merged
admin merged 1 commits from fix/fail-closed-auth-default into main 2026-08-04 13:24:17 +00:00
Conversation 0 Commits 1 Files Changed 5
+211 -50
1 Commits
Author SHA1 Message Date
Claude (SIAX platform session) 1c1e2cb649 fix(auth): make the AUTH_ENFORCE default fail-closed on /api/0pt/*
CI (SIAX Cloud) / quality (push) Successful in 42s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 22s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 42s
Details
CI (SIAX Cloud) / security (push) Successful in 23s
Details 
The auth seam read `process.env.AUTH_ENFORCE === 'true'`, so an absent env
var meant NO authentication: any fresh container, local run, DR restore or
redeploy that dropped the variable served /api/0pt/* anonymously, taking the
tenant from the caller-supplied X-Tenant-Id header. 0pt.app is deployed and
was answering anonymously (verified: an invalid Bearer token plus an
arbitrary X-Tenant-Id returned 200), so this was a live hole, not latent.

* authEnforced() now returns true unless AUTH_ENFORCE is explicitly "false"
  (trimmed, case-insensitive). Unset/empty/misspelled => ENFORCED.
* assertAuthConfigSafe() throws AuthMisconfigurationError when
  NODE_ENV=production and enforcement resolved off, naming AUTH_ENFORCE. It
  runs at middleware module load (startup) and on the env-driven request
  path, so a production instance can neither boot nor serve a single
  unauthenticated request with auth switched off.
* .env.example no longer teaches AUTH_ENFORCE=false; README's Deploy section
  states the fail-closed posture (no DEPLOY.md in this repo).
* 7 new tests, incl. the regression case: with AUTH_ENFORCE unset and no
  `enforce` option, an unauthenticated request is rejected with 401. No test
  was inverted or deleted -- none asserted the open default; the three
  enforce:false cases now describe the explicit local-dev escape hatch.

Tests: 121 passed / 1 skipped before, 128 passed / 1 skipped after.
Typecheck and build clean; advisory lint unchanged (16 pre-existing problems).

Scope: auth default only. The matcher still covers /api/0pt/* alone, and the
handlers still take tenant_id from the query/body rather than the verified
principal -- both described in the PR body, neither fixed here.
 2026-07-27 13:28:24 +02:00