mosaicstack/stack
19
0
Fork 1
Code Issues 335 Pull Requests 14 Actions Packages Projects Releases 15 Wiki Activity

fix(mosaic): gateway token recovery review remediations #414

Merged
jason.woltje merged 1 commits from fix/gateway-token-recovery-review into main 2026-04-05 06:13:30 +00:00
Conversation 0 Commits 1 Files Changed 5
+90 -30
jason.woltje commented 2026-04-05 06:05:04 +00:00
Owner
Copy Link
Copy Source

Security and correctness remediations from independent code review of PR #411 (CU-03-08). Blockers fixed: session.json mode 0o600 and password no-echo prompt. Important: password trim fix, cross-gateway warning, --password unsafe flag. All 114 tests pass.

Security and correctness remediations from independent code review of PR #411 (CU-03-08). Blockers fixed: session.json mode 0o600 and password no-echo prompt. Important: password trim fix, cross-gateway warning, --password unsafe flag. All 114 tests pass.
jason.woltje added 1 commit 2026-04-05 06:05:06 +00:00
fix(mosaic): address code review findings for gateway token recovery (CU-03-08)
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
ca214ccc76 
- auth.ts: write session.json with mode 0o600 (was world-readable; cookie is a credential)
- login.ts: add promptSecret() using TTY raw mode so password is not echoed to terminal
- login.ts: export promptLine() so token-ops.ts can use it (keeps prompts mockable in tests)
- login.ts: fix password trimming — do not trim() passwords (may have intentional whitespace)
- token-ops.ts: use promptLine/promptSecret from login.ts (replaces inline readline)
- token-ops.ts: persistToken() warns when --gateway targets a different host than meta.json
- gateway.ts: mark --password flag [UNSAFE] in help; emit console.warn when it is used
- recover-token.spec.ts: update mock to include promptLine/promptSecret from ./login.js

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
jason.woltje merged commit 119ff0eb1b into main 2026-04-05 06:13:30 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#414