ifritechnologies/pfm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Applied extensive leaked secret protection

Browse Source
This commit is contained in:
hermes
2026-10-24 15:56:25 +02:00
parent 29a11f0e0b
commit 17a99ff084
11 changed files with 17 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PostFundManagement.ConsoleUI/.env.example
-1
View File
@@ -24,4 +24,3 @@ VITE_ENABLE_HTTPS="true"
# HasherSettings for HashIds compatibility with backend pfm-api # HasherSettings for HashIds compatibility with backend pfm-api
VITE_HASHER_MIN_LENGTH="11" VITE_HASHER_MIN_LENGTH="11"
VITE_HASHER_SALT="TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ=="
PostFundManagement.ConsoleUI/docker-entrypoint.sh
+2 -7
View File
@@ -30,17 +30,16 @@ OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__Cli
OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}" OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
# 6. Hasher Settings # 6. Hasher Settings
HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}" HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
if [ -d "$TARGET_DIR" ]; then if [ -d "$TARGET_DIR" ]; then
echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..." echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
# Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization # Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization
# Public SPA clients use Authorization Code flow with PKCE; client secrets must NEVER be injected or exposed here. # Public SPA clients use Authorization Code flow with PKCE; client secrets and hasher salts must NEVER be injected or exposed here.
cat <<EOF > "$TARGET_DIR/env-config.js" cat <<EOF > "$TARGET_DIR/env-config.js"
// Generated dynamically at container startup from deployment environment variables // Generated dynamically at container startup from deployment environment variables
// Note: Secrets such as client secrets or private keys must NEVER be exposed here. // Note: Secrets such as client secrets, private keys, or hashing salts must NEVER be exposed here.
window.__RUNTIME_CONFIG__ = { window.__RUNTIME_CONFIG__ = {
API_BASE_URL: "${API_BASE_URL}", API_BASE_URL: "${API_BASE_URL}",
VITE_API_BASE_URL: "${API_BASE_URL}", VITE_API_BASE_URL: "${API_BASE_URL}",
@@ -52,8 +51,6 @@ window.__RUNTIME_CONFIG__ = {
VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}", VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
OIDC_SCOPE: "${OIDC_SCOPE}", OIDC_SCOPE: "${OIDC_SCOPE}",
VITE_OIDC_SCOPE: "${OIDC_SCOPE}", VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
HASHER_SALT: "${HASHER_SALT}",
VITE_HASHER_SALT: "${HASHER_SALT}",
HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}", HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}", VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
ApiSettings: { ApiSettings: {
@@ -66,7 +63,6 @@ window.__RUNTIME_CONFIG__ = {
Scope: "${OIDC_SCOPE}" Scope: "${OIDC_SCOPE}"
}, },
HasherSettings: { HasherSettings: {
Salt: "${HASHER_SALT}",
MinHashLength: "${HASHER_MIN_LENGTH}" MinHashLength: "${HASHER_MIN_LENGTH}"
} }
}; };
@@ -85,7 +81,6 @@ EOF
"Scope": "${OIDC_SCOPE}" "Scope": "${OIDC_SCOPE}"
}, },
"HasherSettings": { "HasherSettings": {
"Salt": "${HASHER_SALT}",
"MinHashLength": "${HASHER_MIN_LENGTH}" "MinHashLength": "${HASHER_MIN_LENGTH}"
} }
} }
PostFundManagement.ConsoleUI/public/config.json
-1
View File
@@ -9,7 +9,6 @@
"Scope": "" "Scope": ""
}, },
"HasherSettings": { "HasherSettings": {
"Salt": "",
"MinHashLength": "" "MinHashLength": ""
} }
} }
PostFundManagement.ConsoleUI/src/config.ts
+4 -4
View File
@@ -13,7 +13,7 @@ export interface ApiSettings {
} }
export interface HasherSettings { export interface HasherSettings {
Salt: string; Salt?: string;
MinHashLength: number; MinHashLength: number;
} }
@@ -44,7 +44,7 @@ export const defaultApiSettings: ApiSettings = {
}; };
export const defaultHasherSettings: HasherSettings = { export const defaultHasherSettings: HasherSettings = {
Salt: 'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==', Salt: '',
MinHashLength: 11, MinHashLength: 11,
}; };
@@ -276,7 +276,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
fetchedConfig.hasherSalt, fetchedConfig.hasherSalt,
buildEnvConfig.hasherSalt, buildEnvConfig.hasherSalt,
defaultHasherSettings.Salt defaultHasherSettings.Salt
)!; );
const minHashLength = const minHashLength =
windowConfig.hasherMinLength || windowConfig.hasherMinLength ||
@@ -296,7 +296,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
BaseUrl: normalizeBaseUrl(baseUrl), BaseUrl: normalizeBaseUrl(baseUrl),
}, },
HasherSettings: { HasherSettings: {
Salt: salt, Salt: salt || '',
MinHashLength: minHashLength, MinHashLength: minHashLength,
}, },
ConfigSource: source, ConfigSource: source,
PostFundManagement.ConsoleUI/src/services/toolsService.ts
+1 -3
View File
@@ -11,9 +11,7 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
*/ */
export const HASHER_SETTINGS = { export const HASHER_SETTINGS = {
minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11, minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
salt: salt: (env.VITE_HASHER_SALT as string) || '',
(env.VITE_HASHER_SALT as string) ||
'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
}; };
// Singleton Hashids instance initialized with salt & minHashLength // Singleton Hashids instance initialized with salt & minHashLength
PostFundManagement.ConsoleUI/src/utils/hashids.ts
+1 -3
View File
@@ -6,9 +6,7 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
export const HASHER_SETTINGS = { export const HASHER_SETTINGS = {
minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11, minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
salt: salt: (env.VITE_HASHER_SALT as string) || '',
(env.VITE_HASHER_SALT as string) ||
'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
}; };
let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength); let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
PostFundManagement.PartnerUI/docker-entrypoint.sh
+2 -7
View File
@@ -30,17 +30,16 @@ OIDC_CLIENT_ID="${VITE_OIDC_CLIENT_ID:-${OIDC_CLIENT_ID:-${SecuritySettings__Cli
OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}" OIDC_SCOPE="${VITE_OIDC_SCOPE:-${OIDC_SCOPE:-${SecuritySettings__Scope:-${SecuritySettings_Scope:-${SCOPE:-}}}}}"
# 6. Hasher Settings # 6. Hasher Settings
HASHER_SALT="${VITE_HASHER_SALT:-${HASHER_SALT:-${HasherSettings__Salt:-${HasherSettings_Salt:-}}}}}"
HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}" HASHER_MIN_LENGTH="${VITE_HASHER_MIN_LENGTH:-${HASHER_MIN_LENGTH:-${HasherSettings__MinLength:-${HasherSettings_MinLength:-}}}}}"
if [ -d "$TARGET_DIR" ]; then if [ -d "$TARGET_DIR" ]; then
echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..." echo "[docker-entrypoint] Generating runtime configuration files in $TARGET_DIR..."
# Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization # Generate env-config.js for instant, synchronous window.__RUNTIME_CONFIG__ initialization
# Public SPA clients use Authorization Code flow with PKCE; client secrets must NEVER be injected or exposed here. # Public SPA clients use Authorization Code flow with PKCE; client secrets and hasher salts must NEVER be injected or exposed here.
cat <<EOF > "$TARGET_DIR/env-config.js" cat <<EOF > "$TARGET_DIR/env-config.js"
// Generated dynamically at container startup from deployment environment variables // Generated dynamically at container startup from deployment environment variables
// Note: Secrets such as client secrets or private keys must NEVER be exposed here. // Note: Secrets such as client secrets, private keys, or hashing salts must NEVER be exposed here.
window.__RUNTIME_CONFIG__ = { window.__RUNTIME_CONFIG__ = {
API_BASE_URL: "${API_BASE_URL}", API_BASE_URL: "${API_BASE_URL}",
VITE_API_BASE_URL: "${API_BASE_URL}", VITE_API_BASE_URL: "${API_BASE_URL}",
@@ -52,8 +51,6 @@ window.__RUNTIME_CONFIG__ = {
VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}", VITE_OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}",
OIDC_SCOPE: "${OIDC_SCOPE}", OIDC_SCOPE: "${OIDC_SCOPE}",
VITE_OIDC_SCOPE: "${OIDC_SCOPE}", VITE_OIDC_SCOPE: "${OIDC_SCOPE}",
HASHER_SALT: "${HASHER_SALT}",
VITE_HASHER_SALT: "${HASHER_SALT}",
HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}", HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}", VITE_HASHER_MIN_LENGTH: "${HASHER_MIN_LENGTH}",
ApiSettings: { ApiSettings: {
@@ -66,7 +63,6 @@ window.__RUNTIME_CONFIG__ = {
Scope: "${OIDC_SCOPE}" Scope: "${OIDC_SCOPE}"
}, },
HasherSettings: { HasherSettings: {
Salt: "${HASHER_SALT}",
MinHashLength: "${HASHER_MIN_LENGTH}" MinHashLength: "${HASHER_MIN_LENGTH}"
} }
}; };
@@ -85,7 +81,6 @@ EOF
"Scope": "${OIDC_SCOPE}" "Scope": "${OIDC_SCOPE}"
}, },
"HasherSettings": { "HasherSettings": {
"Salt": "${HASHER_SALT}",
"MinHashLength": "${HASHER_MIN_LENGTH}" "MinHashLength": "${HASHER_MIN_LENGTH}"
} }
} }
PostFundManagement.PartnerUI/public/config.json
-1
View File
@@ -10,7 +10,6 @@
"BaseUrl": "" "BaseUrl": ""
}, },
"HasherSettings": { "HasherSettings": {
"Salt": "",
"MinHashLength": "" "MinHashLength": ""
} }
} }
PostFundManagement.PartnerUI/src/config.ts
+5 -5
View File
@@ -14,7 +14,7 @@ export interface ApiSettings {
} }
export interface HasherSettings { export interface HasherSettings {
Salt: string; Salt?: string;
MinHashLength: number; MinHashLength: number;
} }
@@ -40,11 +40,11 @@ export const defaultApiSettings: ApiSettings = {
}; };
export const defaultHasherSettings: HasherSettings = { export const defaultHasherSettings: HasherSettings = {
Salt: 'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==', Salt: '',
MinHashLength: 11, MinHashLength: 11,
}; };
function syncAllHasherSettings(salt: string, minHashLength: number): void { function syncAllHasherSettings(salt: string | undefined, minHashLength: number): void {
updateToolsHasherSettings(salt, minHashLength); updateToolsHasherSettings(salt, minHashLength);
updateUtilsHasherSettings(salt, minHashLength); updateUtilsHasherSettings(salt, minHashLength);
} }
@@ -233,7 +233,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
fetchCfg.hasherSalt, fetchCfg.hasherSalt,
envCfg.hasherSalt, envCfg.hasherSalt,
defaultHasherSettings.Salt defaultHasherSettings.Salt
)!; );
const hasherMinLength = const hasherMinLength =
winCfg.hasherMinLength || winCfg.hasherMinLength ||
fetchCfg.hasherMinLength || fetchCfg.hasherMinLength ||
@@ -252,7 +252,7 @@ function resolveConfig(fetchedJson?: Record<string, any>): AppConfig {
BaseUrl: baseUrl, BaseUrl: baseUrl,
}, },
HasherSettings: { HasherSettings: {
Salt: hasherSalt, Salt: hasherSalt || '',
MinHashLength: hasherMinLength, MinHashLength: hasherMinLength,
}, },
ConfigSource: source, ConfigSource: source,
PostFundManagement.PartnerUI/src/services/toolsService.ts
+1 -3
View File
@@ -11,9 +11,7 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
*/ */
export const HASHER_SETTINGS = { export const HASHER_SETTINGS = {
minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11, minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
salt: salt: (env.VITE_HASHER_SALT as string) || '',
(env.VITE_HASHER_SALT as string) ||
'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
}; };
let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength); let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);
PostFundManagement.PartnerUI/src/utils/hashids.ts
+1 -3
View File
@@ -6,9 +6,7 @@ const env = (typeof import.meta !== 'undefined' && import.meta.env
export const HASHER_SETTINGS = { export const HASHER_SETTINGS = {
minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11, minHashLength: Number(env.VITE_HASHER_MIN_LENGTH) || 11,
salt: salt: (env.VITE_HASHER_SALT as string) || '',
(env.VITE_HASHER_SALT as string) ||
'TGlnaHQgQ2hhcm1zLCBNaWRyYW5kQm9va3MgbWFrZSBsb3RzIG9mIG1vbmV5IGFuZCBhcmUgYSBzdWNjZXNzZnVsIHZpcmFsIHN0b3J5IGluIFNvdXRoIEFmcmljYQ==',
}; };
let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength); let hasher = new Hashids(HASHER_SETTINGS.salt, HASHER_SETTINGS.minHashLength);