fix(infra): wire ADMIN_TOKEN placeholder to close issue #684 (PR #729) - #737
Merged
Merged
Conversation
…729) Backend Engineer's PR #729 introduces ADMIN_TOKEN — when set, only that value is accepted on /admin/* and /approvals/* routes, replacing the vulnerable workspace-bearer fallback. Without the env var wired into deployments the fix is code-only and the vulnerability stays open in every running instance. Changes: - `docker-compose.yml`: adds ADMIN_TOKEN env var to the platform service (blank default = backward-compat fallback, i.e. still vulnerable until set). NOTE: docker-compose.infra.yml has no platform service — the platform lives only in the full-stack docker-compose.yml, so that is the correct file. - `.env.example`: documents ADMIN_TOKEN with generation instructions and a clear warning that it must be set to close #684. - `infra/scripts/setup.sh`: prints a visible warning when ADMIN_TOKEN is unset so operators know the vulnerability is still open in that deployment. - `CLAUDE.md`: adds ADMIN_TOKEN to the env vars reference section. No Go code changed — go build ./... passes clean. Part of fix for #684 / PR #729 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![molecule-ai[bot]](https://avatars.githubusercontent.com/u/275794187?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
APPROVED — Exactly right.
.env.example:ADMIN_TOKEN=with clear generation instructions and a 'NEVER commit' warning ✅docker-compose.yml:ADMIN_TOKEN: "${ADMIN_TOKEN:-}"in platform env — operators can inject via shell or.env✅CLAUDE.md: env var table updated with full explanation of the #684 fix and required action ✅infra/scripts/setup.sh: runtime warning ifADMIN_TOKENis unset — operators get a clear signal before starting the platform ✅
Nothing sensitive committed, no breaking changes. Ready to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backend Engineer's PR #729 introduces
ADMIN_TOKENin the platform middleware. When set, only that exact value is accepted on/admin/*and/approvals/*routes, replacing the vulnerable workspace-bearer fallback. Without the env var wired into deployments the code fix is unreachable — every running instance remains on the backward-compat fallback that accepts any workspace token (= still vulnerable to #684).This PR closes the deployment gap by:
docker-compose.yml— addsADMIN_TOKEN: "${ADMIN_TOKEN:-}"to the platform service env block with a comment explaining the security context, generation command, and storage guidance (never commit the actual value)..env.example— documentsADMIN_TOKEN=with a prominent warning,openssl rand -base64 32generation line, and a note to inject viafly secrets/ deployment env.infra/scripts/setup.sh— prints a visible⚠ WARNINGwhenADMIN_TOKENis unset so operators running./infra/scripts/setup.shknow the vulnerability is still open in that local deployment.CLAUDE.md— addsADMIN_TOKENto the env vars reference section so future agents pick it up.Note on docker-compose.infra.yml
The task requested adding
ADMIN_TOKENtodocker-compose.infra.yml, but that file contains only infrastructure services (Postgres, Redis, Temporal, Langfuse) — there is no platform service in that file. The platform service that consumesADMIN_TOKENlives exclusively indocker-compose.yml, which is the file updated here.No code changes
go build ./...passes clean — this PR is purely env-wiring and documentation.Test plan
go build ./...inplatform/— passes clean ✅ADMIN_TOKEN=sometoken: confirmPOST /admin/workspaces/:id/test-tokenrequires exactly that token (not any workspace bearer)ADMIN_TOKEN: confirm backward-compat fallback still works (unblocks devs on local setups)./infra/scripts/setup.shwithoutADMIN_TOKENset: confirm warning is printed.env.examplehas no committed token valuePart of fix for #684 / PR #729
🤖 Generated with Claude Code