fix(security): redact operational diagnostics from /api/health/auth-config

[LucasSantana-Dev]

Summary

Found during a repo-wide security sweep (scoped to skip #1706-#1709, which cover known code-scanning/CVE findings).

/api/health/auth-config is unauthenticated by design — it verifies OAuth config before a session can exist, so clientId/redirectUri staying public is correct (they're already visible in every login flow's OAuth authorize URL, constructed in authorizeUrlPreview on the same response). But the endpoint also returned warnings, sessionSecretConfigured, and redisHealthy to any anonymous caller — none of that is needed by legitimate unauthenticated callers, and it only helps an attacker fingerprint deployment misconfiguration.

Redacts those three fields when NODE_ENV === 'production', dev/test behavior unchanged. No new secret or auth requirement — avoids breaking whatever currently polls this endpoint for basic health checks.

Test plan

• npm run type:check --workspace=packages/backend clean
• npm run lint --workspace=packages/backend: 0 errors (4 pre-existing unrelated warnings)
• packages/backend/tests/integration/routes/health.test.ts: 40/40 pass, including a new test asserting the redaction
• Full packages/backend suite: 1348/1348 pass (2 unrelated files flaked once under full-parallel load, both pass 100% in isolation — pre-existing flakiness tracked in Backend integration test suite: flaky failures under full parallel run #1704)

---

Summary by cubic

Redacts operational diagnostics from /api/health/auth-config outside development to prevent information disclosure. Public OAuth fields remain; existing health checks are unaffected.

• Bug Fixes
  • In production (including staging), remove warnings, sessionSecretConfigured, redisHealthy, and status from the response.
  • Keep clientId, redirectUri, frontendOrigins, clientIdConfigured, and authorizeUrlPreview.
  • Dev/test unchanged; added redaction tests and restore NODE_ENV after prod-mode tests to avoid leaks.

^{Written for commit 3ec2b39. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes

  • Improved the health endpoint so anonymous requests are treated as unauthenticated.
  • In production, the auth health response now returns a reduced, redacted view with only high-level status and selected auth details.
  • Non-production environments continue to receive the full health response.

• Tests

  • Updated integration coverage to match the new production redaction behavior.
  • Fixed test environment cleanup so one test’s settings don’t affect others.

[coderabbitai]

📝 Walkthrough

Walkthrough

The health route's auth-config endpoint now returns a redacted JSON response in production, exposing only status and limited auth fields while omitting diagnostics like warnings, sessionSecretConfigured, and redisHealthy. Integration tests were updated with NODE_ENV isolation and new assertions covering the redaction behavior.

Changes

Production redaction of health auth-config

Layer / File(s)	Summary
Redacted response for production packages/backend/src/routes/health.ts	Adds a production-only conditional that returns a reduced JSON payload with limited status and auth fields, then returns early; non-production requests continue to return the full response.
Test coverage and environment isolation packages/backend/tests/integration/routes/health.test.ts	Captures and restores process.env.NODE_ENV via afterEach, switches to a destructured Jest globals import, updates production test assertions to expect warnings as undefined, and adds a new test verifying sessionSecretConfigured and redisHealthy are redacted while clientId, redirectUri, and authorizeUrlPreview remain defined.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main security change to redact diagnostics from /api/health/auth-config.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/health-auth-config-info-disclosure

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[github-actions]

	Warnings
⚠️	User-facing change without a CHANGELOG.md update. Add a line under ## [Unreleased] if this should appear in release notes. (Or apply the skip-changelog label if this PR does not affect end users.)

Generated by 🚫 dangerJS against 3ec2b39

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Auto-approved: Redacts operational diagnostics from auth-config endpoint in production to prevent information disclosure. Simple conditional response with full test coverage.

Re-trigger cubic</sub>

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/backend/src/routes/health.ts`:
- Around line 116-127: The production branch in the health route is still
leaking operational state by returning healthResponse.status even though auth
warnings are redacted. Update the response built in the health handler to omit
status entirely or return a neutral value in production, while keeping the auth
fields redacted; use the existing healthResponse object in the route to locate
the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40f023bb-2e57-49fa-9670-4c8baa50cfb7

📥 Commits

Reviewing files that changed from the base of the PR and between 8da316b and af363e9.

📒 Files selected for processing (2)

• packages/backend/src/routes/health.ts
• packages/backend/tests/integration/routes/health.test.ts

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Auto-approved: Security fix redacting operational diagnostics from public health endpoint in production. Low risk, well-tested.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud