fix(security): migrate unauthenticated NATS defaults to authenticated URL - #1292
Conversation
Replace nats://localhost:4222 with nats://nats:pmoves@nats:4222 in work-marshaling (5 refs) and node-registry (7 refs). Refs: AGNOTE4482 P0
Replace nats://localhost:4222 and nats://127.0.0.1:4222 with nats://nats:pmoves@nats:4222 across 9 tool scripts. Refs: AGNOTE4482 P0
Update export example to show authenticated NATS URL. Refs: AGNOTE4482 P0
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 9 minutes and 21 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (15)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c72684d63b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Ignore docker-only alias when running on host. | ||
| if nats_url.startswith("nats://nats:") or nats_url.startswith("tls://nats:"): | ||
| return "nats://127.0.0.1:4222" | ||
| return "nats://nats:pmoves@nats:4222" |
There was a problem hiding this comment.
This script is explicitly host-run, but _resolve_nats_url now returns nats://nats:pmoves@nats:4222 when NATS_URL uses the Docker alias, which is not resolvable from the host. That regresses the previous behavior (mapping Docker alias to loopback) and causes nc.connect(...) to fail unless users manually override VOICE_FOLLOW_NATS_URL. Please keep the host translation behavior (while preserving auth) so the default path still works outside containers.
Useful? React with 👍 / 👎.
| # Translate docker-only alias to host-accessible URL | ||
| if nats_url.startswith("nats://nats:") or nats_url.startswith("tls://nats:"): | ||
| return "nats://127.0.0.1:4222" | ||
| return "nats://nats:pmoves@nats:4222" |
There was a problem hiding this comment.
The cast follower has the same host-run resolver contract, but this change makes Docker-alias input resolve to nats://nats:pmoves@nats:4222 instead of a host-accessible URL. On non-container execution, the nats hostname typically does not resolve, so startup fails even though previous versions worked with no extra env setup. This should continue translating Docker-internal aliases to loopback for host execution.
Useful? React with 👍 / 👎.
…2 non-urgent) (#1690) Lane 1 (Archon fork-sync): DONE — fork synced to upstream main 0.4.1, bun 1.3.14-slim base, Archon #15 merged, gitlinks reconciled #1674, vendored pin retired, branch protection right-sized for solo operator. Lane 2 (NATS-auth): scope-and-report overturned the "~17 urgent files" framing. env.shared.example already emits the authed NATS_URL and all production wiring reads it via os.getenv — zero consumers of the bare nats://nats:4222 constant. DoX already normalizes both forms (#1375/#1292); pmoves_health's literal is __main__ example code; the ~30 triple copies have drifted (md5 differs) so there is no clean single-source fix. Decision: no 30-file hardened-branch sweep for a non-issue; any fallback hardening is a separate low-priority refactor at the canonical pmoves-cipher-mcp package. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
AGNOTE4482 P0 — NATS Auth Batch Migration
Summary
Batch migration of unauthenticated NATS connection strings across production code.
Changes
work-marshaling,node-registry— 12 refs migratedPattern
nats://localhost:4222andnats://127.0.0.1:4222→nats://nats:pmoves@nats:4222Preservation
chat-relay/tests/test_relay.pyuntouched (test cases override with custom URLs)Stats