Skip to content

fix(ci): restore core-decoupling ratchet to baseline — main is red after #549 #553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Weegy merged 2 commits into from
Jul 30, 2026
Merged

fix(ci): restore core-decoupling ratchet to baseline — main is red after #549 #553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
52ba543
fix(channel-api): drop dev-platform cross-references from API-key com…
Weegy Jul 30, 2026
315b514
Merge branch 'main' into fix/core-decoupling-ratchet-apikey-comments
Weegy Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions middleware/packages/harness-api-key-auth/src/apiKeyToken.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,11 @@
* any plugin can share the SAME implementation (core must never import from a
* channel plugin).
*
* Mirrors `middleware/src/devplatform/jobToken.ts` (the dev-runner's one-time
* job token), the closest existing precedent for a bearer credential this
* codebase hashes at rest and verifies in constant time. The plaintext exists
* Follows the shape this codebase already uses for one-time bearer credentials
* elsewhere: hashed at rest, verified in constant time, plaintext shown once.
* (The path is deliberately not cited — the closest precedent lives in the Dev
* Platform, which epic #470 is extracting into its own repository.) The
* plaintext exists
* exactly once — at creation time, returned to the operator — and is never
* persisted. Only its sha256 hex lands in the vault (`apiKeyStore.ts`).
* Verification hashes the presented token and compares digests with
Expand All @@ -16,7 +18,7 @@
import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';

/** Every minted key carries this prefix so it is greppable in logs/incidents
* and visually distinct from other omadia tokens (e.g. `djr_`). */
* and visually distinct from the other prefixed token families omadia mints. */
export const API_KEY_PREFIX = 'omk_';

/** 32 random bytes → 43 base64url chars; with the prefix, a 47-char key. */
Expand Down
7 changes: 4 additions & 3 deletions middleware/test/channelApi/apiKeyToken.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,10 @@ import {
} from '../../packages/harness-api-key-auth/src/apiKeyToken.js';

/**
* Issue #438 — pure-unit coverage for the API-key token, mirroring
* `test/devplatform/jobToken.test.ts` (the closest existing precedent for a
* hashed, constant-time-verified bearer credential in this codebase).
* Issue #438 — pure-unit coverage for the API-key token, following the coverage
* shape this codebase already uses for hashed, constant-time-verified bearer
* credentials: prefix and entropy, hash-only persistence, and a verify path
* that rejects on any mismatch without leaking timing.
*/
describe('channelApi/apiKeyToken', () => {
it('mints `omk_` + 32 random bytes base64url, and stores only the sha256 hex', () => {
Expand Down
Loading