fix(auth): report safe credential inspection diagnostics #27

Merged

gitchegumi merged 1 commit from kiyi/credential-inspection-diagnostics into main

2026-09-07 21:49:53 -05:00

kiyi commented

2026-09-07 21:45:24 -05:00

Member

Add fixed, reviewed diagnostics for missing/empty OIDC configuration, endpoint-origin mismatch, HTTPS requirements, redirects, HTTP rejection, TLS/connectivity failures, invalid JSON, oversized responses and invalid token shape. Keep unknown validation errors generic. Never print variable values, request URLs, response bodies or arbitrary exception text. Reject non-object JWT payloads before attempting to use claims.

This is shared functionality for all app callers. Inspection still contacts Forgejo only and cannot issue OpenBao/Kubernetes credentials or deploy an app. Existing origin, TLS and permission checks remain enforced.

Validation: all 92 tests passed in WSL, including six new diagnostic tests covering missing variables, rejected origins, response shapes, transport failures, secret non-disclosure and successful inspection without deployment. The Windows full-suite attempt hit temporary-file permission failures; Linux validation passed. git diff --check passed.

Evidence: https://git.gitchegumi.com/Homelab/actual-budget/actions/runs/77/jobs/1/attempt/1
Related: #19. After merge, release a patch version and update the Actual caller pins before rerunning inspection. This improves diagnosis; it does not claim to fix the still-unknown runtime cause of run #77.

Actual credential inspection run #77 stopped with only “Automatic credential issuance failed; deployment stopped.” The generic handler discarded the reason before any diagnostic claims were emitted, so the existing log cannot establish the root cause. Add fixed, reviewed diagnostics for missing/empty OIDC configuration, endpoint-origin mismatch, HTTPS requirements, redirects, HTTP rejection, TLS/connectivity failures, invalid JSON, oversized responses and invalid token shape. Keep unknown validation errors generic. Never print variable values, request URLs, response bodies or arbitrary exception text. Reject non-object JWT payloads before attempting to use claims. This is shared functionality for all app callers. Inspection still contacts Forgejo only and cannot issue OpenBao/Kubernetes credentials or deploy an app. Existing origin, TLS and permission checks remain enforced. Validation: all 92 tests passed in WSL, including six new diagnostic tests covering missing variables, rejected origins, response shapes, transport failures, secret non-disclosure and successful inspection without deployment. The Windows full-suite attempt hit temporary-file permission failures; Linux validation passed. git diff --check passed. Evidence: https://git.gitchegumi.com/Homelab/actual-budget/actions/runs/77/jobs/1/attempt/1 Related: #19. After merge, release a patch version and update the Actual caller pins before rerunning inspection. This improves diagnosis; it does not claim to fix the still-unknown runtime cause of run #77.

kiyi added 1 commit

2026-09-07 21:45:24 -05:00

fix(auth): report safe credential inspection diagnostics

Workflow acceptance / acceptance (pull_request) Successful in 45s

Details

Repository security / security-1 (pull_request) Successful in 1m25s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m49s

Details

fd8174e755

Distinguish configuration, endpoint, transport and response failures without logging secrets. Validate identity payloads and cover inspection failure paths.