File size: 3,299 Bytes
c794b6b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 | """
Production security validation and secret resolution.
"""
from __future__ import annotations
import hmac
import os
import sys
# Legacy well-known defaults — rejected in strict startup; never auto-resolved from code.
KNOWN_INSECURE_API_KEYS = frozenset({"cepheus-dev-key"})
def is_production() -> bool:
return os.getenv("CEPHEUS_PRODUCTION", "").strip() == "1"
def is_demo_mode() -> bool:
"""Demo simulations (issue progress, missing-person auto-resolve) — never in production."""
if is_production():
return False
return os.getenv("CEPHEUS_DEMO_MODE", "").strip() == "1"
def is_auth_dev_mode() -> bool:
"""Local-only insecure auth defaults — never in production."""
if is_production():
return False
return os.getenv("CEPHEUS_AUTH_DEV_MODE", "").strip() == "1"
def safe_compare_strings(a: str, b: str) -> bool:
if not a or not b:
return False
return hmac.compare_digest(a.encode("utf-8"), b.encode("utf-8"))
def resolve_dev_api_key() -> str:
if not is_auth_dev_mode():
return ""
return os.getenv("CEPHEUS_DEV_API_KEY", "").strip()
def resolve_api_key() -> str:
key = os.getenv("CEPHEUS_API_KEY", "").strip()
if key:
return key
if is_production():
return ""
return resolve_dev_api_key()
def resolve_readonly_api_key() -> str:
"""Optional read-only automation key (ISSUE-178). Role enforced at route dependencies."""
return os.getenv("CEPHEUS_READONLY_API_KEY", "").strip()
def api_key_scope_label() -> str:
"""Document intended API key use (audit / ops); does not enforce RBAC by itself."""
return os.getenv("CEPHEUS_API_KEY_SCOPE", "").strip()
def validate_startup() -> None:
"""Fail fast when production or a real cloud deployment is misconfigured.
Local development may run the cloud stub engine (CEPHEUS_CLOUD=1) together with
CEPHEUS_AUTH_DEV_MODE=1; that combination is intentionally exempt from the strict
secret requirements so developers can run the full stack locally. Real cloud
deployments must NOT set CEPHEUS_AUTH_DEV_MODE and therefore remain strict.
"""
errors: list[str] = []
dev_mode = is_auth_dev_mode()
cloud = os.getenv("CEPHEUS_CLOUD", "").strip() in ("1", "true", "yes")
# Strict when in production, or a cloud deploy that is NOT explicitly in dev mode.
strict = is_production() or (cloud and not dev_mode)
if strict:
if not os.getenv("CEPHEUS_JWT_SECRET", "").strip():
errors.append("CEPHEUS_JWT_SECRET is required in production/cloud")
if dev_mode and is_production():
errors.append("CEPHEUS_AUTH_DEV_MODE must be 0 in production")
key = os.getenv("CEPHEUS_API_KEY", "").strip()
if not key or key in KNOWN_INSECURE_API_KEYS:
errors.append("CEPHEUS_API_KEY must be set to a non-default value in production/cloud")
cors = os.getenv("CORS_ORIGINS", "").strip()
if not cors:
errors.append("CORS_ORIGINS must be set in production/cloud")
if errors:
for msg in errors:
print(f"FATAL: {msg}", file=sys.stderr)
raise SystemExit(1)
def auth_enabled_check() -> bool:
return bool(os.getenv("CEPHEUS_JWT_SECRET", "").strip()) or is_auth_dev_mode()
|