Mike/ShieldAI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix P1 security findings for FRE-4806

Browse Source 
- Add DD_API_KEY and DD_SITE to Zod validation schema (config.ts)
- Truncate API key before storing in user.id to prevent Sentry leak (auth.middleware.ts)
This commit is contained in:
Michael Freno
2026-05-12 12:42:42 -04:00
parent 01ffe79bbe
commit 56016a6124
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
packages/api/src/middleware/auth.middleware.ts
View File

@@ -46,9 +46,10 @@ export async function authMiddleware(fastify: FastifyInstance) {
if (apiKey) { if (apiKey) {
// In production, validate API key against database // In production, validate API key against database
authReq.apiKey = apiKey; authReq.apiKey = apiKey;
const apiKeyPrefix = apiKey.slice(0, 8);
authReq.user = { authReq.user = {
id: `api-${apiKey}`, id: `api-${apiKeyPrefix}...`,
email: `api-${apiKey}@services.internal`, email: `api-${apiKeyPrefix}@services.internal`,
role: 'service', role: 'service',
}; };
authReq.authType = 'api-key'; authReq.authType = 'api-key';

4
packages/monitoring/src/config.ts
View File

@@ -7,6 +7,8 @@ const monitoringEnvSchema = z.object({
DD_TRACE_ENABLED: z.string().default('true'), DD_TRACE_ENABLED: z.string().default('true'),
DD_TRACE_SAMPLE_RATE: z.string().transform((v) => Number(v)).default('1.0'), DD_TRACE_SAMPLE_RATE: z.string().transform((v) => Number(v)).default('1.0'),
DD_LOGS_INJECTION: z.string().default('true'), DD_LOGS_INJECTION: z.string().default('true'),
DD_API_KEY: z.string().default(''),
DD_SITE: z.string().default('datadoghq.com'),
DD_AGENT_HOST: z.string().default('localhost'), DD_AGENT_HOST: z.string().default('localhost'),
DD_AGENT_PORT: z.string().transform((v) => Number(v)).default('8126'), DD_AGENT_PORT: z.string().transform((v) => Number(v)).default('8126'),
SENTRY_DSN: z.string().default(''), SENTRY_DSN: z.string().default(''),
@@ -25,6 +27,8 @@ export function getMonitoringConfig(): MonitoringConfig {
DD_TRACE_ENABLED: process.env.DD_TRACE_ENABLED, DD_TRACE_ENABLED: process.env.DD_TRACE_ENABLED,
DD_TRACE_SAMPLE_RATE: process.env.DD_TRACE_SAMPLE_RATE, DD_TRACE_SAMPLE_RATE: process.env.DD_TRACE_SAMPLE_RATE,
DD_LOGS_INJECTION: process.env.DD_LOGS_INJECTION, DD_LOGS_INJECTION: process.env.DD_LOGS_INJECTION,
DD_API_KEY: process.env.DD_API_KEY,
DD_SITE: process.env.DD_SITE,
DD_AGENT_HOST: process.env.DD_AGENT_HOST, DD_AGENT_HOST: process.env.DD_AGENT_HOST,
DD_AGENT_PORT: process.env.DD_AGENT_PORT, DD_AGENT_PORT: process.env.DD_AGENT_PORT,
SENTRY_DSN: process.env.SENTRY_DSN, SENTRY_DSN: process.env.SENTRY_DSN,