Commit authconfig.json (asserted expected auth-config values) + diff-on-push drift assertion for GoTrue config
Split out of PLUTO-630 (closed) per coder-pluto-cc's recommendation: keep the machine drift-gate distinct from PLUTO-631's human-readable mirror doc. Right now nothing detects a silent regression on pluto's Supabase Auth config (e.g. someone re-enabling external_email_enabled, or a stray allow-list entry creeping back in) -- the only record of correct state is tonight's wi events. Build: commit authconfig.json asserting the expected values (not mere presence) for the 7-field extract list (site_url, uri_allow_list, external_google_enabled, external_google_client_id, external_email_enabled, disable_signup, mailer_autoconfirm), plus a diff-on-push check (separate GET via Management API, PAT from git-ignored overlay, field-select -- never dump/log external_google_secret) wired into .gitpush-pre.sh or equivalent. Non-urgent hardening, not blocking -- the actual vuln is already closed.
Questions
Activity
-
coder-pluto-cc
-
DONE 2026-07-30 SHA 1c0af31 v2.22.13. Shipped: db/state/authconfig.json (expected VALUES for all 7 fields + per-field _rationale, incl. explicit "never harden disable_signup to true" note; no secret-bearing field) + scripts/assert-authconfig.mjs (separate Management-API GET, field-select immediately so external_google_secret/SMTP creds never flow on, strict equality) wired into .gitpush-pre.sh BEFORE the doc-only short-circuit (config drift is out-of-band, unrelated to the diff, so a doc-only push is an equally valid moment to catch it). Behaviour: HARD-FAIL exit 1 on real value mismatch; loud "SKIP (UNVERIFIED)" exit 0 on missing PAT / non-200 / network timeout so the push lane is never stranded on a Supabase blip -- a skip is reported as UNVERIFIED, never as OK. Consequence to know: the gate is only ARMED for a pusher whose overlay carries SUPABASE_ACCESS_TOKEN (coder-pluto-cc and now db-pluto-cc). TESTS RUN: T1 no-PAT -> SKIP exit 0; T2 live-matches-committed -> OK exit 0; T3 --print field extract; T4 simulated the exact feared regression (expected external_email_enabled:true + localhost entry restored vs live) -> exit 1 with per-field expected/live/why-it-matters output, then restored and re-asserted clean; plus bash -n on the full hook and a set -euo pipefail simulation proving neither the DRIFT nor the SKIP path aborts the hook incorrectly. PTD (Class-S): version 2.22.13 live on cache-busted /api/app-version, new dpl_8Bf4zV62UFpQDjx1maJfb3sVk69U, state READY, githubCommitSha 1c0af311..., target production, alias includes evolutiva.pensanta.com, aliasError null.
-
SHA 1c0af31 v2.22.13. authconfig.json + assert-authconfig.mjs wired into .gitpush-pre.sh, hard-fails on real drift, loud SKIP(UNVERIFIED) on missing-PAT/timeout (never reads as pass), field-select (no secrets in diff/log), disable_signup rationale-commented against future 'hardening'. Tested: no-PAT skip, live-match OK, --print, simulated regression (T4) catches it then clean re-assert. PTD Class-S: /api/app-version live-matched, deploy READY, alias correct. Limitation: only fires on push by a PAT-holder -- follow-up filed for scheduled/cron detection.