feat: redact replication-log secrets + bump core for registry deploy auth#287
feat: redact replication-log secrets + bump core for registry deploy auth#287kriszyp wants to merge 6 commits into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a log redaction utility to mask sensitive fields, such as SSH keys, passwords, and registry tokens, in replicated or forwarded operations before they are written to debug logs. It also updates the @harperfast/rocksdb-js dependency and adds corresponding unit tests. Feedback on the changes suggests optimizing the redaction logic for registryAuth arrays to avoid eagerly cloning the operation object when no tokens are present, thereby preserving the zero-allocation fast-path.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Reviewed; no blockers found. |
Adds redactOperationForLog to mask SSH keys, passwords, auth headers, and deploy_component registryAuth tokens before the replication send/receive paths log operations at debug. Defense-in-depth: the origin strips registryAuth before replicating, so the token should never reach peers, but any forwarding path that logs the operation is now masked. Bumps core to 719c6128d (transient private-registry auth for deploy_component). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Picks up the core fixes for scope-less default-registry routing and inherited npm userconfig preservation in the transient registry-auth deploy path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- logRedaction.ts: only clone the operation for registryAuth when an entry actually carries a token, so operations without sensitive data keep the zero-allocation fast path (addresses gemini review). Behavior unchanged when a token is present. - Bump core submodule to 1a231963f (transient registryAuth token-handling hardening: immediate req strip, cleanup try/catch, double-write guard). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Bump core submodule to 9d46b36 (kris/registry-deploy-auth-core merged with main) so harper-pro builds/tests against the now-green main, which fixes the Format Check, the #1114 resync-idempotency unit tests, and the upgrade-fixture integration breakage that were failing on the prior main. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Bump core to 4e90560 (newline guard on registry/token + in-memory token clear). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Picks up the merge of origin/main into the core branch (urlPath #1113 alongside registryAuth), keeping the integrated harper-pro PR building against current core. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
kriszyp
force-pushed
the
kris/registry-deploy-auth
branch
from
574fcfb to
7f4d0a1
Compare
2 participants
Summary
Harper-pro half of the private-registry deploy-by-reference feature (
deploy_component package=npm:@org/app@1.2.3against a private npm registry). The token-handling core change lives in HarperFast/harper#1158 — this PR bumps thecoresubmodule to it and adds the harper-pro-side defense-in-depth redaction.replication/logRedaction.ts(new):redactOperationForLog()masks top-leveltoken/key/password/hdbAuthHeaderand nestedregistryAuth[].tokenbefore an operation is written to a debug log. Returns the same object reference when there is nothing sensitive, so the common (no-secret) path allocates nothing.replicator.ts— guarded bylogger.logsAtLevel('debug')(module-namespace logger, so the redaction call only runs when debug logging is on).replicationConnection.ts—logger.debug?.(…)short-circuits when debug is off, so no separate guard needed.coresubmodule →ea0d9e9ce(the registry-auth feature + its review fixes).@harperfast/rocksdb-js→^1.4.2(package.json + lockfile).Purpose
The registry token must never persist or be exposed on a data-plane node — not in the package reference,
harperdb-config.yaml, thehdb_deploymentrow, logs, or replication. The core PR strips the token from the replicated operation; this PR closes the logging surface as a second, independent layer (the token can't leak via a debug-level operation dump even if an upstream strip is ever missed).Where to focus
logRedaction.tscorrectness — confirm the masked-key set is complete and the nestedregistryAuth[].tokenwalk matches the contract shaperegistryAuth: [{ registry, token, scope? }]. The no-allocation fast-path (same-ref return when nothing sensitive) is the one bit of cleverness worth a look.^1.4.2root bump — this rides along because thecorepointer advances ~14 commits to currentmain, which depends on rocksdb-js 1.4.2 (now thelatestdist-tag); syncing the harper-pro root + lockfile avoids a resolved-version skew between core and the integrated build. Called out by the Codex pre-review; bundled here deliberately rather than as a separate PR.Notes
corepointer references its head commit.