From 8716b92c7fc55b2c6bf1c28f95ff54a46b04463d Mon Sep 17 00:00:00 2001 From: ghost <49853598+JSONbored@users.noreply.github.com> Date: Sun, 28 Jun 2026 05:27:27 -0700 Subject: [PATCH] fix(export): redact cached Orb token envelopes --- scripts/export-d1-core.mjs | 3 ++- test/unit/export-d1-core.test.ts | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/export-d1-core.mjs b/scripts/export-d1-core.mjs index 46be0bee27..ac59ed47a5 100644 --- a/scripts/export-d1-core.mjs +++ b/scripts/export-d1-core.mjs @@ -16,12 +16,13 @@ export const EXCLUDED_TABLES = new Set(["sqlite_sequence", "sqlite_stat1", "d1_m // • submission_user_tokens.encrypted_token — short-lived GitHub OAuth token envelopes, cloud-scoped. // • orb_enrollments.secret_hash — one-time enrollment secret hashes. // • orb_enrollments.relay_secret_* — encrypted relay webhook signing secret material. +// • orb_enrollments.cached_token_json — encrypted GitHub installation-token cache envelope. export const REDACTED_COLUMNS = { auth_sessions: ["token_hash"], webhook_events: ["payload_hash"], repository_ai_keys: ["ciphertext"], submission_user_tokens: ["encrypted_token"], - orb_enrollments: ["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt"], + orb_enrollments: ["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt", "cached_token_json"], }; // A table name is only ever interpolated into SQL (`SELECT * FROM ""`) after passing this allowlist, so a diff --git a/test/unit/export-d1-core.test.ts b/test/unit/export-d1-core.test.ts index 11892e9fd7..987ff8c1c9 100644 --- a/test/unit/export-d1-core.test.ts +++ b/test/unit/export-d1-core.test.ts @@ -38,7 +38,7 @@ describe("export-d1-core redaction (#selfhost-migration)", () => { webhook_events: ["payload_hash"], repository_ai_keys: ["ciphertext"], submission_user_tokens: ["encrypted_token"], - orb_enrollments: ["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt"], + orb_enrollments: ["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt", "cached_token_json"], }); expect(redactRow("webhook_events", { delivery_id: "d1", payload_hash: "h" })).toEqual({ delivery_id: "d1" }); expect(redactRow("repository_ai_keys", { repo_full_name: "o/r", ciphertext: "ENCRYPTED" })).toEqual({ repo_full_name: "o/r" }); @@ -59,9 +59,10 @@ describe("export-d1-core redaction (#selfhost-migration)", () => { relay_secret_enc: "LEAK_RELAY_SECRET", relay_secret_iv: "LEAK_RELAY_IV", relay_secret_salt: "LEAK_RELAY_SALT", + cached_token_json: "LEAK_CACHED_ORB_TOKEN_ENVELOPE", }, ]); - expect(orbExport?.redactedColumns).toEqual(["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt"]); + expect(orbExport?.redactedColumns).toEqual(["secret_hash", "relay_secret_enc", "relay_secret_iv", "relay_secret_salt", "cached_token_json"]); expect(orbExport?.rows).toEqual([{ enroll_id: "e1", installation_id: 42 }]); expect(JSON.stringify([draftExport, orbExport])).not.toMatch(/LEAK_/);