mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-11 13:52:20 +00:00
Marc-André Bombeck
afcb37e76c
Two requests left the server without anything being connected: the HaveIBeenPwned range query on every password set (registration, change, admin reset) and the daily GitHub releases request behind the About page and the admin version tile. Neither could be turned off, which made "nothing leaves" untrue for an instance that wanted it to be. PASSWORD_BREACH_CHECK_DISABLED and UPDATE_CHECK_DISABLED (1, true, yes or on) stop each request. Both stay on by default. The breach check keeps its fail-open contract: switched off, a password is simply not looked up. The update route answers status "unknown" with reason "disabled" and the admin tile says the check is off. The password routes reach the check only through the switch, and a test holds that import line. Both are on the compose whitelist, in the env manifest under a new "Outbound requests" group with IP_GEO_LOOKUP_DISABLED, and documented in both env examples and the getting-started guide.
30 lines
1.3 KiB
TypeScript
30 lines
1.3 KiB
TypeScript
/**
|
|
* The operator switch in front of the HaveIBeenPwned password check.
|
|
*
|
|
* `checkPasswordBreach()` (src/lib/auth/hibp.ts) sends the first five hex
|
|
* characters of the password's SHA-1 to api.pwnedpasswords.com whenever a
|
|
* password is set: registration, a password change, and an admin reset. The
|
|
* range API is k-anonymous, so neither the password nor its full hash leaves
|
|
* the server, but the request itself does, and an instance that promises no
|
|
* third-party calls needs a way to stop it. `PASSWORD_BREACH_CHECK_DISABLED`
|
|
* (1, true, yes or on) turns the check off; the result is then "unknown",
|
|
* which every caller already treats as fail-open.
|
|
*
|
|
* Callers import this module, never `@/lib/auth/hibp` directly;
|
|
* `src/__tests__/password-breach-check-switch.test.ts` holds that line.
|
|
*/
|
|
import { checkPasswordBreach, type BreachCheckResult } from "@/lib/auth/hibp";
|
|
import { envFlag } from "@/lib/env";
|
|
|
|
export function passwordBreachCheckEnabled(): boolean {
|
|
return !envFlag("PASSWORD_BREACH_CHECK_DISABLED");
|
|
}
|
|
|
|
/** The breach status of `password`, or `null` when disabled or unknown. */
|
|
export async function checkPasswordBreachIfEnabled(
|
|
password: string,
|
|
): Promise<BreachCheckResult | null> {
|
|
if (!passwordBreachCheckEnabled()) return null;
|
|
return checkPasswordBreach(password);
|
|
}
|