Kita/kita-planer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deploy): preserve credential blocking through hosting parser

Browse Source
This commit is contained in:
t.indorf
2026-10-09 23:55:16 +02:00
parent add96fb40b
commit b915857951
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/verify-runtime-isolation.mjs
+2 -2
View File
@@ -6,10 +6,10 @@ try {
const index = line.indexOf('='); return [line.slice(0, index), line.slice(index + 1)];
}));
for (const key of ['POSTGRES_PASSWORD', 'PGADMIN_DEFAULT_PASSWORD', 'APP_DATABASE_PASSWORD', 'MIGRATION_DATABASE_URL']) {
if (process.env[key] || main[key]) throw new Error('Administrative credential reached the app.');
if ((process.env[key] && process.env[key] !== 'unavailable-in-app') || main[key]) throw new Error('Administrative credential reached the app.');
}
// Configured global/legacy URLs must not expose an administrative login either.
if (process.env.DATABASE_URL) throw new Error('Hosting injected a legacy database URL.');
if (process.env.DATABASE_URL && process.env.DATABASE_URL !== 'unavailable-in-app') throw new Error('Hosting injected a legacy database URL.');
if (new URL(main.DATABASE_URL).username !== 'kita_runtime') throw new Error('Wrong application database role.');
prisma = new PrismaClient({ datasourceUrl: main.DATABASE_URL });
const [row] = await prisma.$queryRawUnsafe('SELECT current_user');