24 lines
1.4 KiB
JavaScript
24 lines
1.4 KiB
JavaScript
import { readFileSync } from 'node:fs';
|
|
import { PrismaClient } from '@prisma/client';
|
|
let prisma;
|
|
try {
|
|
const main = Object.fromEntries(readFileSync('/proc/1/environ', 'utf8').split('\0').filter(Boolean).map(line => {
|
|
const index = line.indexOf('='); return [line.slice(0, index), line.slice(index + 1)];
|
|
}));
|
|
for (const key of ['POSTGRES_PASSWORD', 'PGADMIN_DEFAULT_PASSWORD', 'APP_DATABASE_PASSWORD', 'MIGRATION_DATABASE_URL']) {
|
|
if ((process.env[key] && process.env[key] !== 'unavailable-in-app') || main[key]) throw new Error('Administrative credential reached the app.');
|
|
}
|
|
// Configured global/legacy URLs must not expose an administrative login either.
|
|
if (process.env.DATABASE_URL && process.env.DATABASE_URL !== 'unavailable-in-app') throw new Error('Hosting injected a legacy database URL.');
|
|
if (new URL(main.DATABASE_URL).username !== 'kita_runtime') throw new Error('Wrong application database role.');
|
|
prisma = new PrismaClient({ datasourceUrl: main.DATABASE_URL });
|
|
const [row] = await prisma.$queryRawUnsafe('SELECT current_user');
|
|
if (row.current_user !== 'kita_runtime') throw new Error('Wrong effective database role.');
|
|
console.log('Runtime isolation verified: no administrative credentials in container/app environment; current_user=kita_runtime.');
|
|
} catch {
|
|
console.error('Runtime isolation verification failed. Credential values were not logged.');
|
|
process.exitCode = 1;
|
|
} finally {
|
|
await prisma?.$disconnect();
|
|
}
|