fix: encrypt stored GitHub credentials (#797)

src/scripts/migrate-credentials.ts

@@ -0,0 +1,41 @@
+import "dotenv/config";
+import mongoose from "mongoose";
+import config from "../config";
+import { credentialCipher } from "../core/credentials";
+import { migrateCredentials, verifyCredentials, enforceCredentialStorage } from "../core/migrate-credentials";
+
+async function main() {
+  const args = new Set(process.argv.slice(2));
+  for (const arg of args) {
+    if (!["--apply", "--remove-legacy", "--prefer-owner-token", "--maintenance", "--verify", "--enforce"].includes(arg)) {
+      throw new Error("Unknown migration option");
+    }
+  }
+  if (args.has("--apply") && !args.has("--maintenance")) throw new Error("Stop all application writers and pass --maintenance before applying");
+  if (args.has("--enforce") && !args.has("--apply")) throw new Error("--enforce requires --apply");
+  if (args.has("--remove-legacy") && !args.has("--apply")) throw new Error("--remove-legacy requires --apply");
+  const cipher = credentialCipher();
+  const uri = config.MONGODB_URI || `mongodb://${config.DB_USERNAME}:${config.DB_PASSWORD}@${config.DB_HOSTNAME}:27017/production`;
+  await mongoose.connect(uri, config.MONGODB_URI ? {} : { authSource: "admin" });
+  const db = mongoose.connection.db;
+  if (args.has("--enforce")) {
+    process.stdout.write(JSON.stringify(await enforceCredentialStorage(db, cipher)) + "\n");
+  } else if (args.has("--verify")) {
+    const result = await verifyCredentials(db, cipher);
+    process.stdout.write(JSON.stringify(result) + "\n");
+    if (result.legacy) process.exitCode = 1;
+  } else {
+    const result = await migrateCredentials(db, cipher, {
+      apply: args.has("--apply"), removeLegacy: args.has("--remove-legacy"),
+      preferOwnerToken: args.has("--prefer-owner-token"),
+      report: event => process.stdout.write(JSON.stringify(event) + "\n"),
+    });
+    process.stdout.write(JSON.stringify(result) + "\n");
+    if (result.issues) process.exitCode = 1;
+  }
+}
+main().catch(() => {
+  // Driver errors can contain document values or connection credentials.
+  process.stderr.write("Credential migration failed; check configuration, connectivity, and encrypted records. No secret values are logged.\n");
+  process.exitCode = 1;
+}).finally(() => mongoose.disconnect());

src/scripts/purge-legacy-sessions.ts

@@ -0,0 +1,38 @@
+import "dotenv/config";
+import { createClient } from "redis";
+import config from "../config";
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.some(arg => arg !== "--apply")) throw new Error("Unknown option");
+  const client = createClient({ socket: { host: config.REDIS_HOSTNAME, port: config.REDIS_PORT, reconnectStrategy: false } });
+  client.on("error", () => {});
+  try {
+    await client.connect();
+    let found = 0;
+    let removed = 0;
+    for await (const key of client.scanIterator({ MATCH: "anoGH_session:*", COUNT: 100 })) {
+      const raw = await client.get(key);
+      if (!raw) continue;
+      let legacy = false;
+      try {
+        const value = JSON.parse(raw);
+        legacy = !!value.passport?.user && typeof value.passport.user !== "string";
+      } catch { legacy = true; }
+      if (!legacy) continue;
+      found++;
+      if (args.includes("--apply")) {
+        // Do not remove a session replaced since the scan read it.
+        removed += Number(await client.eval(
+          'if redis.call("GET", KEYS[1]) == ARGV[1] then return redis.call("DEL", KEYS[1]) else return 0 end',
+          { keys: [key], arguments: [raw] }
+        ));
+      }
+    }
+    process.stdout.write(JSON.stringify({ found, removed }) + "\n");
+  } finally { if (client.isOpen) await client.quit(); }
+}
+main().catch(() => {
+  process.stderr.write("Legacy session cleanup failed; check Redis configuration and connectivity.\n");
+  process.exitCode = 1;
+});