josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Protect private bank configuration from drift reconciliation (Refs #152)

Browse Source
This commit is contained in:
josh
2026-10-12 23:32:20 -04:00
parent 4e3df81786
commit d9fa15cdf6
23 changed files with 597 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/api/agent/blobs/[sha256]/+server.ts
+2
View File
@@ -1,3 +1,4 @@
import { isPrivateFileBlob } from '$lib/server/db/file-blobs.js';
import { error } from '@sveltejs/kit';
import { authenticateAgent } from '$lib/server/hosts/http.js';
import { db } from '$lib/server/db/index.js';
@@ -5,6 +6,7 @@ import { db } from '$lib/server/db/index.js';
export function GET({ request, params }: { request: Request; params: { sha256: string } }) {
const host = authenticateAgent(request);
if (!/^[a-f0-9]{64}$/.test(params.sha256)) error(404, 'File not found.');
if (isPrivateFileBlob(params.sha256)) error(404, 'File not found.');
const row = db()
.prepare(
`SELECT b.content,b.size FROM file_blobs b WHERE b.sha256=? AND EXISTS (
src/routes/api/campaigns/[id]/file/[fileId]/+server.ts
+2 -1
View File
@@ -1,3 +1,4 @@
import { isPrivateConfigEvidencePath } from '$lib/server/fleet/private-config.js';
import { blobContent } from '$lib/server/db/file-blobs.js';
import { json, error } from '@sveltejs/kit';
import { db } from '$lib/server/db/index.js';
@@ -35,7 +36,7 @@ export async function GET({ params }: { params: { id: string; fileId: string } }
snapshot_pending: number;
}
| undefined;
if (!row) throw error(404, 'file not found');
if (!row || isPrivateConfigEvidencePath(row.rel_path)) throw error(404, 'file not found');
if (row.snapshot_pending)
return json(
{
src/routes/api/deployments/[id]/file/[fileId]/+server.ts
+2 -1
View File
@@ -1,3 +1,4 @@
import { isPrivateConfigEvidencePath } from '$lib/server/fleet/private-config.js';
import { blobContent } from '$lib/server/db/file-blobs.js';
import { json, error } from '@sveltejs/kit';
import { db } from '$lib/server/db/index.js';
@@ -22,7 +23,7 @@ export async function GET({ params }: { params: { id: string; fileId: string } }
content_after: Buffer | null;
}
| undefined;
if (!row) throw error(404, 'file not found');
if (!row || isPrivateConfigEvidencePath(row.rel_path)) throw error(404, 'file not found');
return json({
verb: row.verb,