archetech / archon / 31274676707

95%

push

github

fix(gatekeeper): require an admin API key and fail closed without one (#868)

* fix(gatekeeper): require an admin API key and fail closed without one

Gatekeeper's admin middleware fell open when ARCHON_ADMIN_API_KEY was
unset, leaving db/reset, dids/remove, batch import/export, and queue
management unauthenticated — and compose publishes Gatekeeper on all
interfaces. This is H-01 of the August audit.

Fail-closed middleware alone would be a silent regression: the satoshi,
filecoin, and solana mediators authenticate against these same admin
routes and send the key conditionally (`if (config.adminApiKey)`), so an
unset key would stop DID anchoring and registry sync with nothing but
403s in mediator logs. Refusing to boot surfaces that at deploy time
instead.

- main() exits non-zero when ARCHON_ADMIN_API_KEY is unset, naming the
  variable and the openssl command that generates one. Short keys warn
  rather than fail, so an upgrade doesn't brick a running deployment.
- createRequireAdminKey now returns 403 when no key is configured and
  compares with timingSafeEqual, matching Drawbridge's v1-admin.ts.
- Same two changes in the Rust port, which had the identical fail-open
  block and a `==` comparison. Constant-time compare is written inline
  rather than pulling in a new crate.
- The CI test env generator had no admin key, so gatekeeper would have
  refused to start in build_test_images; added one.

Keymaster (TS and Python) has the same fail-open pattern and is left for
a follow-up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(python-sdk): authenticate with X-Archon-Admin-Key, not just Bearer

Adding ARCHON_ADMIN_API_KEY to the generated CI env (needed for Gatekeeper
to boot) turned on Keymaster's admin gate, and 26 SDK tests started
401ing. The cause is a pre-existing bug the fail-open middleware was
hiding: the Python SDK sends only `Authorization: Bearer <key>`, and the
TS Keymaster reads only `x-archon-admin-key` — there is no Au... (continued)

3616 of 4070 branches covered (88.85%)

Branch coverage included in aggregate %.

13 of 13 new or added lines in 1 file covered. (100.0%)

8245 of 8527 relevant lines covered (96.69%)

685.96 hits per line