archetech / archon / 33933028340

87%

push

github

fix(keymaster): Refuse to start without ARCHON_ADMIN_API_KEY (#1048)

* fix(keymaster): Refuse to start without ARCHON_ADMIN_API_KEY

Gatekeeper exits on a blank key in both its TypeScript and Rust ports.
Keymaster logged a warning and served, and its guard is mounted across
the whole v1 router rather than an admin subset -- so the service holding
the wallet was the one that failed open, leaving identity, credential,
Lightning and vault operations reachable by anyone who could open the
port.

The check runs before the port is bound and exits explicitly, mirroring
gatekeeper's placement: this process installs uncaughtException and
unhandledRejection handlers that log and continue, so a throw raised from
inside the listen callback would leave the server accepting requests.

The middleware now refuses with 403 when no key is configured, for an app
constructed programmatically, and compares keys with timingSafeEqual
after a length check as gatekeeper does. The Python service gets the same
startup check and the same fail-closed guard.

Closes #1018

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GYGMfX3foBcVqP7AQNXjWj

* fix(keymaster): Stop /login disclosing the admin key, and end startup failures

POST /login returned the configured admin API key to any caller when
ARCHON_ENCRYPTED_PASSPHRASE was blank. /login sits ahead of the admin
guard because it is how a client obtains that key, so the disclosure was
unauthenticated. A blank passphrase is now refused at startup and the
handler answers 403 for an app built programmatically.

#1018 read this as unreachable, because the Keymaster constructor
rejects an empty passphrase. It runs inside the listen callback, where
the process-level handlers log the rejection and leave the server bound
and answering. Startup is now all-or-nothing: the callback exits rather
than leaving a server with no keymaster behind it.

Co-Authored-By: Claude Opus 5 <noreply@anthr... (continued)

3922 of 4504 branches covered (87.08%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 2 files covered. (100.0%)

8555 of 8979 relevant lines covered (95.28%)

715.75 hits per line