From 8602c54c1f2f767884b96d9091d9cd310330b0ef Mon Sep 17 00:00:00 2001 From: jmoore-skild Date: Wed, 5 Aug 2026 16:09:50 -0400 Subject: [PATCH] docs(backup): say what the secret-key hints actually refuse (#2656) The comment called the hint list belt-and-braces over keys the collector already refuses to write. It is not: _collect_settings filters exactly bambu_cloud_token and auth_secret_key, so a current backup really does carry mqtt_password, ldap_bind_password, ha_token and prometheus_token, and the hints are the only thing that refuses them. The companion- credential rule sits downstream of that, so reading the list as redundant and shortening it would write a stale credential and make that rule inert at the same time. Comment and test docstring only - no behaviour change. --- backend/app/services/github_restore.py | 9 +++++++-- backend/tests/unit/test_github_restore.py | 5 +++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/backend/app/services/github_restore.py b/backend/app/services/github_restore.py index 881714b17..74ddcbce0 100644 --- a/backend/app/services/github_restore.py +++ b/backend/app/services/github_restore.py @@ -72,8 +72,13 @@ _KPROFILE_PATH_RE = re.compile(r"^kprofiles/([^/]+)/([^/]+)\.json$") # contain them, and a restore must not resurrect a stale credential. _SENSITIVE_SETTING_KEYS = {"bambu_cloud_token", "auth_secret_key"} -# Belt-and-braces for the same reason: any key that looks like a secret is -# skipped even if it isn't in the explicit denylist above. +# The primary refusal, not a backstop for the set above. The collector filters +# exactly bambu_cloud_token and auth_secret_key, so every other credential — +# mqtt_password, ldap_bind_password, ha_token, prometheus_token — is present in +# a current backup and is skipped only because its key matches a hint here. +# _COMPANION_CREDENTIALS sits downstream of that: it withholds a toggle when the +# credential it needs was refused, so shortening this tuple would both write a +# stale credential and quietly make that rule inert. _SECRET_KEY_HINTS = ("token", "secret", "password", "access_code", "api_key", "passphrase") # Settings the MQTT relay reads only when it is (re)configured, so restoring the diff --git a/backend/tests/unit/test_github_restore.py b/backend/tests/unit/test_github_restore.py index 1cb96ee39..d2099a039 100644 --- a/backend/tests/unit/test_github_restore.py +++ b/backend/tests/unit/test_github_restore.py @@ -125,8 +125,9 @@ class TestSettingKeyBlocklist: Carving it out would also be a live hole rather than a tidy-up: an attacker-authored ``settings/app_settings.json`` could then get a ``*token*``-named row written simply by choosing that name. This - blocklist's whole job is belt-and-braces, so a name-shaped exception to - it is exactly the wrong shape of fix. + The hints are the primary refusal for every credential the collector + does not filter, so a name-shaped exception to them is exactly the wrong + shape of fix. """ assert _is_blocked_setting_key("ha_token_from_env") is True