ESD-1635: Validate the environment in WASM setAuthCredentials - #524
Open
Phil-Browne wants to merge 7 commits into
Open
ESD-1635: Validate the environment in WASM setAuthCredentials#524Phil-Browne wants to merge 7 commits into
Phil-Browne wants to merge 7 commits into
Conversation
setAuthCredentials wrote its environment argument straight into MEGAPORT_ENVIRONMENT with no validation, unlike setAuthToken. An unrecognized value (wrong case, typo, trailing whitespace) fell through login_wasm.go's default case to the production API endpoint, silently authenticating credentials against the wrong backend. Normalize and validate the environment the same way setAuthToken does, rejecting anything outside production/staging/development instead of storing it. Also make login_wasm.go's credential path fail closed on an unrecognized environment rather than defaulting to production.
Add a follow-up comment on the pre-existing empty-env-defaults-to- production path in login_wasm.go explaining why it's still safe, use consistent raw-string error literals, update setAuthCredentials' doc comment and TS type declaration to reflect the new validation, and add missing test coverage for the too-few-args branch.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #524 +/- ##
==========================================
- Coverage 79.48% 79.48% -0.01%
==========================================
Files 193 193
Lines 18859 18859
==========================================
- Hits 14991 14990 -1
Misses 2820 2820
- Partials 1048 1049 +1 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens WASM credential authentication by validating and canonicalizing the environment name so typos/case/whitespace can’t silently route API-key logins to production.
Changes:
- Added
restrictEnvironmentNameStrictto bucket only recognized environments and report whether the input matched. - Updated
setAuthCredentialsto normalize + strictly validate the environment before storing it, and to return the normalized bucket on success. - Updated
login_wasm.go’s credential login path to fail closed on unknown environments, plus added/updated WASM tests and TS typings.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| internal/wasm/wasm.go | Adds strict environment bucketing and enforces normalized/validated environments in setAuthCredentials. |
| internal/wasm/wasm_test.go | Adds tests for strict bucketing and setAuthCredentials normalization/rejection behavior. |
| internal/commands/config/login_wasm.go | Makes credential login fail closed on unknown MEGAPORT_ENVIRONMENT instead of defaulting to production. |
| internal/commands/config/login_wasm_test.go | Adds a WASM test ensuring unknown environments are rejected in the credential login path. |
| frontend-integration/types/megaport-wasm.d.ts | Updates TypeScript docs/types to reflect normalization, rejection, and success payload shape for setAuthCredentials. |
penzeliz-megaport
previously approved these changes
Jul 13, 2026
penzeliz-megaport
left a comment
penzeliz-megaport
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed for correctness; no findings. LGTM.
…credentials-env # Conflicts: # internal/commands/config/login_wasm_test.go # internal/wasm/wasm_test.go
Contributor
Author
|
Merge conflict resolved in 7e8a74c |
…credentials-env # Conflicts: # internal/commands/config/login_wasm_test.go
Two fail-open gaps in loginFunc: the bearer-token path silently routed an unrecognized environment to production instead of rejecting it, and the credential path let the page-writable megaportCredentials JS global override an already-validated MEGAPORT_ENVIRONMENT env var. Both now fail closed, matching the env-var-wins precedence already used elsewhere in this function.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
setAuthCredentialswrote its environment argument straight intoMEGAPORT_ENVIRONMENTwith no validation. Downstream,login_wasm.go's credential login path defaulted any unrecognized environment to the production API endpoint, so a typo, wrong case, or stray whitespace would silently authenticate real credentials against production instead of the intended environment.setAuthCredentialsnow normalizes (lowercase, trim) and validates the environment the same waysetAuthTokendoes, rejecting anything outside production/staging/development instead of storing it.login_wasm.go's credential path now fails closed on an unrecognized environment instead of defaulting to production.login_wasm.go's bearer-token login path had the same fail-open default; it now fails closed too instead of silently routing an unrecognized token environment to production.megaportCredentialsJS global override an already-validatedMEGAPORT_ENVIRONMENT, so a script sharing the page origin could redirect valid credentials to a different environment. It now only falls back to the global when the env var is empty, matching the token path's existing precedence.Ref: ESD-1635