Arcadia/arcadia-cloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: Arcadia:7c7370860a34124323971950780157e8981db5af
Branches Tags
Arcadia:main Arcadia:purge/guardian-dev-literal Arcadia:fix/audit-security-blockers
..
compare: Arcadia:main
Branches Tags
Arcadia:main Arcadia:purge/guardian-dev-literal Arcadia:fix/audit-security-blockers

4 Commits
7c7370860a ... main

Author SHA1 Message Date
jules
0e9332f055 Merge pull request 'chore(security): purge burned Guardian literal from dev/test config (Phase 4)' (#2) from purge/guardian-dev-literal into main 2026-06-21 01:44:52 +00:00
Giuliano Silvestro
25c6cb705d chore(security): purge burned Guardian literal from dev/test config (Phase 4) 
Replace the compromised committed Guardian secret with an obviously-fake
dev-only value. Prod reads GUARDIAN_SECRET_KEY from env and raises (Phase 1,
already merged); this removes the dead literal from the repo entirely.
Ref: arcadia-core/docs/GUARDIAN_SECRET_ROTATION.md Phase 4.
 2026-06-21 11:29:12 +10:00
jules
fad93b04d6 Merge pull request 'fix(security): wire Guardian secret_key (raise in prod)' (#1) from fix/audit-security-blockers into main 2026-06-21 01:15:21 +00:00
Giuliano Silvestro
20ce45717a fix(security): wire Guardian secret_key (raise in prod) 
ArcadiaCloud.Guardian had no secret_key for prod at all — every authed route
would fail at deploy. Wire it from GUARDIAN_SECRET_KEY, raising when absent in
prod; keep the pinned dev/staging default.

Ecosystem audit 2026-06-20, rank 2 blocker.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-20 16:22:17 +10:00
2 changed files with 13 additions and 1 deletions
Expand all files Collapse all files

2
config/dev.exs
View File

@@ -25,7 +25,7 @@ config :arcadia_cloud, ArcadiaCloudWeb.Endpoint,
# Guardian — must match arcadia-core's Arcadia.Guardian dev secret_key
# (shared verbatim with arcadia-social and arcadia-voice).
config :arcadia_cloud, ArcadiaCloud.Guardian,
secret_key: "DuMkIRN3Qcxk8VqOu8nHj5i7a7a7YgBHF4oXqKwDI4A="
secret_key: "dev-only-guardian-secret-not-for-production-aaaaaaaaaaaaaaaa="
# skyai-finance push — service-to-service identity for cloud invoice push.
# tenant_id="platform-admin" lands invoices in the platform's own books;

12
config/runtime.exs
View File

@@ -23,6 +23,18 @@ end
config :arcadia_cloud, ArcadiaCloudWeb.Endpoint,
http: [port: String.to_integer(System.get_env("PORT", "4005"))]
# Guardian shared secret — arcadia-cloud only *verifies* arcadia-core-issued
# JWTs, so this MUST match arcadia-core's Arcadia.Guardian secret or every
# authed route 401s. Without it Guardian cannot verify at all. Prod supplies
# GUARDIAN_SECRET_KEY (raise if missing); dev/test use the pinned shared secret.
config :arcadia_cloud, ArcadiaCloud.Guardian,
secret_key:
System.get_env("GUARDIAN_SECRET_KEY") ||
if(config_env() == :prod,
do: raise("environment variable GUARDIAN_SECRET_KEY is missing"),
else: "dev-only-guardian-secret-not-for-production-aaaaaaaaaaaaaaaa="
)
if config_env() == :prod do
database_url =
System.get_env("DATABASE_URL") ||