Scott KarpandClaude Fable 5.1
79eb34840f
/courtyard/* and /chatzer/* admitted any `Authorization: Bearer <x>`. Every test sent `Bearer test-token`; none sent a wrong one. Every admitted request spends the day's manna. VavPipeline.BigdeiKodesh.Gate: keys are a file (Construction §4.6 — never env, never config, never git), one `tier key` per line, tiers courtyard < chatzer (the inner ring opens the outer). Constant-time compare against every line; no file / empty / unreadable → nobody passes, GATE_NO_KEYS in the log, the caller told only "missing or invalid". 403 FORBIDDEN for an outer key at an inner gate. Read on every request so a rotated key is live in ~1 min without a rollout. Deploy: Secret shorashim-api-keys projected at /etc/shorashim/secrets/api_keys (vav-pipeline only, 0440), API_KEYS_FILE in the configmap, template + issue/rotate recipe in secrets.yaml and KOHEN.md "Issuing a key". Spec: tamid §1.1 (gate, 403), vayakhel §4.6. Doorpost 91d09d8d… → 42b38626…. Tests: tablet45_gate_test (parse, tiers, wrong/near/empty/no key, no file) — Elixir 527/0. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
29 lines
1.2 KiB
Elixir
29 lines
1.2 KiB
Elixir
import Config
|
|
|
|
config :logger, level: :warning
|
|
|
|
# Test uses L1 relative to project root
|
|
config :vav_pipeline,
|
|
l1_mount_point: "../l1",
|
|
manna_provision_file: "test/fixtures/manna/today.json",
|
|
api_keys_file: "test/fixtures/api_keys",
|
|
cycle_boundary_check_interval_ms: :timer.hours(24),
|
|
http_port: 0
|
|
|
|
# L3 test database — separate from dev, uses sandbox pool
|
|
# Repo start disabled by default — L3 tests need PostgreSQL running locally
|
|
# Enable: SHORASHIM_L3=1 mix test --include l3
|
|
#
|
|
# Credentials come from the environment (tablet 44: without a password
|
|
# the SCRAM handshake raised KeyError in every connection, the pool hit
|
|
# its restart intensity, and the whole application went down silently
|
|
# ~30 ms after test_helper — no L3 test ever ran).
|
|
config :vav_pipeline, VavPipeline.Repo,
|
|
database: "shorashim_test#{System.get_env("MIX_TEST_PARTITION")}",
|
|
hostname: System.get_env("SHORASHIM_L3_HOST") || "localhost",
|
|
username: System.get_env("SHORASHIM_L3_USER") || "postgres",
|
|
password: System.get_env("SHORASHIM_L3_PASSWORD") || "postgres",
|
|
pool: Ecto.Adapters.SQL.Sandbox,
|
|
pool_size: System.schedulers_online() * 2,
|
|
start: System.get_env("SHORASHIM_L3") != nil
|