SECURITY - TASKER: add staging env guard

2026-05-12 13:03:31 +03:00
parent 854a596149
commit 6737138ab7
3 changed files with 236 additions and 0 deletions
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${1:-"$ROOT_DIR/plane-app/plane.env.staging"}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Missing Tasker staging env file: $ENV_FILE" >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+failures=0
+
+fail() {
+  echo "FAIL: $*" >&2
+  failures=$((failures + 1))
+}
+
+require_value() {
+  local name="$1"
+  local value="${!name:-}"
+
+  if [[ -z "$value" ]]; then
+    fail "$name is required"
+  fi
+}
+
+require_secret() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" =~ change-me|local-dev|replace-with|example|plane|secret-key|access-key ]]; then
+    fail "$name uses a placeholder/dev value"
+  fi
+
+  if [[ ${#value} -lt 32 ]]; then
+    fail "$name must be at least 32 characters"
+  fi
+}
+
+require_https_url() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" != https://* ]]; then
+    fail "$name must use https://"
+  fi
+}
+
+require_staging_domain() {
+  local name="$1"
+  local value="${!name:-}"
+
+  require_value "$name"
+
+  if [[ "$value" == *.local.nodedc || "$value" == "localhost" || "$value" == 127.* ]]; then
+    fail "$name must not use local/dev domain"
+  fi
+}
+
+require_staging_domain APP_DOMAIN
+require_https_url WEB_URL
+require_https_url PLANE_OIDC_ISSUER
+require_https_url PLANE_OIDC_REDIRECT_URI
+require_https_url PLANE_NODEDC_ACCESS_CHECK_URL
+require_https_url PLANE_NODEDC_ACCESS_DENIED_REDIRECT_URL
+require_https_url PLANE_NODEDC_GLOBAL_LOGOUT_URL
+require_https_url PLANE_NODEDC_LAUNCHER_PUBLIC_URL
+require_https_url PLANE_NODEDC_HANDOFF_URL
+require_https_url PLANE_NODEDC_WORKSPACE_POLICY_URL
+
+require_value CORS_ALLOWED_ORIGINS
+IFS=',' read -ra cors_origins <<< "$CORS_ALLOWED_ORIGINS"
+for origin in "${cors_origins[@]}"; do
+  origin="${origin//[[:space:]]/}"
+  if [[ "$origin" != https://* ]]; then
+    fail "CORS_ALLOWED_ORIGINS contains non-HTTPS origin: $origin"
+  fi
+done
+
+require_secret POSTGRES_PASSWORD
+require_secret RABBITMQ_PASSWORD
+require_secret SECRET_KEY
+require_secret AWS_ACCESS_KEY_ID
+require_secret AWS_SECRET_ACCESS_KEY
+require_secret LIVE_SERVER_SECRET_KEY
+require_secret PLANE_OIDC_CLIENT_SECRET
+require_secret PLANE_NODEDC_ACCESS_TOKEN
+
+if [[ "${COOKIE_DOMAIN:-}" == *.local.nodedc || "${COOKIE_DOMAIN:-}" == "localhost" ]]; then
+  fail "COOKIE_DOMAIN must not use local/dev domain"
+fi
+
+if [[ "${ENABLE_SIGNUP:-}" != "0" ]]; then
+  fail "ENABLE_SIGNUP must be 0"
+fi
+
+if [[ "${ENABLE_EMAIL_PASSWORD:-}" != "0" ]]; then
+  fail "ENABLE_EMAIL_PASSWORD must be 0 for staging OIDC-only access"
+fi
+
+if [[ "${ENABLE_MAGIC_LINK_LOGIN:-}" != "0" ]]; then
+  fail "ENABLE_MAGIC_LINK_LOGIN must be 0"
+fi
+
+if [[ "${PLANE_NODEDC_ACCESS_ENFORCEMENT:-}" != "1" ]]; then
+  fail "PLANE_NODEDC_ACCESS_ENFORCEMENT must be 1"
+fi
+
+if [[ "${PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED:-}" != "1" ]]; then
+  fail "PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED must be 1"
+fi
+
+if [[ "${TRUSTED_PROXIES:-}" =~ change-me|local-dev|replace-with|example ]]; then
+  fail "TRUSTED_PROXIES uses a placeholder/dev value"
+fi
+
+case "${TRUSTED_PROXIES:-}" in
+  *"0.0.0.0/0"*|*"::/0"*|*"10.0.0.0/8"*|*"172.16.0.0/12"*|*"192.168.0.0/16"*|*"127.0.0.0/8"*)
+    fail "TRUSTED_PROXIES must be limited to the actual platform edge proxy or ingress subnet"
+    ;;
+esac
+
+if [[ $failures -gt 0 ]]; then
+  echo "Tasker staging env check failed with $failures issue(s)." >&2
+  exit 1
+fi
+
+echo "Tasker staging env check passed: $ENV_FILE"