PULP-2257: Add EnvVarHeaderContentGuard for env-backed header validation - #1420
Open
decko wants to merge 2 commits into
Open
PULP-2257: Add EnvVarHeaderContentGuard for env-backed header validation#1420decko wants to merge 2 commits into
decko wants to merge 2 commits into
Conversation
Introduce a content guard that compares a request header to a secret read from os.environ at request time, enabling rotation via deployment config without updating guard records in the database. Assisted-by: Cursor
Contributor
Reviewer's GuideAdds an envvar_header content guard whose secret is resolved from the pod environment for every request, exposes it through a dedicated CRUD/RBAC endpoint, and validates behavior with unit, live API, and access-policy tests. Sequence diagram for environment-backed header validationsequenceDiagram
participant Client
participant ContentGuard as EnvVarHeaderContentGuard
participant Environment as os.environ
Client->>ContentGuard: permit(request)
ContentGuard->>ContentGuard: request.headers.get(header_name)
ContentGuard->>Environment: get(env_var)
Environment-->>ContentGuard: expected secret
ContentGuard->>ContentGuard: hmac.compare_digest(header_content, expected.strip())
alt header matches
ContentGuard-->>Client: allow request
else header missing, secret unavailable, or mismatch
ContentGuard-->>Client: PermissionError Access denied
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. If the header comparison is wrong, a protected distribution could expose its content to callers who do not possess the intended secret, or deny legitimate callers. Reverting restores the prior guard implementation but cannot retract any content that was already exposed.
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
8 tasks
Decode the request header from Base64 to UTF-8 before comparing against the plaintext environment variable. Compare UTF-8 bytes with hmac.compare_digest so non-ASCII secrets work. Update tests and API help text accordingly. Assisted-by: Cursor
Member
Author
|
Updated implementation to Base64-decode the request header before comparing to the plaintext env var (UTF-8 byte compare via
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EnvVarHeaderContentGuard(envvar_headertype) that compares a configurable request header to a secret read fromos.environ[env_var]at request time usinghmac.compare_digest./pulp/api/v3/contentguards/service/envvar_header/with RBAC matching the existingFeatureContentGuardpattern.Secrets can be rotated by updating the deployment environment and redeploying pods — no need to update guard records in the database.
Test plan
pulp_service/tests/unit/test_envvar_header_content_guard.py(7 passed)pulp_service/tests/functional/test_envvar_header_content_guard.py(4 passed, requiresENVVAR_HEADER_GUARD_TEST_SECRETin container env)test_envvar_header_content_guard_access_policy_existsFollow-up
Made with Cursor
Summary by Sourcery
Add an environment-backed header content guard for securely validating guarded content requests.
New Features:
Documentation:
Tests: