larvit/plainpages
3
0
Fork 0
Code Issues 1 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

Record the comprehension check: overall 6.50 then 6.38, under the 7.0 floor; the README's REQUIRE_SECURE_SECRETS drift is filed as item 56
CI / full-gate (push) Successful in 3m24s
Details
Mirror / github-mirror (push) Successful in 4s
Details

Browse Source
This commit was merged in pull request #202.
This commit is contained in:
Lilleman auf Larv
2026-10-31 14:09:54 +01:00
parent 8e73d165da
commit c2389f871d
2 changed files with 81 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
todo.md
+13 -1
View File
@@ -6,12 +6,13 @@
`Bar = 1`
`Next ID = 56`
`Next ID = 57`
## Items
| ID | Release | Blocked by | Exempt | Item | L | E | I | R | S | Moves | Score |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 56 | 0.4.22 | | | **Correct the README's two statements that `REQUIRE_SECURE_SECRETS` guards only `CSRF_SECRET`.** | 1 | 2 | 1 | 2 | 1 | code health by 2 | 14.4 |
| 19 | 0.5.0 | | question | **Run the documented Docker commands on macOS and fix whatever misbehaves.** | 2 | 2 | 1 | 3 | 3 | 1 by 3 | 3.3 |
| 16 | 0.5.0 | | question | **Decide whether the single Keto `Resource` namespace splits into per-domain namespaces.** | 3 | 2 | 3 | 6 | 6 | 7 by 2 | 0.5 |
| 48 | 0.5.0 | | | **Correct the Keto tuple in the `login.ts` and `bootstrap.ts` comments to the `granted` relation the code writes.** | 1 | 1 | 1 | 1 | 1 | code health by 4 | 28.7 |
@@ -33,6 +34,17 @@
## Details
### 56. Correct the README's two statements that `REQUIRE_SECURE_SECRETS` guards only `CSRF_SECRET`.
README → What you must supply (about `:1275`: "refuses to boot on a missing or throwaway
`CSRF_SECRET` and **nothing else**") and README → Security model (about `:1442`:
"`REQUIRE_SECURE_SECRETS` guards only `CSRF_SECRET`") contradict the Configuration table row (about
`:1216`), `src/config.ts:59` and `:190`, and `src/plugin-host/settings.ts`. The flag also refuses a
missing or throwaway `PLUGIN_DB_SECRET` once `PLUGIN_DB_URL` is set, and every plugin setting
declared `secret`. An operator following the checklist underrates the toggle. Make both passages say
what the flag enforces by pointing to the table row, its one home. Four comprehension seats raised it
independently. Markdown only.
### 19. Run the documented Docker commands on macOS and fix whatever misbehaves.
Needs a Mac. Two suspects, both from `--user "$(id -u):$(id -g)"`: a macOS `id -g` is `20`, which is