🛡️ Sentinel: [CRITICAL] Fix hardcoded staff password#42
🛡️ Sentinel: [CRITICAL] Fix hardcoded staff password#42
Conversation
- Removed hardcoded 'SAC_MUSEUM_2026' password from client-side `js/main.js`. - Implemented secure backend verification endpoint `/api/verify-staff` in `backend/main.py`. - Added `StaffLogin` model to `backend/models.py`. - Password comparison now uses `hmac.compare_digest` to prevent timing attacks. - Staff password is now configurable via the `STAFF_PASSWORD` environment variable. - Added comprehensive integration tests in `backend/tests/test_staff.py`. - Verified UI flow with automated Playwright verification. Co-authored-by: LVT-ENG <214667862+LVT-ENG@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request migrates staff password verification from the frontend to a new backend API endpoint /api/verify-staff. The implementation includes a StaffLogin model, secure password comparison using hmac.compare_digest, and a Vite proxy configuration. Feedback identifies a critical security risk regarding the hardcoded default password in the backend and suggests using monkeypatch in tests to avoid hardcoding credentials.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
|
Yes |
There was a problem hiding this comment.
Pull request overview
This PR moves the staff “private pass” verification from a hardcoded frontend string to a backend-validated endpoint, so the password is no longer exposed in client-side JavaScript.
Changes:
- Added a new FastAPI endpoint (
POST /api/verify-staff) to validate staff credentials server-side. - Refactored the frontend staff check to call the backend endpoint via
fetch. - Added a Vite dev proxy for
/apito forward requests to the backend during local development, plus new backend tests for the staff verification endpoint.
Reviewed changes
Copilot reviewed 5 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
vite.config.js |
Adds dev-time /api proxy to the FastAPI server. |
js/main.js |
Replaces hardcoded staff password check with an async call to /api/verify-staff. |
backend/main.py |
Introduces /api/verify-staff and reads STAFF_PASSWORD from env. |
backend/models.py |
Adds StaffLogin request model for the staff verification endpoint. |
backend/tests/test_staff.py |
Adds tests intended to cover staff verification success/failure cases. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…SWORD to .env.example Agent-Logs-Url: https://github.com/Tryonme-com/-TRYONYOU2/sessions/e1359dae-0604-4ed4-97ba-aecb7bb775ae Co-authored-by: LVT-ENG <214667862+LVT-ENG@users.noreply.github.com>
Agent-Logs-Url: https://github.com/Tryonme-com/-TRYONYOU2/sessions/e1359dae-0604-4ed4-97ba-aecb7bb775ae Co-authored-by: LVT-ENG <214667862+LVT-ENG@users.noreply.github.com>
test_staff.py: replaceimport mainwithimport backend.mainso monkeypatch correctly patches the module the endpoint readsraising=Falsefrommonkeypatch.setattrcallstest_staff_password_123) to avoid leaking format hints about the real passwordSTAFF_PASSWORDto.env.example