fix: CSP Clerk-origin drift + Production Smoke failure paging (linejam-912, linejam-913) #300
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,21 +1,34 @@ | ||
| import type { NextConfig } from 'next'; | ||
| import { validateEnv } from './lib/env'; | ||
| import { deriveClerkFrontendOrigin } from './scripts/lib/clerk-domain.mjs'; | ||
|
|
||
| // Validate required env vars during production builds | ||
| // This prevents deploying with missing configuration | ||
| if (process.env.NODE_ENV === 'production') { | ||
| validateEnv(); | ||
| } | ||
|
|
||
| // Clerk's Frontend API is served from *.clerk.accounts.dev for dev/preview | ||
| // keys, but a live key can point at a custom domain instead (production: | ||
| // clerk.linejam.app). A custom domain is invisible to any generic wildcard, | ||
| // so it must be derived from NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY at config | ||
| // time rather than hand-listed — the 2026-07-04 outage was exactly this | ||
| // list going stale: PR #291 hand-listed domains, missed the production | ||
| // custom domain, and CSP blocked auth site-wide for ~16h because preview | ||
| // smoke only ever exercised the (allowed) dev domain. | ||
| const GENERIC_CLERK_SOURCES = [ | ||
| 'https://*.clerk.accounts.dev', | ||
| 'https://*.clerk.com', | ||
| 'https://api.clerk.com', | ||
| ]; | ||
|
|
||
| function resolveClerkSources(): string[] { | ||
| const derivedOrigin = deriveClerkFrontendOrigin( | ||
| process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY | ||
| ); | ||
| return compactSources([...GENERIC_CLERK_SOURCES, derivedOrigin]); | ||
| } | ||
|
|
||
| const LOCAL_CONNECT_SOURCES = [ | ||
| 'http://localhost:*', | ||
| 'https://localhost:*', | ||
|
|
@@ -58,13 +71,14 @@ export function buildContentSecurityPolicy() { | |
| originFrom(process.env.CANARY_ENDPOINT) || | ||
| 'https://canary-obs.fly.dev'; | ||
| const posthogOrigin = originFrom(process.env.NEXT_PUBLIC_POSTHOG_HOST); | ||
| const clerkSources = resolveClerkSources(); | ||
|
|
||
| const directives: Array<[string, string[]]> = [ | ||
| ['default-src', ["'self'"]], | ||
| ['base-uri', ["'self'"]], | ||
| ['object-src', ["'none'"]], | ||
| ['frame-ancestors', ["'none'"]], | ||
| ['form-action', ["'self'", ...clerkSources]], | ||
| [ | ||
| 'script-src', | ||
| compactSources([ | ||
|
|
@@ -73,7 +87,7 @@ export function buildContentSecurityPolicy() { | |
| // inline scripts today. Nonces are the follow-up once app wiring exists. | ||
| "'unsafe-inline'", | ||
| isDevelopment ? "'unsafe-eval'" : null, | ||
| ...clerkSources, | ||
| 'https://challenges.cloudflare.com', | ||
| 'https://us-assets.i.posthog.com', | ||
| 'https://va.vercel-scripts.com', | ||
|
|
@@ -85,7 +99,7 @@ export function buildContentSecurityPolicy() { | |
| "'self'", | ||
| "'unsafe-inline'", | ||
| 'https://fonts.googleapis.com', | ||
| ...clerkSources, | ||
| ]), | ||
| ], | ||
| [ | ||
|
|
@@ -96,7 +110,7 @@ export function buildContentSecurityPolicy() { | |
| 'blob:', | ||
| 'https://img.clerk.com', | ||
| 'https://images.clerk.dev', | ||
| ...clerkSources, | ||
| ]), | ||
| ], | ||
| [ | ||
|
|
@@ -111,7 +125,7 @@ export function buildContentSecurityPolicy() { | |
| convexWsOrigin, | ||
| 'https://*.convex.cloud', | ||
| 'wss://*.convex.cloud', | ||
| ...clerkSources, | ||
| 'https://challenges.cloudflare.com', | ||
| 'https://us.i.posthog.com', | ||
| 'https://us-assets.i.posthog.com', | ||
|
|
@@ -127,7 +141,7 @@ export function buildContentSecurityPolicy() { | |
| 'frame-src', | ||
| compactSources([ | ||
| "'self'", | ||
| ...clerkSources, | ||
| 'https://challenges.cloudflare.com', | ||
| ]), | ||
| ], | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ | |
|
|
||
| import { spawnSync } from 'node:child_process'; | ||
| import { fileURLToPath } from 'node:url'; | ||
| import { deriveClerkFrontendOrigin } from '../lib/clerk-domain.mjs'; | ||
|
|
||
| /** | ||
| * @typedef {Record<string, string | undefined>} EnvShape | ||
|
|
@@ -19,28 +20,7 @@ export function deriveClerkIssuerDomain(env = process.env) { | |
| env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY?.trim() || | ||
| env.CLERK_PUBLISHABLE_KEY?.trim() || | ||
| ''; | ||
| return deriveClerkFrontendOrigin(publishableKey); | ||
| } | ||
|
|
||
| function normalizeIssuer(value) { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| /** | ||
| * Derive the Clerk Frontend API origin encoded in a publishable key. | ||
| * | ||
| * Clerk publishable keys are `pk_(test|live)_<base64url(frontendApiHost + "$")>`. | ||
| * Decoding the trailing segment recovers the exact host Clerk serves clerk-js | ||
| * and its Frontend API from. For a custom domain (e.g. `clerk.linejam.app`) | ||
| * this is the only source of truth for that host — nothing else in env | ||
| * encodes it. | ||
| * | ||
| * This is the canonical implementation. `next.config.ts` (CSP allowlist) and | ||
| * `scripts/ci/bootstrap-convex-env.mjs` (Convex JWT issuer domain) both | ||
| * derive from it, so a Clerk domain change can never silently diverge | ||
| * between the two again (2026-07-04 outage: CSP hand-listed domains and | ||
| * missed the production custom domain, blocking auth site-wide for ~16h | ||
| * while preview smoke stayed green on the dev Clerk domain). | ||
| * | ||
| * @param {string | undefined | null} publishableKey | ||
| * @returns {string} the origin (e.g. "https://clerk.linejam.app"), or '' if | ||
| * it cannot be derived (missing/malformed key). | ||
| */ | ||
| export function deriveClerkFrontendOrigin(publishableKey) { | ||
| const key = publishableKey?.trim() ?? ''; | ||
| if (!key) return ''; | ||
|
|
||
| const encodedDomain = key.split('_').at(-1); | ||
| if (!encodedDomain) return ''; | ||
|
Comment on lines
+33
to
+34
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
node -e '
const hosts = ["clerk.linejam.app","auth.example-tenant.com","great-moose-1.clerk.accounts.dev"];
// brute-force a few synthetic hosts to prove _ is reachable in base64url output
for (let i=0;i<5000;i++){ hosts.push("clerk-"+i+".linejam.app"); }
let hit=null;
for (const h of hosts){
const enc = Buffer.from(h+"$").toString("base64url");
if (enc.includes("_")){ hit={h,enc}; break; }
}
console.log("example host whose key segment contains _ :", hit);
if (hit){
const key = "pk_live_"+hit.enc;
const tail = key.split("_").at(-1);
console.log("split-based decode:", Buffer.from(tail,"base64url").toString("utf8"));
console.log("prefix-strip decode:", Buffer.from(hit.enc,"base64url").toString("utf8"));
}
'Repository: misty-step/linejam Length of output: 205 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== scripts/lib/clerk-domain.mjs ==\n'
sed -n '1,220p' scripts/lib/clerk-domain.mjs
printf '\n== related references ==\n'
rg -n "deriveClerkFrontendOrigin|clerk-domain|frontendApiHost|Convex JWT issuer|bootstrap-convex-env|next.config" scripts . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || true
printf '\n== tests around clerk domain ==\n'
rg -n "clerk.*domain|frontendApiHost|base64url|pk_(test|live)_" scripts test tests . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || trueRepository: misty-step/linejam Length of output: 14127 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== file inventory ==\n'
git ls-files | rg '^scripts/lib/clerk-domain\.mjs$|^scripts/.*(bootstrap-convex-env|next\.config|clerk).*|(^|/)(test|tests)/.*clerk|.*clerk.*test.*'
printf '\n== source around the target ==\n'
nl -ba scripts/lib/clerk-domain.mjs | sed -n '1,120p'Repository: misty-step/linejam Length of output: 473 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the target file and nearby callers/tests without executing repository code.
printf '\n== scripts/lib/clerk-domain.mjs ==\n'
nl -ba scripts/lib/clerk-domain.mjs | sed -n '1,200p'
printf '\n== references to the helper and related derivation ==\n'
rg -n "deriveClerkFrontendOrigin|clerk-domain|frontendApiHost|base64url|pk_(test|live)_" scripts . \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || true
printf '\n== test files referencing clerk domain ==\n'
rg -n "clerk.*domain|frontendApiHost|base64url|pk_(test|live)_" tests test scripts \
-g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || trueRepository: misty-step/linejam Length of output: 232 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
import base64
import itertools
import string
alphabet = string.ascii_lowercase + string.digits + "-."
# Search short, syntactically plausible host labels first.
def enc(s: str) -> str:
return base64.urlsafe_b64encode(s.encode()).decode().rstrip("=")
for n in range(1, 7):
for s in itertools.product(alphabet, repeat=n):
host = "".join(s)
e = enc(host)
if "_" in e:
print("found_host=", host)
print("encoded=", e)
key = "pk_live_" + e
tail = key.split("_")[-1]
print("split_tail=", tail)
print("split_decoded=", base64.urlsafe_b64decode(tail + "==").decode("utf-8", "replace"))
print("full_decoded=", base64.urlsafe_b64decode(e + "==").decode("utf-8", "replace"))
raise SystemExit(0)
print("no host found in search space")
PYRepository: misty-step/linejam Length of output: 148
🤖 Prompt for AI Agents |
||
|
|
||
| try { | ||
| const decoded = Buffer.from(encodedDomain, 'base64url') | ||
| .toString('utf8') | ||
| .replace(/\$+$/, ''); | ||
|
|
||
| if (!decoded) return ''; | ||
|
|
||
| return decoded.startsWith('https://') ? decoded : `https://${decoded}`; | ||
| } catch { | ||
| return ''; | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| #!/usr/bin/env node | ||
| import { pathToFileURL } from 'node:url'; | ||
|
|
||
| const WORKFLOW_FILE = 'prod-smoke.yml'; | ||
|
|
||
| /** | ||
| * Count the consecutive failure streak ending at the current run. | ||
| * | ||
| * `priorConclusions` is the conclusions of earlier completed runs of the | ||
| * same workflow, ordered most-recent-first, excluding the current run. | ||
| * Runs whose conclusion is neither `success` nor `failure` (cancelled, | ||
| * skipped, stale, action_required, ...) are ignored — they carry no signal | ||
| * about whether the underlying check passed — rather than breaking or | ||
| * extending the streak. | ||
| * | ||
| * @param {'success' | 'failure'} currentOutcome | ||
| * @param {Array<string | null>} priorConclusions | ||
| * @returns {number} | ||
| */ | ||
| export function countConsecutiveFailures(currentOutcome, priorConclusions) { | ||
| if (currentOutcome !== 'failure') return 0; | ||
|
|
||
| let streak = 1; | ||
| for (const conclusion of priorConclusions) { | ||
| if (conclusion === 'failure') { | ||
| streak += 1; | ||
| continue; | ||
| } | ||
| if (conclusion === 'success') break; | ||
| // else: ignore and keep looking further back | ||
| } | ||
| return streak; | ||
| } | ||
|
|
||
| /** | ||
| * @param {{ | ||
| * owner: string, | ||
| * repo: string, | ||
| * excludeRunId: string | number, | ||
| * perPage?: number, | ||
| * token: string, | ||
| * fetchImpl?: typeof fetch, | ||
| * }} params | ||
| * @returns {Promise<Array<string | null>>} | ||
| */ | ||
| export async function fetchPriorRunConclusions({ | ||
| owner, | ||
| repo, | ||
| excludeRunId, | ||
| perPage = 10, | ||
| token, | ||
| fetchImpl = globalThis.fetch, | ||
| }) { | ||
| const url = `https://api.github.com/repos/${owner}/${repo}/actions/workflows/${WORKFLOW_FILE}/runs?status=completed&per_page=${perPage}`; | ||
| const response = await fetchImpl(url, { | ||
| headers: { | ||
| Authorization: `Bearer ${token}`, | ||
| Accept: 'application/vnd.github+json', | ||
| 'X-GitHub-Api-Version': '2022-11-28', | ||
| }, | ||
| }); | ||
|
|
||
| if (!response.ok) { | ||
| throw new Error( | ||
| `Failed to list ${WORKFLOW_FILE} runs: HTTP ${response.status}` | ||
| ); | ||
| } | ||
|
|
||
| const body = await response.json(); | ||
| return (body.workflow_runs ?? []) | ||
| .filter((run) => String(run.id) !== String(excludeRunId)) | ||
| .sort((a, b) => new Date(b.created_at) - new Date(a.created_at)) | ||
| .map((run) => run.conclusion); | ||
| } | ||
|
|
||
| if (import.meta.url === pathToFileURL(process.argv[1]).href) { | ||
| const currentOutcome = process.argv[2]; | ||
| const [owner, repo] = (process.env.GITHUB_REPOSITORY || '').split('/'); | ||
|
|
||
| fetchPriorRunConclusions({ | ||
| owner, | ||
| repo, | ||
| excludeRunId: process.env.GITHUB_RUN_ID, | ||
| token: process.env.GITHUB_TOKEN, | ||
| }) | ||
| .then((conclusions) => { | ||
| console.log(countConsecutiveFailures(currentOutcome, conclusions)); | ||
| }) | ||
| .catch((error) => { | ||
| console.error(error instanceof Error ? error.message : String(error)); | ||
| // Fail OPEN toward escalation, never toward silence: the 2026-07-04 | ||
| // outage was caused by a red signal nobody saw for ~15 hours, not by | ||
| // an over-eager page. If we cannot read history on a failing run, | ||
| // assume the threshold is already met rather than assuming zero. | ||
| console.log(currentOutcome === 'failure' ? 2 : 0); | ||
| }); | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: misty-step/linejam
Length of output: 5521
🏁 Script executed:
Repository: misty-step/linejam
Length of output: 837
Use a unique
GITHUB_OUTPUTdelimiter here. A fixedSMOKE_DETAIL_EOFmarker can appear in the captured stderr and truncate the multiline value, letting extra text be parsed as new outputs. Generate a per-run delimiter instead.🤖 Prompt for AI Agents