harden: write a per-repo plaintext token only with recorded --insecure-storage consent #610

New issue

Closed

opened 2026-09-23 15:47:50 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-23 15:47:50 +00:00

Owner

What

WriteRepoCredentials (internal/service/git/clone.go) provisions credentials for clone, init, and remote add. With no global secure-backend marker, it wrote the token in plaintext into the repo's .git/config. The token can come from MADTEA_TOKEN, so a user with MADTEA_URL and MADTEA_TOKEN set and no keychain got the env token copied to disk, with no --insecure-storage consent. ADR 0013 makes --insecure-storage the sole plaintext path.

Fix

With no secure backend, write the plaintext token only when a plaintext madtea.token exists in the global scope. Only auth login --insecure-storage writes one, so it is the record of consent.
Without that consent, write the URL and user only, and print a notice that names the fix. madtea reads MADTEA_TOKEN on every run, so env setups keep working.
ADR 0042 records the rule.

Acceptance

No backend and no consent: clone, init, and remote add write no token.
No backend with consent: they write the token as before.
A secure backend: unchanged (the marker, no token).
The record exists, and the gate is green.

## What `WriteRepoCredentials` (`internal/service/git/clone.go`) provisions credentials for clone, init, and remote add. With no global secure-backend marker, it wrote the token in plaintext into the repo's `.git/config`. The token can come from `MADTEA_TOKEN`, so a user with `MADTEA_URL` and `MADTEA_TOKEN` set and no keychain got the env token copied to disk, with no `--insecure-storage` consent. ADR 0013 makes `--insecure-storage` the sole plaintext path. ## Fix - With no secure backend, write the plaintext token only when a plaintext `madtea.token` exists in the global scope. Only `auth login --insecure-storage` writes one, so it is the record of consent. - Without that consent, write the URL and user only, and print a notice that names the fix. madtea reads `MADTEA_TOKEN` on every run, so env setups keep working. - ADR 0042 records the rule. ## Acceptance - No backend and no consent: clone, init, and remote add write no token. - No backend with consent: they write the token as before. - A secure backend: unchanged (the marker, no token). - The record exists, and the gate is green.

hexajon added the

security

severity/low

labels

2026-09-23 15:47:50 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-23 16:29:06 +00:00

fix(git): write a per-repo plaintext token only with recorded consent #611

hexajon referenced this issue from a commit

2026-09-23 16:29:07 +00:00

fix(git): write a per-repo plaintext token only with recorded consent

hexajon closed this issue