require dedicated secret for MCP API key signing

Rhys Sullivan committed 8 months ago

Commit a63e8231 parent 44cb3682 files · +12 −5Browse files

Unified · Split

2 files

@@ -50,3 +50,15 @@ test("issueMcpApiKey returns null when secret is missing", async () => { · 49 unmodified lines
50		50
51	expect(apiKey).toBeNull();	51	expect(apiKey).toBeNull();
52	});	52	});
		53
		54	test("does not fall back to anonymous private key", async () => {
		55	delete process.env.MCP_API_KEY_SECRET;
		56	process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM = "unused-anonymous-key";
		57
		58	const apiKey = await issueMcpApiKey({
		59	workspaceId: "workspace_no_fallback" as Id<"workspaces">,
		60	accountId: "account_no_fallback" as Id<"accounts">,
		61	});
		62
		63	expect(apiKey).toBeNull();
		64	});

     return normalizeSecret(explicit);
   }
-  const anonymousPrivateKey = trimOrNull(process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM);
-  if (anonymousPrivateKey) {
-    return normalizeSecret(anonymousPrivateKey);
-  }
   return null;
 }