#191: feeds.enabled instance switch + feed-token log masking #242

fable-5 · 2026-07-30T11:35:02+02:00

fable-5 commented

2026-07-30 11:35:02 +02:00

Implements #191 via the instance-switch path:

feeds.enabled (default ON - feeds predate the switch, existing subscribers keep working; the VS-NfD reference config #227 sets it off). While off, both feed routes AND the feed-token management (/users/me/feed-tokens) answer 404, same existence-hiding semantics as api.enabled/mcp.enabled.
Admin UI toggle next to the API/MCP switches (i18n de+en, same accessible label pattern).
Rejected alternative documented in security.md: moving the token into a path segment lands in the same proxy/request logs, and feed readers cannot send headers - that is why the credential is in the URL at all.
Real finding fixed: pino logs req.url, so feed tokens DID land in the api own request log. The req serializer now masks ?token= values (common/mask-token-param.ts + unit tests) - no code path logs the credential.

Tested: api full suite 448 green vs fresh DB (new: whole-surface-404 test in feed.e2e.db.test.ts incl. reader flow unchanged and the rest of the public surface untouched; 4 mask unit tests); web 131; i18n:check; typecheck + lint green.

Refs #191 (close manually after green CI + merge).

Generated with Claude Code (Claude Fable 5)

Implements #191 via the instance-switch path: - feeds.enabled (default ON - feeds predate the switch, existing subscribers keep working; the VS-NfD reference config #227 sets it off). While off, both feed routes AND the feed-token management (/users/me/feed-tokens) answer 404, same existence-hiding semantics as api.enabled/mcp.enabled. - Admin UI toggle next to the API/MCP switches (i18n de+en, same accessible label pattern). - Rejected alternative documented in security.md: moving the token into a path segment lands in the same proxy/request logs, and feed readers cannot send headers - that is why the credential is in the URL at all. - Real finding fixed: pino logs req.url, so feed tokens DID land in the api own request log. The req serializer now masks ?token= values (common/mask-token-param.ts + unit tests) - no code path logs the credential. Tested: api full suite 448 green vs fresh DB (new: whole-surface-404 test in feed.e2e.db.test.ts incl. reader flow unchanged and the rest of the public surface untouched; 4 mask unit tests); web 131; i18n:check; typecheck + lint green. Refs #191 (close manually after green CI + merge). Generated with Claude Code (Claude Fable 5)

fable-5 added 1 commit 2026-07-30 11:35:02 +02:00

#191 : feeds.enabled instance switch, feed-token log masking

CI / Lint, typecheck, test (pull_request) Successful in 4m52s

Details

CI / Build container images (pull_request) Successful in 3m55s

Details

CI / Auth e2e pack (pull_request) Successful in 7m52s

Details

CI / Import/export fidelity gate (pull_request) Successful in 55s

Details

CD / Build and push images (push) Successful in 16s

Details

CD / Deploy to Test (push) Successful in 14s

Details

CD / Smoke tests against Test (push) Successful in 1m14s

Details

CD / Promote to Int (push) Successful in 11s

Details

CI / Lint, typecheck, test (push) Successful in 4m55s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 7m34s

Details

CI / Import/export fidelity gate (push) Successful in 58s

Details

afef45732a

Chosen path: an instance master switch following the api.enabled/
mcp.enabled pattern — while off, both feed routes AND the feed-token
management answer 404 (existence hidden). Default ON: feeds predate the
switch, existing instances and their subscribed readers keep working;
the VS-NfD reference configuration (#227) turns it off. Admin UI gets
the toggle next to the API/MCP switches (i18n de+en).

Moving the token out of the query string is documented as rejected: a
path segment lands in the same proxy and request logs, and feed readers
cannot send headers — that is why the credential is in the URL at all.
What DID leak was our own request log (pino logs req.url): the req
serializer now masks ?token= values (common/mask-token-param.ts), so no
code path logs the credential.

Refs #191

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit afef45732a into main

2026-07-30 11:49:41 +02:00

fable-5 referenced this pull request

2026-07-30 11:49:41 +02:00

[VS-NfD] Remove the feed token from the query string, or allow feeds to be disabled #191

Sign in to join this conversation.

No reviewers