From 7a512a972631c4f797987b48e9df879f4bca8ac5 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Mon, 15 Jun 2026 16:17:41 -0400 Subject: [PATCH] fix(12): WR-03 document and log single-write process.env semantics in oidcFallback The oidcConfigFallbackMiddleware permanently mutates process.env on first request then never re-reads from DB. Log an explicit info message when each value is written so operators can see when a restart is required to pick up config changes, and add inline documentation of the single-write semantics to prevent silent misconfiguration after a re-run of the wizard. Co-Authored-By: Claude Sonnet 4.6 --- apps/api/src/auth/middleware.ts | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/apps/api/src/auth/middleware.ts b/apps/api/src/auth/middleware.ts index 82e5247..494cf0d 100644 --- a/apps/api/src/auth/middleware.ts +++ b/apps/api/src/auth/middleware.ts @@ -80,11 +80,26 @@ export async function oidcConfigFallbackMiddleware(c: Context, next: Next): Prom .limit(1); if (row?.value) { - // Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up - // This is safe: these are non-secret, app-config-owned values (D-01) - if (key === 'oidc_issuer') process.env.OIDC_ISSUER = row.value; - if (key === 'oidc_client_id') process.env.OIDC_CLIENT_ID = row.value; - if (key === 'app_external_url') process.env.OIDC_AUTH_EXTERNAL_URL = row.value; + // Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up. + // This is safe: these are non-secret, app-config-owned values (D-01). + // + // WR-03 — single-write semantics: once written, process.env is NOT re-read + // from DB on subsequent requests (the needsXxx guard above is false once set). + // Consequence: if the operator changes these values via the wizard after the + // container is already running, the in-process value is stale until restart. + // A container restart is required to pick up any changed OIDC config values. + if (key === 'oidc_issuer') { + console.info('[oidcFallback] Writing OIDC_ISSUER from app_config — container restart required to update this value'); + process.env.OIDC_ISSUER = row.value; + } + if (key === 'oidc_client_id') { + console.info('[oidcFallback] Writing OIDC_CLIENT_ID from app_config — container restart required to update this value'); + process.env.OIDC_CLIENT_ID = row.value; + } + if (key === 'app_external_url') { + console.info('[oidcFallback] Writing OIDC_AUTH_EXTERNAL_URL from app_config — container restart required to update this value'); + process.env.OIDC_AUTH_EXTERNAL_URL = row.value; + } } } }