Repository navigation
Warn when METRICS_TOKEN is shorter than the 32-char minimum - #1193
Merged
helpcodeai merged 2 commits intoOct 22, 2026
Merged
Conversation
Other secrets in secrets.util.ts (JWT_SECRET, ENCRYPTION_KEY) already enforce MIN_SECRET_LENGTH. METRICS_TOKEN is opt-in, so a short value only logs a one-time warning instead of blocking the listener. Export MIN_SECRET_LENGTH from secrets.util.ts so metrics.ts reuses the same threshold instead of a hardcoded number.
Contributor
Author
|
@helpcodeai PR is up for the METRICS_TOKEN length warning you mentioned on #1131. Please let me know if there's anything off or needs fixing — happy to get to it right away. |
helpcodeai
approved these changes
Oct 22, 2026
helpcodeai
left a comment
helpcodeai
left a comment
Contributor
There was a problem hiding this comment.
Thanks @rangarajan19, this is what I had in mind, and reusing MIN_SECRET_LENGTH instead of a second hardcoded 32 is nicer. The branch is behind main, I'll update it and merge once CI is green.
Contributor
|
Merged and shipped in v0.45.3, thanks again @rangarajan19! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Small follow-up from @helpcodeai's review on #1131 (the opt-in
/metricsendpoint): other secrets insecrets.util.ts(JWT_SECRET,ENCRYPTION_KEY) already enforce a 32-char minimum viaMIN_SECRET_LENGTH.METRICS_TOKENdidn't, so this adds a one-time warning (not a hard failure — metrics is opt-in, so a short token is still better than none) when it's set below that bar.From the review:
Changes
MIN_SECRET_LENGTHfromsecrets.util.tssometrics.tsreuses the same threshold instead of a hardcoded number.metrics.ts: log a one-time warning whenMETRICS_TOKEN.length < MIN_SECRET_LENGTH; the listener still starts.metrics.spec.ts: two new tests (warns once + still serves metrics on a short token; silent on a token that meets the minimum). Bumped the suite'sDEFAULT_TOKENto 32+ chars so existing tests aren't tripped by the new warning.docs/operations/observability.md: noted the 32-char recommendation and warning behavior in theMETRICS_TOKENrow.Type
Testing
Ran from
packages/backend, afternpx prisma generate(needed to pick up the unrelated schema changes merged intomainsince #1131):tsc --noEmit: clean.metricssuite: 14/14 passed (12 existing + 2 new).Checklist
npm test)Related Issues
Follow-up from the review on #1131 (no separate issue was filed for this one — it was raised and explicitly offered as "up for grabs" directly in that PR's review).