Stop embedding secret-shaped literals for the production-defaults guard

SonarCloud's hard-coded-secret rule flags any string that structurally
resembles a key/password next to a suspiciously-named field, regardless of
whether it's a real secret — it caught both the plaintext defaults and
their SHA-256 hashes in the previous two attempts.

ProductionSecretsGuard now takes two ProductionSecretsSnapshot values (the
bound Production configuration, and a fresh runtime read of the base
appsettings.json) and compares them structurally, so the 'dev default' is
never written down as a literal in source — Program.cs re-reads
appsettings.json itself to build the baseline. Tests use synthetic
placeholder strings instead of the real dev-default values.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MoQrUqEN5AoByRCVYD6Qrt

Author: claude

src/Anything.API/Program.cs

@@ -14,6 +14,7 @@
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Options;
 using Microsoft.IdentityModel.Tokens;
 
@@ -196,16 +197,35 @@
 
 // Fails startup (crash loop, caught by the deploy's /health verification) rather
 // than serving Production traffic with the dev secrets from appsettings.json.
-// The checks themselves live in ProductionSecretsGuard (unit-tested).
+// The comparison itself lives in ProductionSecretsGuard (unit-tested); the
+// "dev default" it compares against is read from the base appsettings.json at
+// runtime rather than hard-coded here, so this file never embeds a
+// secret-shaped literal for static analysis to flag.
 static void ValidateProductionSecrets(WebApplication app)
 {
     if (!app.Environment.IsProduction())
         return;
 
-    var errors = ProductionSecretsGuard.FindDevDefaults(
-        app.Services.GetRequiredService<IOptions<JwtSettings>>().Value,
-        app.Services.GetRequiredService<IOptions<AdminSettings>>().Value,
-        app.Services.GetRequiredService<IOptions<ImageSettings>>().Value);
+    var configured = new ProductionSecretsSnapshot(
+        app.Services.GetRequiredService<IOptions<JwtSettings>>().Value.SecretKey,
+        app.Services.GetRequiredService<IOptions<AdminSettings>>().Value.Password,
+        app.Services.GetRequiredService<IOptions<ImageSettings>>().Value.SecretKey,
+        app.Services.GetRequiredService<IOptions<ImageSettings>>().Value.ImageProxyKey,
+        app.Services.GetRequiredService<IOptions<ImageSettings>>().Value.ImageProxySalt);
+
+    var baseFile = new ConfigurationBuilder()
+        .SetBasePath(app.Environment.ContentRootPath)
+        .AddJsonFile("appsettings.json", optional: true)
+        .Build();
+
+    var baseline = new ProductionSecretsSnapshot(
+        baseFile[$"{JwtSettings.SectionName}:SecretKey"],
+        baseFile[$"{AdminSettings.SectionName}:Password"],
+        baseFile[$"{ImageSettings.SectionName}:SecretKey"],
+        null,
+        null);
+
+    var errors = ProductionSecretsGuard.FindDevDefaults(configured, baseline);
 
     if (errors.Count > 0)
         throw new InvalidOperationException(

src/Anything.API/agent.md

@@ -25,5 +25,5 @@ Thin HTTP layer. Endpoints extract request data and dispatch to `IMediator.Send(
 - **Auth on the endpoint is not scoping.** `.RequireAuthorization()` + `HouseholdMiddleware` only prove the caller is *a member* of the header's household — the handler's own query must still filter by `IHouseholdContext.HouseholdId`, or every member of any household can read/write the row. Both halves are required for every new household-scoped endpoint.
 - **`HouseholdMiddleware`'s exempt prefixes** (`/api/auth`, `/api/households`, `/api/events`, `/api/shared`, `/swagger`) skip the membership check entirely, so endpoints under them enforce their own access rules in the handler. Adding a prefix to that list needs the same justification. The middleware also costs one DB query per request — don't add further per-request middleware queries.
 - **SSE (`/api/events`) broadcasts every event to every connected client, across households.** `SyncEvent` must stay type + optional id — never put entity data (names, amounts) in it. Its auth token rides the query string (EventSource can't set headers): don't log query strings anywhere, and don't reuse the query-token pattern on other endpoints.
-- **The checked-in `appsettings.json` secrets are dev-only, and Production enforces that**: `ValidateProductionSecrets` in `Program.cs` refuses to start when `Jwt:SecretKey`, `Admin:Password`, or the MinIO secret still hold the checked-in defaults, or when `ImageSettings:ImageProxyKey`/`ImageProxySalt` are unset (unset means unsigned `/insecure` imgproxy URLs — an open resizer). Override them via environment variables; never commit a real secret to any appsettings file, and add any new secret's default to that guard.
+- **The checked-in `appsettings.json` secrets are dev-only, and Production enforces that**: `ValidateProductionSecrets` in `Program.cs` refuses to start when `Jwt:SecretKey`, `Admin:Password`, or the MinIO secret still equal what a fresh runtime read of the base `appsettings.json` holds, or when `ImageSettings:ImageProxyKey`/`ImageProxySalt` are unset (unset means unsigned `/insecure` imgproxy URLs — an open resizer). It deliberately compares against a **runtime file read**, not an embedded literal or hash (`ProductionSecretsGuard`/`ProductionSecretsSnapshot`) — a hard-coded copy of the dev secret, plaintext or hashed, is itself what SonarCloud's secret-detection rule flags. Override real deployments via environment variables; never commit a real secret to any appsettings file, and never add a new secret's literal/hash to the guard — extend the snapshot and the baseline file read instead.
 - **Anonymous endpoints doing per-request crypto or DB work need a rate limiter.** Login/refresh/register carry `.RequireRateLimiting(RateLimitPolicies.Auth)` (per-client-IP fixed window, configured via `RateLimiting:Auth`; the integration-test factory raises the limit). Client IPs are real only because `UseForwardedHeaders` trusts the nginx chain in `Program.cs` — keep that ordering (first in the pipeline) intact.

src/Anything.Application/Configuration/ProductionSecretsGuard.cs

@@ -1,42 +1,48 @@
-using System.Security.Cryptography;
-using System.Text;
-
 namespace Anything.Application.Configuration;
 
 /// <summary>
-/// Detects checked-in dev-default secrets so Program.cs can refuse to start
-/// Production on them. Pure (no host or options plumbing) so every branch is
-/// unit-testable. The defaults are recognized by SHA-256 hash — the plaintexts
-/// live only in appsettings.json, so this source carries no credential strings.
-/// Add any new secret's dev-default hash here.
+/// The subset of appsettings values Program.cs's startup guard cares about.
+/// Deliberately holds no literal secret text — see <see cref="ProductionSecretsGuard"/>.
+/// </summary>
+public sealed record ProductionSecretsSnapshot(
+    string? JwtSecretKey,
+    string? AdminPassword,
+    string? MinioSecretKey,
+    string? ImageProxyKey,
+    string? ImageProxySalt);
+
+/// <summary>
+/// Detects secrets that were never overridden from the checked-in
+/// appsettings.json defaults, so Program.cs can refuse to start Production on
+/// them. Deliberately takes two snapshots (the bound configuration, and a
+/// fresh read of the base appsettings.json — see Program.cs) rather than
+/// comparing against an embedded literal: a hard-coded copy of the dev secret
+/// (plaintext or hashed) is itself what static analysis flags as a
+/// "hard-coded secret", so the only value this class ever holds is whatever
+/// the deployment's own config file contains at runtime.
 /// </summary>
 public static class ProductionSecretsGuard
 {
-    // SHA-256 (uppercase hex) of the dev defaults in appsettings.json.
-    private const string DevJwtSecretKeySha256 = "360600F0C7D3CD42A71DF0136A2514E2B41B42C83C95209CE71BA7AEF13F1E87";
-    private const string DevAdminPasswordSha256 = "3EB3FE66B31E3B4D10FA70B5CAD49C7112294AF6AE4E476A1C405155D45AA121";
-    private const string DevMinioSecretKeySha256 = "AD9858116E63B0C5A4D7DC7F50F034C7247E56838DAE22C1832712FFDE48E694";
-
-    public static IReadOnlyList<string> FindDevDefaults(JwtSettings jwt, AdminSettings admin, ImageSettings images)
+    public static IReadOnlyList<string> FindDevDefaults(
+        ProductionSecretsSnapshot configured, ProductionSecretsSnapshot baseline)
     {
         var errors = new List<string>();
 
-        if (IsDevDefault(jwt.SecretKey, DevJwtSecretKeySha256))
-            errors.Add("Jwt:SecretKey is the checked-in dev default — set a real secret via environment variables.");
+        if (UnchangedFromBaseline(configured.JwtSecretKey, baseline.JwtSecretKey))
+            errors.Add("Jwt:SecretKey is unchanged from the checked-in appsettings.json default — set a real secret via environment variables.");
 
-        if (IsDevDefault(admin.Password, DevAdminPasswordSha256))
-            errors.Add("Admin:Password is the checked-in dev default — set a real password via environment variables.");
+        if (UnchangedFromBaseline(configured.AdminPassword, baseline.AdminPassword))
+            errors.Add("Admin:Password is unchanged from the checked-in appsettings.json default — set a real password via environment variables.");
 
-        if (IsDevDefault(images.SecretKey, DevMinioSecretKeySha256))
-            errors.Add("ImageSettings:SecretKey is the checked-in dev default — set real MinIO credentials via environment variables.");
+        if (UnchangedFromBaseline(configured.MinioSecretKey, baseline.MinioSecretKey))
+            errors.Add("ImageSettings:SecretKey is unchanged from the checked-in appsettings.json default — set real MinIO credentials via environment variables.");
 
-        if (string.IsNullOrEmpty(images.ImageProxyKey) || string.IsNullOrEmpty(images.ImageProxySalt))
+        if (string.IsNullOrEmpty(configured.ImageProxyKey) || string.IsNullOrEmpty(configured.ImageProxySalt))
             errors.Add("ImageSettings:ImageProxyKey/ImageProxySalt are unset — without them image URLs are unsigned (/insecure), an open resizer. Set both (hex) and configure imgproxy with the same IMGPROXY_KEY/IMGPROXY_SALT.");
 
         return errors;
     }
 
-    private static bool IsDevDefault(string? configuredValue, string devDefaultSha256) =>
-        configuredValue is not null
-        && Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(configuredValue))) == devDefaultSha256;
+    private static bool UnchangedFromBaseline(string? configuredValue, string? baselineValue) =>
+        !string.IsNullOrEmpty(configuredValue) && configuredValue == baselineValue;
 }

tests/Anything.Application.UnitTests/Configuration/ProductionSecretsGuardTests.cs

@@ -5,99 +5,96 @@ namespace Anything.Application.UnitTests.Configuration;
 
 public class ProductionSecretsGuardTests
 {
-    // The dev defaults checked into appsettings.json, in the order
-    // Jwt:SecretKey, Admin:Password, ImageSettings:SecretKey. The guard stores
-    // only their SHA-256 hashes, so these tests prove the plaintexts are
-    // still recognized.
-    private static readonly string[] AppsettingsDevDefaults =
-    [
-        "your-secret-key-min-32-characters-long-change-in-production",
-        "Admin123!",
-        "minioadmin"
-    ];
-
-    private static JwtSettings Jwt(string configured = "a-real-value-with-enough-length") => new()
-    {
-        SecretKey = configured,
-        Issuer = "issuer",
-        Audience = "audience"
-    };
-
-    private static AdminSettings Admin(string? configured = "a-real-value") => new()
-    {
-        Email = "admin@example.com",
-        Password = configured
-    };
-
-    private static ImageSettings Images(
-        string configuredSecret = "a-real-minio-value",
-        string? proxyKey = "aabbcc",
-        string? proxySalt = "ddeeff") => new()
-    {
-        BucketName = "bucket",
-        Endpoint = "http://minio:9000",
-        AccessKey = "access",
-        SecretKey = configuredSecret,
-        MinioSourceEndpoint = "http://minio:9000",
-        ImageProxyBaseUrl = "http://imgproxy:8080",
-        ImageProxyKey = proxyKey,
-        ImageProxySalt = proxySalt
-    };
+    // Stands in for whatever the checked-in appsettings.json currently holds —
+    // the guard only cares whether the configured value still matches it, not
+    // what the value actually is.
+    private static ProductionSecretsSnapshot Baseline() => new(
+        JwtSecretKey: "baseline-jwt-value",
+        AdminPassword: "baseline-admin-value",
+        MinioSecretKey: "baseline-minio-value",
+        ImageProxyKey: null,
+        ImageProxySalt: null);
+
+    private static ProductionSecretsSnapshot OverriddenValues() => new(
+        JwtSecretKey: "overridden-jwt-value",
+        AdminPassword: "overridden-admin-value",
+        MinioSecretKey: "overridden-minio-value",
+        ImageProxyKey: "aabbcc",
+        ImageProxySalt: "ddeeff");
 
     [Fact]
-    public void FindDevDefaults_WithRealSecrets_ReturnsNoErrors() =>
-        Assert.Empty(ProductionSecretsGuard.FindDevDefaults(Jwt(), Admin(), Images()));
+    public void FindDevDefaults_WithOverriddenValues_ReturnsNoErrors() =>
+        Assert.Empty(ProductionSecretsGuard.FindDevDefaults(OverriddenValues(), Baseline()));
 
     [Fact]
-    public void FindDevDefaults_WithDefaultJwtSecret_FlagsIt()
+    public void FindDevDefaults_WithJwtSecretUnchangedFromBaseline_FlagsIt()
     {
-        var errors = ProductionSecretsGuard.FindDevDefaults(
-            Jwt(AppsettingsDevDefaults[0]), Admin(), Images());
+        var configured = OverriddenValues() with { JwtSecretKey = Baseline().JwtSecretKey };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
 
         Assert.Contains(errors, e => e.Contains("Jwt:SecretKey"));
     }
 
     [Fact]
-    public void FindDevDefaults_WithDefaultAdminPassword_FlagsIt()
+    public void FindDevDefaults_WithAdminPasswordUnchangedFromBaseline_FlagsIt()
     {
-        var errors = ProductionSecretsGuard.FindDevDefaults(
-            Jwt(), Admin(AppsettingsDevDefaults[1]), Images());
+        var configured = OverriddenValues() with { AdminPassword = Baseline().AdminPassword };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
 
         Assert.Contains(errors, e => e.Contains("Admin:Password"));
     }
 
     [Fact]
-    public void FindDevDefaults_WithDefaultMinioSecret_FlagsIt()
+    public void FindDevDefaults_WithMinioSecretUnchangedFromBaseline_FlagsIt()
     {
-        var errors = ProductionSecretsGuard.FindDevDefaults(
-            Jwt(), Admin(), Images(configuredSecret: AppsettingsDevDefaults[2]));
+        var configured = OverriddenValues() with { MinioSecretKey = Baseline().MinioSecretKey };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
 
         Assert.Contains(errors, e => e.Contains("ImageSettings:SecretKey"));
     }
 
     [Fact]
-    public void FindDevDefaults_WithUnsetAdminPassword_DoesNotFlagIt() =>
-        Assert.Empty(ProductionSecretsGuard.FindDevDefaults(Jwt(), Admin(configured: null), Images()));
+    public void FindDevDefaults_WithUnsetAdminPassword_DoesNotFlagIt()
+    {
+        var configured = OverriddenValues() with { AdminPassword = null };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
+
+        Assert.DoesNotContain(errors, e => e.Contains("Admin:Password"));
+    }
+
+    [Fact]
+    public void FindDevDefaults_WithNoBaselineToCompareAgainst_DoesNotFlagRealValues()
+    {
+        // appsettings.json missing at runtime (see Program.cs's `optional: true`) —
+        // nothing to compare against, so a real configured secret isn't flagged.
+        var missingBaseline = new ProductionSecretsSnapshot(null, null, null, "aabbcc", "ddeeff");
+
+        Assert.Empty(ProductionSecretsGuard.FindDevDefaults(OverriddenValues(), missingBaseline));
+    }
 
     [Theory]
     [InlineData(null, "ddeeff")]
     [InlineData("aabbcc", null)]
     [InlineData("", "")]
     public void FindDevDefaults_WithMissingImgproxyKeys_FlagsIt(string? proxyKey, string? proxySalt)
     {
-        var errors = ProductionSecretsGuard.FindDevDefaults(
-            Jwt(), Admin(), Images(proxyKey: proxyKey, proxySalt: proxySalt));
+        var configured = OverriddenValues() with { ImageProxyKey = proxyKey, ImageProxySalt = proxySalt };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
 
         Assert.Contains(errors, e => e.Contains("ImageProxyKey"));
     }
 
     [Fact]
-    public void FindDevDefaults_WithEveryDefault_ReturnsAllErrors()
+    public void FindDevDefaults_WithEveryValueUnchanged_ReturnsAllErrors()
     {
-        var errors = ProductionSecretsGuard.FindDevDefaults(
-            Jwt(AppsettingsDevDefaults[0]),
-            Admin(AppsettingsDevDefaults[1]),
-            Images(configuredSecret: AppsettingsDevDefaults[2], proxyKey: null, proxySalt: null));
+        var configured = Baseline() with { ImageProxyKey = null, ImageProxySalt = null };
+
+        var errors = ProductionSecretsGuard.FindDevDefaults(configured, Baseline());
 
         Assert.Equal(4, errors.Count);
     }