Commit Graph
2 Commits
Author SHA1 Message Date
thePR0M3TH3AN 86bfec6319 update 2026-02-19 17:05:13 -05:00
google-labs-jules[bot]andPR0M3TH3AN 88506ad6e4 fix(security): sanitize torch-config.json response in dashboard
The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.

Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.

Co-authored-by: PR0M3TH3AN <[email protected]>
2026-02-17 17:36:56 +00:00