[Lakshya-2440]

Summary

This PR resolves the hardcoded password pepper vulnerability in src/worker.py by introducing dynamic runtime pepper injection from Cloudflare secrets.

Previously, _PEPPER was statically hardcoded as b"edu-platform-cf-pepper-2024", causing all clones and deployments to share the same password-salt derivation material.

Key Changes

1. Dynamic Pepper Resolution (src/worker.py):

   • Added get_pepper(env) with hierarchical resolution:
     1. Explicit PASSWORD_PEPPER or PEPPER binding on the Cloudflare env object.
     2. Cached worker isolate state _ACTIVE_PEPPER initialized during on_fetch().
     3. os.environ["PASSWORD_PEPPER"] or os.environ["PEPPER"].
   • Fail-Closed Production Security: If running in production (ENVIRONMENT or SENTRY_ENVIRONMENT equals production) and the pepper secret is missing, it raises a RuntimeError instead of falling back to default values.
   • Backward Compatibility: Non-production and local test environments cleanly fallback to _DEFAULT_PEPPER (b"edu-platform-cf-pepper-2024").

2. Injected into Cryptographic Routines:

   • Updated _user_salt(), hash_password(), and verify_password() with optional pepper and env arguments.
   • Cached active pepper in on_fetch() via init_pepper(env).
   • Wired env=env into api_register, api_login, api_reset_password, api_change_password, seed_db, and guest checkout.

3. Test Suite (tests/test_password.py):

   • Added TestDynamicPepper test suite covering:
     • Custom pepper altering PBKDF2 hash output.
     • Password verification with matching vs mismatched pepper.
     • Runtime injection via env binding and PEPPER alias.
     • Runtime injection via os.environ.
     • Fail-closed behavior in production mode when secret is omitted.
     • Successful resolution in production mode when secret is present.
     • In-isolate active pepper caching.
   • Updated make_env helper in tests/helpers.py.

4. Documentation:

   • Added PASSWORD_PEPPER to setup instructions and Wrangler production secrets in README.md.

Verification

• Syntax check: python3 -m py_compile src/worker.py passed with 0 errors.
• Unit tests: All 22 tests in tests/test_password.py pass cleanly.
• Security: Fail-closed production validation prevents deployment without dedicated secret material.

---

I used gemini 3.8

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4f24c511-ab45-42f4-8aca-7254a876905e

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.