fix(ops): the secrets gate called an undeliverable mailer "OK" - #489
Open
runyourempire wants to merge 1 commit into
Open
fix(ops): the secrets gate called an undeliverable mailer "OK"#489runyourempire wants to merge 1 commit into
runyourempire wants to merge 1 commit into
Conversation
check-pages-secrets.cjs could only ever read variable NAMES -- Cloudflare never returns values -- so "configured" and "able to send" were the same answer to it. They come apart in one specific and dangerous way: set RESEND_API_KEY and RESEND_FROM_EMAIL while the sending domain is unverified, and Resend refuses every send with 403 while the gate reports green. That is the same conflation this script was written to refuse, pointing the other way. Its own header says "could not check" must never read as "checked and fine"; a mailer that cannot send must not read as one that can. Found while provisioning Resend for real: the account's key is send-only and 4da.ai is not verified, so setting the two variables now would have turned an honest exit 1 into a green light over a delivery path that 403s on every sale. Refusing to create that false green is worth more than the round-trip it saves. The check is a DNS lookup for resend._domainkey.4da.ai -- no token, no secret values, either the record is published or it is not. Three-valued like the rest of the script: published is verified, NXDOMAIN/ENOTFOUND/ ENODATA is absent, and an unreachable resolver is UNKNOWN and exits 2, because reporting a network blip as "not verified" would fail a release for the wrong reason and teach everyone to ignore the gate. Proven against live DNS both ways: resend._domainkey.4da.ai reads absent (ENOTFOUND), independently confirming the Resend API's 403 without using the key at all; a name that does publish TXT reads verified. Also adds the tests the script shipped without, which is a poor look for a gate whose whole purpose is not lying. Eight of them, including one pinning that main() returns a Promise: if it is ever reverted to sync the require.main handler assigns a Promise to process.exitCode, which coerces to 0 and makes the gate permanently and silently green. 174 script tests pass, up from 166.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The secrets gate called an undeliverable mailer "OK"
check-pages-secrets.cjscan only ever read variable names — Cloudflare never returns values — so "configured" and "able to send" were the same answer to it. Those come apart in one specific and dangerous way: setRESEND_API_KEYandRESEND_FROM_EMAILwhile the sending domain is unverified, and Resend refuses every send with 403 while the gate reports green.That is the same conflation the script was written to refuse, pointing the other way. Its own header says "could not check" must never read as "checked and fine"; a mailer that cannot send must not read as one that can.
Found while provisioning Resend for real. The account's key was send-only and
4da.aiwas unverified, so setting the two variables at that moment would have turned an honestexit 1into a green light over a delivery path that 403s on every sale. Refusing to create that false green is worth more than the round-trip it saves — and it is the second false-green found in this repo's gates this week, after the one in #485.What it does now
A DNS lookup for
resend._domainkey.4da.ai. No token, no secret values, no network credentials — either the record is published or it is not.Three-valued, like the rest of the script:
NXDOMAIN/ENOTFOUND/ENODATAESERVFAIL, timeout, unknown)The third row is load-bearing. Reporting an unreachable resolver as "not verified" would fail a release over a network blip and teach everyone to ignore the gate — the exact way a gate dies.
SENDING_DOMAINis hard-coded for the same reasonPROJECTis: Cloudflare will not disclose the value ofRESEND_FROM_EMAIL, so the domain to check against cannot be discovered from the project.Tests, which the script shipped without
A poor look for a gate whose entire purpose is not lying. Eight added, covering every DNS outcome and both mailer states.
One is worth calling out:
main()must return a Promise. If it is ever reverted to synchronous, therequire.mainhandler assigns a Promise toprocess.exitCode, which coerces to0— a permanently and silently green gate. That is precisely the failure this whole script exists to prevent, so it is pinned.177 script tests pass, up from 169 on
main.Verified against live DNS, both directions
resend._domainkey.4da.aidid not exist, this read absent (ENOTFOUND) — independently confirming Resend's own 403 without using the API key at all.Same code, opposite answers, tracking reality as it changed during the session.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Fq96xWyPQjx2bCCzWtsnC9