Credential references: env: references are not scoped per driver instance #849

New Issue

2026-11-11T05:24:27-05:00

dohertj2 commented

2026-11-11 05:24:27 -05:00

Residual from #835. The per-instance rule only applies to secret: references (secret:galaxy/<instance>/…). env:OTOPCUA_GALAXY_… / env:GALAXY_MXGW_… have no instance naming convention, so any Galaxy driver may name any of them. Options: define a convention (e.g. env:OTOPCUA_GALAXY_<INSTANCE>_…) and apply the same rule, or deprecate env: for credentials in favour of secret:. Cross-repo idea: mxaccessgw could bind each API key to the client identity / Galaxy it was issued for, so a captured key is useless elsewhere.

Residual from #835. The per-instance rule only applies to `secret:` references (`secret:galaxy/<instance>/…`). `env:OTOPCUA_GALAXY_…` / `env:GALAXY_MXGW_…` have no instance naming convention, so any Galaxy driver may name any of them. Options: define a convention (e.g. `env:OTOPCUA_GALAXY_<INSTANCE>_…`) and apply the same rule, or deprecate env: for credentials in favour of `secret:`. Cross-repo idea: mxaccessgw could bind each API key to the client identity / Galaxy it was issued for, so a captured key is useless elsewhere.

dohertj2 added the cross-driver type:review-finding priority:p3 cross-repo labels 2026-11-11 05:24:27 -05:00

dohertj2 referenced this issue

2026-11-11 05:24:36 -05:00

Credential references are scoped per driver type, not per instance: a Designer can capture another Galaxy instance's mxaccessgw key #835

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

fix(security): env: credential references follow the per-instance rule (#849)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

docs(security): env: per-instance convention, name claim/pin, merged preflight (#848 #849 #850)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:03 -05:00

fix(security): id-form credential references match by id only; id-shaped driver names refused (#849 review)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:04 -05:00

docs(security): id-form matching, ASCII-only name form, one-save pin side-step, rename/device-save race (#848 #849 review)

dohertj2 referenced this issue from a commit

2026-11-11 07:55:04 -05:00

Merge #848 #849 #850 credential name claim/pin, env: per-instance rule, merged preflight

dohertj2 commented

2026-11-11 07:55:32 -05:00

Fixed (4a6229e4, review fix d68dff09). Pushed to master in 03e51457. env: references follow the per-instance rule: env:<PREFIX><INSTANCE>_… with PREFIX in OTOPCUA_GALAXY_, GALAXY_MXGW_, OTOPCUA_OPCUACLIENT_, OTOPCUA_HEIDENHAIN_ and INSTANCE = driver id or name upper-cased with non-letters/digits → _. A variable naming another same-type driver is refused at save, deploy (CredentialReferenceOtherInstance), Test Connect and browse; shared variables naming no driver still work. Id-form variables (…DRV_<12 HEX>…) match by id only, so no driver name can break them. Name-form is reliable for ASCII names only — use the id form.

Upgrade note: a driver whose name is a prefix of another same-type driver's env var (e.g. a Galaxy driver named API vs env:GALAXY_MXGW_API_KEY) is refused at its next deploy; the /raw banner lists these. The mxaccessgw key-binding idea is not done (cross-repo).

Fixed (`4a6229e4`, review fix `d68dff09`). Pushed to master in `03e51457`. `env:` references follow the per-instance rule: `env:<PREFIX><INSTANCE>_…` with PREFIX in `OTOPCUA_GALAXY_`, `GALAXY_MXGW_`, `OTOPCUA_OPCUACLIENT_`, `OTOPCUA_HEIDENHAIN_` and INSTANCE = driver id or name upper-cased with non-letters/digits → `_`. A variable naming another same-type driver is refused at save, deploy (`CredentialReferenceOtherInstance`), Test Connect and browse; shared variables naming no driver still work. Id-form variables (`…DRV_<12 HEX>…`) match by id only, so no driver name can break them. Name-form is reliable for ASCII names only — use the id form. **Upgrade note:** a driver whose name is a prefix of another same-type driver's env var (e.g. a Galaxy driver named `API` vs `env:GALAXY_MXGW_API_KEY`) is refused at its next deploy; the /raw banner lists these. The mxaccessgw key-binding idea is not done (cross-repo).

dohertj2 closed this issue

2026-11-11 07:55:32 -05:00

dohertj2 referenced this issue from a commit

2026-11-11 16:14:33 -05:00

docs(deploy): vd03 upgrade-readiness pack b8b4c18f -> master (#793)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#849