Missing authentication/authorization on secrets API exposes GitHub secret management to any caller

59  }
60
61  const setSecrets = new Set(listSecrets())
62
63  // Start with builtin secrets
64  const secrets = BUILTIN_SECRETS.map(s => ({
65    ...s,
66    isSet: setSecrets.has(s.name),
67  }))
68
69  // Add any GitHub secrets not in builtins as custom "Skill Keys"
70  for (const name of setSecrets) {
71    if (!BUILTIN_NAMES.has(name)) {
72      secrets.push({ name, group: 'Skill Keys', description: 'Custom secret', isSet: true })
73    }
74  }
75
76  return NextResponse.json({ secrets, ghReady: true })
77}
78
79export async function POST(request: Request) {
80  if (!ghAvailable()) {
81    return NextResponse.json({ error: 'GitHub CLI not authenticated' }, { status: 503 })
82  }
83
84  const { name, value } = await request.json()
85
86  if (!name || !value) {
87    return NextResponse.json({ error: 'name and value required' }, { status: 400 })
88  }
89
90  // Allow any valid env var name (builtins + custom)
91  if (!VALID_SECRET_NAME.test(name)) {
92    return NextResponse.json({ error: 'Invalid secret name — use UPPER_SNAKE_CASE' }, { status: 400 })
93  }
94
95  try {
96    execFileSync('gh', ['secret', 'set', name, '-b', value], {
97      stdio: 'pipe',
98      cwd: process.cwd(),
99    })
100    return NextResponse.json({ ok: true })
101  } catch (error: unknown) {
102    const msg = error instanceof Error ? error.message : 'Failed to set secret'
103    return NextResponse.json({ error: msg }, { status: 500 })
104  }
105}
106
107export async function DELETE(request: Request) {
108  if (!ghAvailable()) {
109    return NextResponse.json({ error: 'GitHub CLI not authenticated' }, { status: 503 })
110  }
111
112  const { name } = await request.json()
113
114  if (!name || !VALID_SECRET_NAME.test(name)) {
115    return NextResponse.json({ error: 'Invalid secret name' }, { status: 400 })
116  }
117
118  try {
119    execFileSync('gh', ['secret', 'delete', name], { stdio: 'pipe', cwd: process.cwd() })

59  try {
60    const out = execFileSync('gh', ['secret', 'list', ...ghArgsRepo(), '--json', 'name', '-q', '.[].name'], {
61      stdio: 'pipe',
62      cwd: process.cwd(),
63    }).toString().trim()
64    return out ? out.split('\n').filter(Boolean) : []
65  } catch {
66    return []
67  }
68}
69
70export async function GET() {
71  if (!ghAvailable()) {
72    return NextResponse.json({
73      error: 'GitHub CLI not authenticated. Run: gh auth login',
74      ghReady: false,
75    }, { status: 503 })
76  }
77
78  const setSecrets = new Set(listSecrets())
79
80  // Start with builtin secrets
81  const secrets = BUILTIN_SECRETS.map(s => ({
82    ...s,
83    isSet: setSecrets.has(s.name),
84  }))
85
86  // Add any GitHub secrets not in builtins as custom "Skill Keys"
87  for (const name of setSecrets) {
88    if (!BUILTIN_NAMES.has(name)) {
89      secrets.push({ name, group: 'Skill Keys', description: 'Custom secret', isSet: true })
90    }
91  }
92
93  return NextResponse.json({ secrets, ghReady: true })
94}
95
96export async function POST(request: Request) {
97  if (!ghAvailable()) {
98    return NextResponse.json({ error: 'GitHub CLI not authenticated' }, { status: 503 })
99  }
100
101  const { name, value } = await request.json()
102
103  if (!name || !value) {
104    return NextResponse.json({ error: 'name and value required' }, { status: 400 })
105  }
106
107  // Allow any valid env var name (builtins + custom)
108  if (!VALID_SECRET_NAME.test(name)) {
109    return NextResponse.json({ error: 'Invalid secret name — use UPPER_SNAKE_CASE' }, { status: 400 })
110  }
111
112  try {
113    execFileSync('gh', ['secret', 'set', name, ...ghArgsRepo(), '-b', value], {
114      stdio: 'pipe',
115      cwd: process.cwd(),
116    })
117    return NextResponse.json({ ok: true })
118  } catch (error: unknown) {
119    const msg = error instanceof Error ? error.message : 'Failed to set secret'