fix(admin): handle missing SECRET and default ipWhitelist for rate limits

Author: Ferryx349

src/admin/password-admin-auth-provider.ts

@@ -32,13 +32,18 @@ export class PasswordAdminAuthProvider implements IAdminAuthProvider {
     const currentSettings = this.settings()
     const sessionTtlSeconds = resolveAdminSessionTtlSeconds(currentSettings.admin?.sessionTtlSeconds)
     const expiresAt = Math.floor(Date.now() / 1000) + sessionTtlSeconds
-    const token = createAdminSessionToken(expiresAt)
 
-    response
-      .status(200)
-      .setHeader('content-type', 'application/json')
-      .setHeader('Set-Cookie', buildAdminSessionCookieHeader(request, currentSettings, token, sessionTtlSeconds))
-      .send({ authenticated: true, expiresAt })
+    try {
+      const token = createAdminSessionToken(expiresAt)
+
+      response
+        .status(200)
+        .setHeader('content-type', 'application/json')
+        .setHeader('Set-Cookie', buildAdminSessionCookieHeader(request, currentSettings, token, sessionTtlSeconds))
+        .send({ authenticated: true, expiresAt })
+    } catch {
+      response.status(500).setHeader('content-type', 'application/json').send({ error: 'Internal Server Error' })
+    }
   }
 
   public isRequestAuthenticated(request: Request): boolean {

src/routes/admin/index.ts

@@ -25,8 +25,13 @@ const requireAdminEnabled = (_request: Request, response: Response, next: NextFu
 }
 
 const requireAdminAuth = (request: Request, response: Response, next: NextFunction) => {
-  if (!createAdminAuthProvider().isRequestAuthenticated(request)) {
-    response.status(401).setHeader('content-type', 'application/json').send({ error: 'Unauthorized' })
+  try {
+    if (!createAdminAuthProvider().isRequestAuthenticated(request)) {
+      response.status(401).setHeader('content-type', 'application/json').send({ error: 'Unauthorized' })
+      return
+    }
+  } catch {
+    response.status(500).setHeader('content-type', 'application/json').send({ error: 'Internal Server Error' })
     return
   }
 

src/utils/admin-rate-limit.ts

@@ -24,7 +24,7 @@ export async function isAdminRateLimited(
   const remoteAddress = getRemoteAddress(request, settings)
 
   let limited = false
-  if (Array.isArray(ipWhitelist) && !ipWhitelist.includes(remoteAddress)) {
+  if (!Array.isArray(ipWhitelist) || !ipWhitelist.includes(remoteAddress)) {
     const rateLimiter = rateLimiterFactory()
     for (const { rate, period } of rateLimits) {
       if (await rateLimiter.hit(`${remoteAddress}:admin-${scope}:${period}`, 1, { period, rate })) {

test/unit/routes/admin.spec.ts

@@ -145,6 +145,41 @@ describe('admin router', () => {
     expect(response.status).to.equal(401)
   })
 
+  it('returns 500 when SECRET is missing during login', async () => {
+    delete process.env.SECRET
+    process.env.ADMIN_PASSWORD = 'correct-password'
+    const baseUrl = await startServer({ admin: { enabled: true } })
+
+    const response = await axios.post(
+      `${baseUrl}/login`,
+      { password: 'correct-password' },
+      {
+        headers: { 'content-type': 'application/json' },
+        validateStatus: () => true,
+      },
+    )
+
+    expect(response.status).to.equal(500)
+    expect(response.data).to.deep.equal({ error: 'Internal Server Error' })
+
+    process.env.SECRET = 'test-admin-secret-value'
+  })
+
+  it('returns 500 when SECRET is missing during session validation', async () => {
+    delete process.env.SECRET
+    const baseUrl = await startServer({ admin: { enabled: true } })
+
+    const response = await axios.get(`${baseUrl}/session`, {
+      headers: { cookie: 'admin_session=9999999999.deadbeef' },
+      validateStatus: () => true,
+    })
+
+    expect(response.status).to.equal(500)
+    expect(response.data).to.deep.equal({ error: 'Internal Server Error' })
+
+    process.env.SECRET = 'test-admin-secret-value'
+  })
+
   it('authenticates with ADMIN_PASSWORD and exposes session and health', async () => {
     process.env.ADMIN_PASSWORD = 'correct-password'
     const baseUrl = await startServer({ admin: { enabled: true, sessionTtlSeconds: 3600 } })