mikael-lovqvists-claude-agent
67c1c3f9a4
Each request is signed with HMAC-SHA256 over timestamp+body using a per-user secret loaded from a --secrets file (never env vars or git). Users have a canApprove list controlling who may approve queued actions. Queue entries track submitted_by for permission checks on approve/deny. Also renames all identifiers to snake_case throughout the codebase. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
24 lines
596 B
JavaScript
24 lines
596 B
JavaScript
import { readFileSync } from "fs";
|
|
|
|
export function load_secrets(file_path) {
|
|
if (!file_path) {
|
|
throw new Error("--secrets <path> is required");
|
|
}
|
|
let raw;
|
|
try {
|
|
raw = readFileSync(file_path, "utf8");
|
|
} catch (err) {
|
|
throw new Error(`Cannot read secrets file at ${file_path}: ${err.message}`);
|
|
}
|
|
let parsed;
|
|
try {
|
|
parsed = JSON.parse(raw);
|
|
} catch (err) {
|
|
throw new Error(`Secrets file is not valid JSON: ${err.message}`);
|
|
}
|
|
if (!parsed.users || typeof parsed.users !== "object") {
|
|
throw new Error("Secrets file must have a top-level 'users' object");
|
|
}
|
|
return parsed;
|
|
}
|