fix(cli): keep token-file credentials away from repository-chosen API URLs

cli/shared/config.test.ts

@@ -22,6 +22,10 @@ import {
 } from "./config.ts";
 import type { ResolvedConfig } from "./config.ts";
 import type { EnvironmentConfig } from "#veryfront/config/environment-config.ts";
+import {
+  _resetEnvironmentConfig,
+  refreshEnvironmentConfig,
+} from "#veryfront/config/environment-config.ts";
 import { makeTempDir } from "#veryfront/testing/deno-compat.ts";
 import { observeFetchRequestInit, withMockFetch } from "#veryfront/testing/mock-fetch.ts";
 import { join } from "veryfront/platform/path";
@@ -724,6 +728,51 @@ describe("resolveConfig", () => {
     }
   });
 
+  for (
+    const [label, tokenFileFromShell] of [
+      ["exported in the shell", true],
+      ["named by the project .env", false],
+    ] as const
+  ) {
+    it(`keeps a token file ${label} away from the .env API URL`, async () => {
+      const tempDir = await makeTempDir();
+      const keys = ["VERYFRONT_API_URL", "VERYFRONT_API_TOKEN", "VERYFRONT_API_TOKEN_FILE"];
+      const originals = keys.map((key) => [key, Deno.env.get(key)] as const);
+      const operatorSecret = "token_file_secret_do_not_forward";
+      const tokenFile = join(tempDir, "operator-token");
+
+      try {
+        __resetEnvLoaderForTests();
+        for (const key of keys) Deno.env.delete(key);
+        await Deno.writeTextFile(tokenFile, operatorSecret);
+        if (tokenFileFromShell) Deno.env.set("VERYFRONT_API_TOKEN_FILE", tokenFile);
+        // The literal token makes the .env look like a self-hosted layout, but
+        // the token file wins when the credential is read, so the secret that
+        // would travel is the operator's, not the repository's.
+        await Deno.writeTextFile(
+          join(tempDir, ".env"),
+          "VERYFRONT_API_URL=https://attacker.example\n" +
+            "VERYFRONT_API_TOKEN=literal-project-token\n" +
+            (tokenFileFromShell ? "" : `VERYFRONT_API_TOKEN_FILE=${tokenFile}\n`),
+        );
+        await loadEnv({ cwd: tempDir });
+        const env = refreshEnvironmentConfig();
+        assertEquals(env.apiToken, operatorSecret);
+
+        const candidates = await resolveApiCredentialCandidatesForAuth(env, tempDir, false);
+        assertEquals(candidates.map((entry) => entry.apiToken).includes(operatorSecret), false);
+
+        const error = await assertRejects(() => resolveConfig(tempDir, env), Error);
+        assertEquals(isUntrustedApiUrlCredentialError(error), true);
+      } finally {
+        __resetEnvLoaderForTests();
+        _resetEnvironmentConfig();
+        await Deno.remove(tempDir, { recursive: true });
+        for (const [key, original] of originals) restoreEnv(key, original);
+      }
+    });
+  }
+
   it("names the confirmation variable without echoing the configured endpoint", async () => {
     const tempDir = await makeTempDir();
     try {

cli/shared/config.ts

@@ -409,6 +409,19 @@ function describeUntrustedApiUrl(trust: ApiUrlTrust): string {
     `to confirm it.`;
 }
 
+/**
+ * Where the effective API token came from.
+ *
+ * A token file wins over `VERYFRONT_API_TOKEN` when the credential is read, so
+ * the source of `VERYFRONT_API_TOKEN` says nothing about the secret actually
+ * sent. A token file belongs to the operator even when a project `.env` names
+ * its path: the repository chose which file to read, never its contents.
+ */
+function getApiTokenSource(): ReturnType<typeof getEnvSource> {
+  if (getEnv("VERYFRONT_API_TOKEN_FILE") !== undefined) return { source: "process" };
+  return getEnvSource("VERYFRONT_API_TOKEN");
+}
+
 /**
  * True when `candidate` may be sent to a repository-steered host.
  *
@@ -427,7 +440,7 @@ function isRepositorySuppliedCredential(
   const endpointSource = trust.steeringEnvKey ? getEnvSource(trust.steeringEnvKey) : undefined;
   if (endpointSource?.source === "env-file" && endpointSource.expandedFromProcessEnv) return false;
 
-  const tokenSource = getEnvSource("VERYFRONT_API_TOKEN");
+  const tokenSource = getApiTokenSource();
   if (tokenSource.source !== "env-file" || tokenSource.file !== trust.steeringEnvFile) return false;
 
   // `loadEnv` expands `$NAME` against the real process environment, so an entry
@@ -484,7 +497,7 @@ async function resolveApiCredentialCandidates(
       (applyIntrinsic(stringTrim, env.apiToken, []) as string)
     ? env.apiToken
     : undefined;
-  const envSource = envToken ? getEnvSource("VERYFRONT_API_TOKEN") : { source: "unset" as const };
+  const envSource = envToken ? getApiTokenSource() : { source: "unset" as const };
   const storedToken = await readToken(env);
   const candidates: ApiCredentialCandidate[] = [];
 
@@ -651,7 +664,7 @@ export async function resolveApiCredentialForFallback(
   // then the veryfront.json apiToken.
   const envToken = getApiTokenEnv(env);
   if (envToken) {
-    const envSource = getEnvSource("VERYFRONT_API_TOKEN");
+    const envSource = getApiTokenSource();
     candidates.push({
       apiToken: envToken,
       apiTokenSource: envSource.source === "env-file" ? "env-file" : "env",