Function loadWebhookSecrets

showcase/harness/src/orchestrator.ts:183–223

(logger_: typeof logger = logger)

 * a missing secret fails loud regardless of which role is selected.
 */
export function loadWebhookSecrets(logger_: typeof logger = logger): string[] {
  const sharedSecret = process.env.SHARED_SECRET;
  const sharedSecretPrev = process.env.SHARED_SECRET_PREV;
  const webhookSecrets = [sharedSecret, sharedSecretPrev].filter(
    (s): s is string => typeof s === "string" && s.length > 0,
  );

  if (webhookSecrets.length > 0) return webhookSecrets;

  const isTestMode = process.env.NODE_ENV === "test";
  const escapeHatch = process.env.HARNESS_ALLOW_NO_SECRET === "1";
  if (isTestMode || escapeHatch) {
    // CB-2 (Slot 2 #28): when the escape hatch fires with a real-looking
    // NODE_ENV (anything except "test"), log at `warn` so a production
    // typo (e.g. NODE_ENV=staging + HARNESS_ALLOW_NO_SECRET=1) is visible
    // in dashboards / log alerting. Pure local-dev (NODE_ENV=test) stays
    // at info level so a normal unit-test boot doesn't spam warnings.
    const logLevel = escapeHatch && !isTestMode ? "warn" : "info";
    logger_[logLevel]("orchestrator.webhook-auth-bypass", {
      msg: "webhook auth disabled — neither SHARED_SECRET nor SHARED_SECRET_PREV is set to a non-empty value",
      nodeEnv: process.env.NODE_ENV ?? "(unset)",
      escapeHatch,
    });
    return webhookSecrets;
  }

  logger_.error("orchestrator.FATAL-CONFIG", {
    msg: "SHARED_SECRET required — refusing to boot",
    nodeEnv: process.env.NODE_ENV ?? "(unset)",
  });
  throw new Error(
    "FATAL-CONFIG: SHARED_SECRET (or SHARED_SECRET_PREV) is required — refusing to boot " +
      "in any deployable mode (gate at src/http/server.ts:119 only registers " +
      "POST /webhooks/deploy when webhookSecrets.length > 0, so booting without " +
      "a secret would silently 404 every notify-harness POST from the " +
      "Showcase: Verify Deploy workflow). " +
      "Set SHARED_SECRET (or SHARED_SECRET_PREV) in the env, or set " +
      "NODE_ENV=test / HARNESS_ALLOW_NO_SECRET=1 for local dev. " +
      `Current NODE_ENV=${process.env.NODE_ENV ?? "(unset)"}.`,
  );
}

/**
 * Resolve the PocketBase URL with the SAME symmetric fail-loud predicate