Say so at boot when a site UUID has no credential behind it

[patchstackdave]

ENG-3641

A guard configured with a site UUID but no resolvable credential currently boots in complete silence. This makes it audible.

Why it is invisible today

The credential is read from .patchstackrc.json, which needs a filesystem and a working directory. Not every runtime this guard targets has either — on a Worker or an edge function the file is absent, and only PATCHSTACK_PULSE_AUTH / PATCHSTACK_API_KEY can carry it.

Nothing about that surfaces in traffic. The rules fetch goes out unauthenticated; if it is ever refused, the guard fails open onto its cached or bundled rules and carries on screening every request. An app running the rule set it installed with looks exactly like an app running the current one — no error, no behavioural difference, nothing to notice. The failure mode is a site that silently stops learning about new vulnerabilities while reporting perfect health.

The change

createProtection reports once at boot, via onError and console.warn, when siteUuid is set and no credential resolves. The message names the site and the variable that fixes it — a diagnostic that states a symptom without a remedy leaves an operator on a filesystem-less runtime with no next step, which is exactly where this happens.

A warning, not a throw. A missing credential costs rule freshness; refusing to boot over it would cost protection entirely.

Tests

tests/protect/credential-visibility.test.ts — five cases, and two of them are controls:

• warns, and names what to set
• reports through onError as well, for hosts that capture logs structurally
• does not warn when a credential resolves — without this, the suite would also pass for a warning hard-wired to siteUuid, firing on every healthy install and training operators to ignore it
• does not warn in bundled-rules mode — a supported configuration, not a misconfiguration: no per-site lookup, so nothing is missing
• still blocks and still allows, proving the diagnostic never became a refusal to boot

Mutation-checked: dropping the credential check fails only the control; removing the diagnostic fails only the two positive cases; dropping the remedy from the message fails only the assertion about the remedy.

Full suite green (1254 passed, 6 skipped), typecheck and template typecheck clean.

[coderbuds]

Adds audible boot-time warning when a site UUID lacks credentials.

🎯 Quality: 100% Elite · 📦 Size: Medium

📈 This month: Your 105th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review