commit 914df66bd84fdfdd82621d7d2232272fa42b361f parent bab7da1039191a5d6eece5138b2d2c9a7e91f466 Author: Florian Dold <dold@taler.net> Date: Fri, 31 Jul 2026 15:42:09 +0200 turn off KYC OAuth2 debug mode by default Should not be on in production. Diffstat:
6 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/inventories/group_vars/testing/test-public.yml b/inventories/group_vars/testing/test-public.yml @@ -57,5 +57,7 @@ EXCHANGE_AML_PROGRAM_TOPS_SMS_REGEX: "\\\\+41[0-9]+" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_COUNTRY_HINT: "Swiss address required" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_EXAMPLE: "Max Mustermann\\nBahnhofsplatz 1\\n4201 Biel/Bienne" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_COUNTRY_REGEX: "CH|Ch|ch" +# Let exchange error messages include the full challenger response. +challenger_oauth2_debug_mode: "YES" # Tool to use for sanction list checking EXCHANGE_SANCTION_HELPER: taler-exchange-helper-sanctions-dummy diff --git a/inventories/host_vars/fdold-acai-tops/test-public.yml b/inventories/host_vars/fdold-acai-tops/test-public.yml @@ -64,5 +64,7 @@ EXCHANGE_AML_PROGRAM_TOPS_SMS_REGEX: "\\\\+41[0-9]+" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_COUNTRY_HINT: "Swiss address required" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_EXAMPLE: "Max Mustermann\\nBahnhofsplatz 1\\n4201 Biel/Bienne" EXCHANGE_AML_PROGRAM_TOPS_POSTAL_COUNTRY_REGEX: "CH|Ch|ch" +# Let exchange error messages include the full challenger response. +challenger_oauth2_debug_mode: "YES" # Tool to use for sanction list checking EXCHANGE_SANCTION_HELPER: taler-exchange-helper-sanctions-dummy diff --git a/roles/challenger/defaults/main.yml b/roles/challenger/defaults/main.yml @@ -0,0 +1,5 @@ +--- +# Include the full challenger response in exchange error messages. +# taler-exchange.conf(5) says this should be NO in production, as those +# responses can contain the address the user is having validated. +challenger_oauth2_debug_mode: "NO" diff --git a/roles/challenger/templates/etc/taler-exchange/secrets/challenger-email.secret.conf.j2 b/roles/challenger/templates/etc/taler-exchange/secrets/challenger-email.secret.conf.j2 @@ -8,5 +8,6 @@ KYC_OAUTH2_CLIENT_ID = {{ ansible_local['email-challenger-client-id'] }} KYC_OAUTH2_CLIENT_SECRET = {{ ansible_local['email-challenger-client-secret'] }} KYC_OAUTH2_POST_URL = {{ KYC_THANK_YOU_URL }} KYC_OAUTH2_CONVERTER_HELPER = /usr/bin/taler-exchange-kyc-challenger-email-converter -# FIXME: change in production? -KYC_OAUTH2_DEBUG_MODE = YES +# Error responses may include the full response of the challenger, +# which can contain the address being validated. +KYC_OAUTH2_DEBUG_MODE = {{ challenger_oauth2_debug_mode }} diff --git a/roles/challenger/templates/etc/taler-exchange/secrets/challenger-postal.secret.conf.j2 b/roles/challenger/templates/etc/taler-exchange/secrets/challenger-postal.secret.conf.j2 @@ -8,5 +8,6 @@ KYC_OAUTH2_CLIENT_ID = {{ ansible_local['postal-challenger-client-id'] }} KYC_OAUTH2_CLIENT_SECRET = {{ ansible_local['postal-challenger-client-secret'] }} KYC_OAUTH2_POST_URL = {{ KYC_THANK_YOU_URL }} KYC_OAUTH2_CONVERTER_HELPER = /usr/bin/taler-exchange-kyc-challenger-postal-converter -# FIXME: change in production? -KYC_OAUTH2_DEBUG_MODE = YES +# Error responses may include the full response of the challenger, +# which can contain the address being validated. +KYC_OAUTH2_DEBUG_MODE = {{ challenger_oauth2_debug_mode }} diff --git a/roles/challenger/templates/etc/taler-exchange/secrets/challenger-sms.secret.conf.j2 b/roles/challenger/templates/etc/taler-exchange/secrets/challenger-sms.secret.conf.j2 @@ -8,5 +8,6 @@ KYC_OAUTH2_CLIENT_ID = {{ ansible_local['sms-challenger-client-id'] }} KYC_OAUTH2_CLIENT_SECRET = {{ ansible_local['sms-challenger-client-secret'] }} KYC_OAUTH2_POST_URL = {{ KYC_THANK_YOU_URL }} KYC_OAUTH2_CONVERTER_HELPER = /usr/bin/taler-exchange-kyc-challenger-sms-converter -# FIXME: change in production? -KYC_OAUTH2_DEBUG_MODE = YES +# Error responses may include the full response of the challenger, +# which can contain the address being validated. +KYC_OAUTH2_DEBUG_MODE = {{ challenger_oauth2_debug_mode }}