From b1bff6aefce0012149fd4d102eb2eda716dde30f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 23 Jul 2026 16:58:59 +0000 Subject: [PATCH 1/2] Initial plan From 5c55ef24deced8c140ee87ba08a5676c698088cf Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:02:18 +0000 Subject: [PATCH 2/2] fix: remove rejectUnauthorized: false to fix certificate validation alert (CodeQL #1) --- api/src/shared/cosmosdb.ts | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/api/src/shared/cosmosdb.ts b/api/src/shared/cosmosdb.ts index e9614e8..c6d6e84 100644 --- a/api/src/shared/cosmosdb.ts +++ b/api/src/shared/cosmosdb.ts @@ -87,12 +87,10 @@ export async function initializeStorage(): Promise { clientOptions.agent = new https.Agent({ ca }) console.log(`🔒 Using custom CA cert from ${emulatorCertPath}`) } else { - // SAFETY: Only allow insecure connections in non-production environments - if (process.env.ENVIRONMENT === 'prod') { - throw new Error('Cannot disable TLS verification in production environment') - } - console.warn(`⚠️ Emulator CA cert not found. Using insecure Cosmos DB TLS agent (localhost only)`) - clientOptions.agent = new https.Agent({ rejectUnauthorized: false }) // eslint-disable-line -- safe: only for local emulator, blocked in prod + throw new Error( + `Cosmos DB Emulator CA certificate not found at "${emulatorCertPath}". ` + + `Run the emulator setup script or set COSMOS_EMULATOR_CERT_PATH to a valid cert file.` + ) } } catch (err) { console.warn(`⚠️ Error reading emulator CA certificate:`, err)