db mode for update secrets

docker-compose.yaml

@@ -156,6 +156,7 @@ services:
       - DB_PORT=3306
       - DB_NAME=softwares
       - UPDATE_SECRET=${UPDATE_SECRET}
+      - UPDATE_SECRET_SOURCE=${UPDATE_SECRET_SOURCE:-env}
       - FILE_CONTAINER_PATH=/softwares
       - IMAGE_CONTAINER_PATH=/images
       - SECRET_KEY_BASE=${SECRET_KEY_BASE:-changeme_in_production_use_long_random_string}

env-example

@@ -23,6 +23,8 @@ WOODPECKER_AGENT_SECRET=
 MYSQL_ROOT_PASSWORD=
 DB_PASSWORD=
 UPDATE_SECRET=
+# env (default, UPDATE_SECRET) vagy database (WarpEngine::ApplicationToken) — kizárólagos
+UPDATE_SECRET_SOURCE=
 DROP_PASSWORD=
 WEBAPP_WIKIJS_TOKEN=
 DISCORD_INVITE_LINK=

libs/ruby/warp_engine/README.md

@@ -184,6 +184,7 @@ Rails.application.config.to_prepare do
     #   :database — only WarpEngine::ApplicationToken records with the
     #               "update" scope are accepted; the shared secret stops
     #               working the moment you switch.
+    # Defaults to ENV["UPDATE_SECRET_SOURCE"] (:env when unset).
     # :database mode also requires the owner class every token belongs to:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"

libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb

@@ -13,6 +13,7 @@ Rails.application.config.to_prepare do
     #   :env      — a fenti shared secret érvényes (default)
     #   :database — csak DB-tárolt WarpEngine::ApplicationToken érvényes
     #               ("update" scope-pal); a shared secret ilyenkor NEM működik.
+    # Default: ENV["UPDATE_SECRET_SOURCE"] (beállítatlanul :env).
     # A :database módhoz kötelező a tokenek tulajdonos-osztálya is:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"

libs/ruby/warp_engine/lib/warp_engine/configuration.rb

@@ -20,7 +20,7 @@ module WarpEngine
       @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
       @image_container_path          = ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
       @update_secret                 = ENV["UPDATE_SECRET"]
-      @update_secret_source          = :env
+      @update_secret_source          = ENV.fetch("UPDATE_SECRET_SOURCE", "env").to_sym
       @application_token_owner_class = nil
       @image_owners                  = []
     end