From b2c780b69736bf8fdacccbe3aa517305f7b2a433 Mon Sep 17 00:00:00 2001
From: Zsolt Tasnadi <rastasi@gmail.com>
Date: Wed, 5 Aug 2026 18:46:49 +0200
Subject: [PATCH] db mode for update secrets

---
 docker-compose.yaml                                             | 1 +
 env-example                                                     | 2 ++
 libs/ruby/warp_engine/README.md                                 | 1 +
 .../lib/generators/warp_engine/install/templates/initializer.rb | 1 +
 libs/ruby/warp_engine/lib/warp_engine/configuration.rb          | 2 +-
 5 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 5f076a3..747c9c1 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -156,6 +156,7 @@ services:
       - DB_PORT=3306
       - DB_NAME=softwares
       - UPDATE_SECRET=${UPDATE_SECRET}
+      - UPDATE_SECRET_SOURCE=${UPDATE_SECRET_SOURCE:-env}
       - FILE_CONTAINER_PATH=/softwares
       - IMAGE_CONTAINER_PATH=/images
       - SECRET_KEY_BASE=${SECRET_KEY_BASE:-changeme_in_production_use_long_random_string}
diff --git a/env-example b/env-example
index d7167c3..06c0fc3 100644
--- a/env-example
+++ b/env-example
@@ -23,6 +23,8 @@ WOODPECKER_AGENT_SECRET=
 MYSQL_ROOT_PASSWORD=
 DB_PASSWORD=
 UPDATE_SECRET=
+# env (default, UPDATE_SECRET) vagy database (WarpEngine::ApplicationToken) — kizárólagos
+UPDATE_SECRET_SOURCE=
 DROP_PASSWORD=
 WEBAPP_WIKIJS_TOKEN=
 DISCORD_INVITE_LINK=
diff --git a/libs/ruby/warp_engine/README.md b/libs/ruby/warp_engine/README.md
index b9ae77b..50bf172 100644
--- a/libs/ruby/warp_engine/README.md
+++ b/libs/ruby/warp_engine/README.md
@@ -184,6 +184,7 @@ Rails.application.config.to_prepare do
     #   :database — only WarpEngine::ApplicationToken records with the
     #               "update" scope are accepted; the shared secret stops
     #               working the moment you switch.
+    # Defaults to ENV["UPDATE_SECRET_SOURCE"] (:env when unset).
     # :database mode also requires the owner class every token belongs to:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"
diff --git a/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb b/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb
index ea2cb88..7636abc 100644
--- a/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb
+++ b/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb
@@ -13,6 +13,7 @@ Rails.application.config.to_prepare do
     #   :env      — a fenti shared secret érvényes (default)
     #   :database — csak DB-tárolt WarpEngine::ApplicationToken érvényes
     #               ("update" scope-pal); a shared secret ilyenkor NEM működik.
+    # Default: ENV["UPDATE_SECRET_SOURCE"] (beállítatlanul :env).
     # A :database módhoz kötelező a tokenek tulajdonos-osztálya is:
     # c.update_secret_source = :database
     # c.application_token_owner_class = "AdminUser"
diff --git a/libs/ruby/warp_engine/lib/warp_engine/configuration.rb b/libs/ruby/warp_engine/lib/warp_engine/configuration.rb
index e629785..a32c003 100644
--- a/libs/ruby/warp_engine/lib/warp_engine/configuration.rb
+++ b/libs/ruby/warp_engine/lib/warp_engine/configuration.rb
@@ -20,7 +20,7 @@ module WarpEngine
       @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
       @image_container_path          = ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
       @update_secret                 = ENV["UPDATE_SECRET"]
-      @update_secret_source          = :env
+      @update_secret_source          = ENV.fetch("UPDATE_SECRET_SOURCE", "env").to_sym
       @application_token_owner_class = nil
       @image_owners                  = []
     end