Rename the update auth switch to application_token_source and drop its ENV default

apps/api/config/initializers/warp_engine.rb

@@ -3,7 +3,7 @@
 Rails.application.config.to_prepare do
   WarpEngine.configure do |c|
     # A /update DB-tokenjeinek tulajdonosa. A :database módra váltás
-    # (c.update_secret_source = :database) csak azután jöhet, hogy a CI már
+    # (c.application_token_source = :database) csak azután jöhet, hogy a CI már
     # DB-tokent használ — az átkapcsolás azonnal érvényteleníti az UPDATE_SECRET-et.
     c.application_token_owner_class = "AdminUser"
 

libs/ruby/warp_engine/README.md

@@ -184,9 +184,8 @@ Rails.application.config.to_prepare do
     #   :database — only WarpEngine::ApplicationToken records with the
     #               "update" scope are accepted; the shared secret stops
     #               working the moment you switch.
-    # Defaults to ENV["UPDATE_SECRET_SOURCE"] (:env when unset).
     # :database mode also requires the owner class every token belongs to:
-    # c.update_secret_source = :database
+    # c.application_token_source = :database
     # c.application_token_owner_class = "AdminUser"
 
     # If your app's own models reference catalog images, register them so the
@@ -225,7 +224,7 @@ deleted records are resurrected on re-ingest.
 ### Updater authentication
 
 The `X-Update-Secret` header (or the `?secret=` query param) carries one of
-two credentials, selected by `update_secret_source` — the modes are
+two credentials, selected by `application_token_source` — the modes are
 exclusive, the endpoint never accepts both:
 
 - **`:env`** (default): the single shared secret from `update_secret`.

libs/ruby/warp_engine/app/controllers/warp_engine/update_controller.rb

@@ -45,7 +45,7 @@ module WarpEngine
       token = request.headers["X-Update-Secret"].presence || params[:secret].presence
       return false if token.blank?
 
-      case WarpEngine.config.update_secret_source
+      case WarpEngine.config.application_token_source
       when :database then database_token_authorized?(token)
       else env_secret_authorized?(token)
       end
@@ -59,7 +59,7 @@ module WarpEngine
 
     def database_token_authorized?(token)
       if WarpEngine.config.application_token_owner_class.blank?
-        Rails.logger.error("[UpdateController] update_secret_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva")
+        Rails.logger.error("[UpdateController] application_token_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva")
         return false
       end
 

libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb

@@ -13,9 +13,8 @@ Rails.application.config.to_prepare do
     #   :env      — a fenti shared secret érvényes (default)
     #   :database — csak DB-tárolt WarpEngine::ApplicationToken érvényes
     #               ("update" scope-pal); a shared secret ilyenkor NEM működik.
-    # Default: ENV["UPDATE_SECRET_SOURCE"] (beállítatlanul :env).
     # A :database módhoz kötelező a tokenek tulajdonos-osztálya is:
-    # c.update_secret_source = :database
+    # c.application_token_source = :database
     # c.application_token_owner_class = "AdminUser"
 
     # Ha a host modelljei is hivatkoznak katalógus-képekre, regisztráld őket,

libs/ruby/warp_engine/lib/warp_engine/configuration.rb

@@ -4,7 +4,7 @@ module WarpEngine
     #   label:       String
     #   image_ids:   -> { Array<Integer> }         — az owner által használt image id-k
     #   usage_label: ->(image) { String vagy nil } — megjelenítendő címke, ha használja
-    # update_secret_source: a /update endpoint hitelesítési forrása, kizárólagos.
+    # application_token_source: a /update endpoint hitelesítési forrása, kizárólagos.
     #   :env      — a shared secret (update_secret) érvényes, a DB-tokenek nem
     #   :database — csak WarpEngine::ApplicationToken érvényes, a shared secret nem
     # application_token_owner_class: a tokenek kötelező tulajdonosának osztályneve
@@ -12,7 +12,7 @@ module WarpEngine
     attr_accessor :file_container_path,
                   :image_container_path,
                   :update_secret,
-                  :update_secret_source,
+                  :application_token_source,
                   :application_token_owner_class,
                   :image_owners
 
@@ -20,7 +20,7 @@ module WarpEngine
       @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
       @image_container_path          = ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
       @update_secret                 = ENV["UPDATE_SECRET"]
-      @update_secret_source          = ENV.fetch("UPDATE_SECRET_SOURCE", "env").to_sym
+      @application_token_source      = :env
       @application_token_owner_class = nil
       @image_owners                  = []
     end

libs/ruby/warp_engine/spec/requests/update_controller_spec.rb

@@ -54,9 +54,9 @@ RSpec.describe "GET /update", type: :request do
     expect(response).to have_http_status(:unauthorized)
   end
 
-  context "with update_secret_source :database" do
+  context "with application_token_source :database" do
     before do
-      allow(WarpEngine.config).to receive(:update_secret_source).and_return(:database)
+      allow(WarpEngine.config).to receive(:application_token_source).and_return(:database)
       allow(WarpEngine.config).to receive(:application_token_owner_class).and_return("TestOwner")
     end