From d0ce26c0a3719c0f084a598f22c0fa37121a0a28 Mon Sep 17 00:00:00 2001 From: Zsolt Tasnadi Date: Wed, 5 Aug 2026 18:53:04 +0200 Subject: [PATCH] Rename the update auth switch to application_token_source and drop its ENV default --- apps/api/config/initializers/warp_engine.rb | 2 +- libs/ruby/warp_engine/README.md | 5 ++--- .../app/controllers/warp_engine/update_controller.rb | 4 ++-- .../generators/warp_engine/install/templates/initializer.rb | 3 +-- libs/ruby/warp_engine/lib/warp_engine/configuration.rb | 6 +++--- .../warp_engine/spec/requests/update_controller_spec.rb | 4 ++-- 6 files changed, 11 insertions(+), 13 deletions(-) diff --git a/apps/api/config/initializers/warp_engine.rb b/apps/api/config/initializers/warp_engine.rb index 5574e30..cfe172e 100644 --- a/apps/api/config/initializers/warp_engine.rb +++ b/apps/api/config/initializers/warp_engine.rb @@ -3,7 +3,7 @@ Rails.application.config.to_prepare do WarpEngine.configure do |c| # A /update DB-tokenjeinek tulajdonosa. A :database módra váltás - # (c.update_secret_source = :database) csak azután jöhet, hogy a CI már + # (c.application_token_source = :database) csak azután jöhet, hogy a CI már # DB-tokent használ — az átkapcsolás azonnal érvényteleníti az UPDATE_SECRET-et. c.application_token_owner_class = "AdminUser" diff --git a/libs/ruby/warp_engine/README.md b/libs/ruby/warp_engine/README.md index 50bf172..768bbc4 100644 --- a/libs/ruby/warp_engine/README.md +++ b/libs/ruby/warp_engine/README.md @@ -184,9 +184,8 @@ Rails.application.config.to_prepare do # :database — only WarpEngine::ApplicationToken records with the # "update" scope are accepted; the shared secret stops # working the moment you switch. - # Defaults to ENV["UPDATE_SECRET_SOURCE"] (:env when unset). # :database mode also requires the owner class every token belongs to: - # c.update_secret_source = :database + # c.application_token_source = :database # c.application_token_owner_class = "AdminUser" # If your app's own models reference catalog images, register them so the @@ -225,7 +224,7 @@ deleted records are resurrected on re-ingest. ### Updater authentication The `X-Update-Secret` header (or the `?secret=` query param) carries one of -two credentials, selected by `update_secret_source` — the modes are +two credentials, selected by `application_token_source` — the modes are exclusive, the endpoint never accepts both: - **`:env`** (default): the single shared secret from `update_secret`. diff --git a/libs/ruby/warp_engine/app/controllers/warp_engine/update_controller.rb b/libs/ruby/warp_engine/app/controllers/warp_engine/update_controller.rb index dc4f6fa..d5c89b3 100644 --- a/libs/ruby/warp_engine/app/controllers/warp_engine/update_controller.rb +++ b/libs/ruby/warp_engine/app/controllers/warp_engine/update_controller.rb @@ -45,7 +45,7 @@ module WarpEngine token = request.headers["X-Update-Secret"].presence || params[:secret].presence return false if token.blank? - case WarpEngine.config.update_secret_source + case WarpEngine.config.application_token_source when :database then database_token_authorized?(token) else env_secret_authorized?(token) end @@ -59,7 +59,7 @@ module WarpEngine def database_token_authorized?(token) if WarpEngine.config.application_token_owner_class.blank? - Rails.logger.error("[UpdateController] update_secret_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva") + Rails.logger.error("[UpdateController] application_token_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva") return false end diff --git a/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb b/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb index 7636abc..5c7a26f 100644 --- a/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb +++ b/libs/ruby/warp_engine/lib/generators/warp_engine/install/templates/initializer.rb @@ -13,9 +13,8 @@ Rails.application.config.to_prepare do # :env — a fenti shared secret érvényes (default) # :database — csak DB-tárolt WarpEngine::ApplicationToken érvényes # ("update" scope-pal); a shared secret ilyenkor NEM működik. - # Default: ENV["UPDATE_SECRET_SOURCE"] (beállítatlanul :env). # A :database módhoz kötelező a tokenek tulajdonos-osztálya is: - # c.update_secret_source = :database + # c.application_token_source = :database # c.application_token_owner_class = "AdminUser" # Ha a host modelljei is hivatkoznak katalógus-képekre, regisztráld őket, diff --git a/libs/ruby/warp_engine/lib/warp_engine/configuration.rb b/libs/ruby/warp_engine/lib/warp_engine/configuration.rb index a32c003..ee30e86 100644 --- a/libs/ruby/warp_engine/lib/warp_engine/configuration.rb +++ b/libs/ruby/warp_engine/lib/warp_engine/configuration.rb @@ -4,7 +4,7 @@ module WarpEngine # label: String # image_ids: -> { Array } — az owner által használt image id-k # usage_label: ->(image) { String vagy nil } — megjelenítendő címke, ha használja - # update_secret_source: a /update endpoint hitelesítési forrása, kizárólagos. + # application_token_source: a /update endpoint hitelesítési forrása, kizárólagos. # :env — a shared secret (update_secret) érvényes, a DB-tokenek nem # :database — csak WarpEngine::ApplicationToken érvényes, a shared secret nem # application_token_owner_class: a tokenek kötelező tulajdonosának osztályneve @@ -12,7 +12,7 @@ module WarpEngine attr_accessor :file_container_path, :image_container_path, :update_secret, - :update_secret_source, + :application_token_source, :application_token_owner_class, :image_owners @@ -20,7 +20,7 @@ module WarpEngine @file_container_path = ENV.fetch("FILE_CONTAINER_PATH", "/softwares") @image_container_path = ENV.fetch("IMAGE_CONTAINER_PATH", "/images") @update_secret = ENV["UPDATE_SECRET"] - @update_secret_source = ENV.fetch("UPDATE_SECRET_SOURCE", "env").to_sym + @application_token_source = :env @application_token_owner_class = nil @image_owners = [] end diff --git a/libs/ruby/warp_engine/spec/requests/update_controller_spec.rb b/libs/ruby/warp_engine/spec/requests/update_controller_spec.rb index d730bd3..6bf8626 100644 --- a/libs/ruby/warp_engine/spec/requests/update_controller_spec.rb +++ b/libs/ruby/warp_engine/spec/requests/update_controller_spec.rb @@ -54,9 +54,9 @@ RSpec.describe "GET /update", type: :request do expect(response).to have_http_status(:unauthorized) end - context "with update_secret_source :database" do + context "with application_token_source :database" do before do - allow(WarpEngine.config).to receive(:update_secret_source).and_return(:database) + allow(WarpEngine.config).to receive(:application_token_source).and_return(:database) allow(WarpEngine.config).to receive(:application_token_owner_class).and_return("TestOwner") end