From 42bdfa25d3e2d195d49d88c65a304a24542ac0ab Mon Sep 17 00:00:00 2001 From: Inferencebot Date: Thu, 29 Oct 2026 04:19:17 +0000 Subject: [PATCH] portal: record that the admin-token cutover is complete (comment only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment above ADMIN_TOKEN still said "set ADMIN_TOKEN_LEGACY=0 and rotate both". Stale — and the direct reason a report claimed a rotation was outstanding: ADMIN_TOKEN was minted new and WEBHOOK_TOKEN rotated on 2026-10-27, and the legacy path was closed on 2026-10-28. Comment only, no behaviour change. Rebranched onto the current main: an earlier attempt had pinned an image built from a tree that predated the key-encryption work, which would have reverted it. --- app/main.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/main.py b/app/main.py index 9fe8fc4..6ddf76b 100644 --- a/app/main.py +++ b/app/main.py @@ -207,9 +207,12 @@ WEBHOOK_TOKEN = os.environ.get("WEBHOOK_TOKEN", "") # generic webhooks cannot send headers), so anything that learns that URL — an OC # admin, OC's logs, this app's own access logs, a Referer — used to gain portal # admin. ADMIN_TOKEN is only ever sent as a header and never appears in a URL. -# Cutover: while ADMIN_TOKEN_LEGACY is not "0" we also accept WEBHOOK_TOKEN on -# /admin/* so the admin panel, the scheduler and the digest scripts keep working. -# Set ADMIN_TOKEN everywhere, then set ADMIN_TOKEN_LEGACY=0 and rotate both. +# Cutover COMPLETE (2026-10-28): ADMIN_TOKEN_LEGACY=0, so the legacy token no +# longer authenticates here (verified: ADMIN_TOKEN -> 200, WEBHOOK_TOKEN -> 403). +# ADMIN_TOKEN was minted new on 2026-10-27 and WEBHOOK_TOKEN was rotated the same +# day, so NO rotation is outstanding — do not "finish" this by rotating again. +# Callers must read ADMIN_TOKEN and fail loudly; never fall back to WEBHOOK_TOKEN, +# which 403s and would turn a missing variable into a mid-run failure. ADMIN_TOKEN = os.environ.get("ADMIN_TOKEN", "") ADMIN_TOKEN_LEGACY = os.environ.get("ADMIN_TOKEN_LEGACY", "1") != "0"