mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(config): load one validated secret bundle

Browse Source
This commit is contained in:
marcopan
2026-07-12 11:06:19 +02:00
parent b539303002
commit 5fe74612fb
9 changed files with 255 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/pi/provider-credentials.ts
+21 -2
View File
@@ -101,11 +101,21 @@ export function buildPiChildEnv(opts: {
provider?: string;
credentialFile?: string;
additions?: NodeJS.ProcessEnv;
credentialValue?: string;
fsOps?: CredentialFsOps;
}): NodeJS.ProcessEnv {
const env = { ...(opts.ambient ?? process.env), ...opts.additions };
delete env.PI_PROVIDER_API_KEY;
delete env.THT_SECRETS_FILE;
delete env.THT_MODEL_API_KEY_FILE;
delete env.THT_DWH_API_KEY_SECRET_FILE;
delete env.THT_VEC_API_KEY_SECRET_FILE;
delete env.THT_VEC_WRITE_API_KEY_SECRET_FILE;
delete env.THT_CA_SECRET_FILE;
delete env.THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_READER_PASSWORD_SECRET_FILE;
delete env.THT_VECTOR_WRITER_PASSWORD_SECRET_FILE;
for (const name of PI_0803_CREDENTIAL_ENV_NAMES) delete env[name];
const provider = canonicalPiProvider(opts.provider);
if (provider && COMPOUND_PROVIDERS.has(provider)) {
@@ -116,8 +126,17 @@ export function buildPiChildEnv(opts: {
}
if (provider && !LOCAL_PROVIDERS.has(provider)) {
const envName = PROVIDER_KEY_ENV[provider];
if (!envName || !opts.credentialFile) throw new Error("model provider credential is unavailable");
env[envName] = readCredential(opts.credentialFile, opts.fsOps ?? realFs);
if (!envName || (!opts.credentialFile && opts.credentialValue === undefined)) {
throw new Error("model provider credential is unavailable");
}
if (opts.credentialValue !== undefined) {
if (!opts.credentialValue || /\s/.test(opts.credentialValue)) {
throw new Error("model provider credential is unavailable");
}
env[envName] = opts.credentialValue;
}
else if (opts.credentialFile) env[envName] = readCredential(opts.credentialFile, opts.fsOps ?? realFs);
else throw new Error("model provider credential is unavailable");
} else if (opts.credentialFile && !provider) {
throw new Error("model provider credential is unavailable");
}