mirror of
https://github.com/we-promise/sure.git
synced 2026-05-24 13:04:56 +00:00
95f6451b39
* feat(sync): add Brex provider schema Adds Brex item and account tables with per-family credentials, scoped upstream account uniqueness, encrypted token storage, and sanitized provider payload columns. * feat(sync): add Brex provider core Adds Brex item/account models, provider client and adapter support, family connection helpers, and provider enum registration for read-only Brex cash and card data. * feat(sync): add Brex import pipeline Adds Brex account discovery, linked-account sync, cash/card balance processors, transaction import, sanitized metadata handling, and idempotent provider entry processing. * feat(sync): add Brex connection flows Adds Mercury-style Brex connection management, explicit item-scoped account selection and linking, settings provider UI, account index visibility, localized copy, and per-item cache handling. * test(sync): cover Brex provider workflows Adds targeted coverage for Brex provider requests, adapter config, item/account guards, importer behavior, entry processing, and Mercury-style controller flows. * fix(sync): align Brex API edge cases Tightens Brex account fetching against the official card-account response shape, sends transaction start filters as RFC3339 date-times, and keeps provider error bodies out of user-facing messages while expanding provider client guard coverage. * fix(sync): harden Brex provider integration Restrict Brex API base URLs to official hosts, tighten account-selection UI behavior, and add tests for invalid credentials, cache scoping, and provider setup edge cases. * test(sync): avoid Brex secret-shaped fixtures * refactor(sync): extract Brex account flows * fix(sync): address Brex provider review feedback * fix(sync): address Brex review follow-ups Move remaining Brex review cleanup into focused model behavior, tighten link/setup edge cases, localize summaries, and add regression coverage from CodeRabbit feedback. Also records the security-review pass as no-findings after diff-scoped inspection and Brakeman validation. * refactor(sync): split Brex account flow controllers Route Brex account selection and setup actions through small namespaced controllers while keeping existing URLs and helpers stable. Business flow remains in BrexItem::AccountFlow; the main Brex item controller now only handles connection CRUD, provider-panel rendering, destroy, and sync. * fix(sync): address Brex CodeRabbit review * fix(sync): address Brex follow-up review * fix(sync): address Brex review follow-ups * fix(sync): address Brex sync review findings * fix(sync): polish Brex review copy and errors * fix(sync): register Brex provider health * fix(sync): polish Brex bank sync presentation * fix(sync): address Brex review follow-ups * fix(sync): tighten Brex setup params * test(api): stabilize usage rate-limit window * fix(sync): polish Brex setup flow nits * fix(sync): harden Brex setup params * fix(sync): finalize Brex review cleanup --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>
40 lines
2.2 KiB
Ruby
40 lines
2.2 KiB
Ruby
require Rails.root.join("lib/active_record_encryption_config").to_s
|
|
|
|
# Configure Active Record encryption keys
|
|
# Priority order:
|
|
# 1. Environment variables (works for both managed and self-hosted modes)
|
|
# 2. Auto-generation from SECRET_KEY_BASE (self-hosted only, if credentials not present)
|
|
# 3. Rails credentials (fallback, handled in application.rb)
|
|
|
|
# Check if keys are provided via environment variables
|
|
primary_key = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"]
|
|
deterministic_key = ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"]
|
|
key_derivation_salt = ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"]
|
|
|
|
if ActiveRecordEncryptionConfig.partial_env?
|
|
raise ActiveRecordEncryptionConfig.partial_env_message
|
|
end
|
|
|
|
# If all environment variables are present, use them (works for both managed and self-hosted)
|
|
if ActiveRecordEncryptionConfig.complete_env?
|
|
Rails.application.config.active_record.encryption.primary_key = primary_key
|
|
Rails.application.config.active_record.encryption.deterministic_key = deterministic_key
|
|
Rails.application.config.active_record.encryption.key_derivation_salt = key_derivation_salt
|
|
elsif Rails.application.config.app_mode.self_hosted? && !Rails.application.credentials.active_record_encryption.present?
|
|
# For self-hosted instances without credentials or env vars, auto-generate keys
|
|
# Use SECRET_KEY_BASE as the seed for deterministic key generation
|
|
# This ensures keys are consistent across container restarts
|
|
secret_base = Rails.application.secret_key_base
|
|
|
|
# Generate deterministic keys from the secret base
|
|
primary_key = Digest::SHA256.hexdigest("#{secret_base}:primary_key")[0..63]
|
|
deterministic_key = Digest::SHA256.hexdigest("#{secret_base}:deterministic_key")[0..63]
|
|
key_derivation_salt = Digest::SHA256.hexdigest("#{secret_base}:key_derivation_salt")[0..63]
|
|
|
|
# Configure Active Record encryption
|
|
Rails.application.config.active_record.encryption.primary_key = primary_key
|
|
Rails.application.config.active_record.encryption.deterministic_key = deterministic_key
|
|
Rails.application.config.active_record.encryption.key_derivation_salt = key_derivation_salt
|
|
end
|
|
# If none of the above conditions are met, credentials from application.rb will be used
|