cclohmar/NextMyDay
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(config): drop the dead secrets.session_key

Browse source 
REVIEW-001 (M0) L1c/L2s: secrets.session_key was validated and generated by
the wizard but never read by any code path — dead config (KISS).

Remove the field, its validation entry and its generation; the example notes
that a placeholder is replaced at startup in setup mode (M1s) as well as by
the wizard's finish.
This commit is contained in:
Claus Lohmar 2026-10-14 11:30:06 +00:00
parent f7d232950f
commit f5e4fd0055
4 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
config.example.yaml
View file

@ -29,8 +29,10 @@ database:
path: "./data/myday.db" # SQLite · WAL · foreign keys ON · one instance only
# ── secrets — generate strong random values; never commit (D-010) ────────────
# A placeholder is replaced with a strong value: at startup in setup mode
# (so the wizard's ceremony is never signed with a known key) and again by the
# wizard's `finish`. A restart adopts what `/setup` persisted.
secrets:
session_key: "CHANGE_ME_32_BYTES_RANDOM"
cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM" # A9 — TOTP secrets are encrypted at rest

4
internal/core/config/config.go
View file

@ -89,8 +89,9 @@ type Database struct {
}
// Secrets holds the symmetric key material (D-010). Never commit real values.
// The wizard generates a strong value for any field left at a placeholder
// (R-6); the startup path does the same in setup mode (M1s).
type Secrets struct {
SessionKey string `yaml:"session_key"`
CookieSecret string `yaml:"cookie_secret"`
CSRFKey string `yaml:"csrf_key"`
TOTPEncryptionKey string `yaml:"totp_encryption_key"` // A9
@ -236,7 +237,6 @@ func (c *Config) Validate() error {
}
for _, s := range []struct{ name, value string }{
{"secrets.session_key", c.Secrets.SessionKey},
{"secrets.cookie_secret", c.Secrets.CookieSecret},
{"secrets.csrf_key", c.Secrets.CSRFKey},
{"secrets.totp_encryption_key", c.Secrets.TOTPEncryptionKey},

4
internal/core/config/config_test.go
View file

@ -34,7 +34,6 @@ app:
database:
path: "./data/myday.db"
secrets:
session_key: "CHANGE_ME_32_BYTES_RANDOM"
cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"
@ -57,7 +56,6 @@ server:
database:
path: "./data/myday.db"
secrets:
session_key: "0123456789abcdef0123456789abcdef"
cookie_secret: "0123456789abcdef0123456789abcdef"
csrf_key: "0123456789abcdef0123456789abcdef"
totp_encryption_key: "0123456789abcdef0123456789abcdef"
@ -280,7 +278,7 @@ func TestMarshalRoundTrip(t *testing.T) {
App: config.App{Locale: "en-GB", Timezone: "Europe/London"},
Database: config.Database{Path: "./data/myday.db"},
Secrets: config.Secrets{
SessionKey: good, CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
},
Mail: config.Mail{Host: "smtp.example.com", Port: 587, From: "myday@example.com"},
Modules: map[string]bool{"time": true},

1
internal/core/setup/setup.go
View file

@ -376,7 +376,6 @@ func (a *Actions) generateSecrets(c *config.Config) (bool, error) {
dst *string
n int
}{
{"secrets.session_key", &c.Secrets.SessionKey, 32},
{"secrets.cookie_secret", &c.Secrets.CookieSecret, 32},
{"secrets.csrf_key", &c.Secrets.CSRFKey, 32},
} {