From 0f9fd0477487332d38999a9fa572d39f13cec394 Mon Sep 17 00:00:00 2001
From: Cedric van Putten <github@cedric.dev>
Date: Mon, 20 Nov 2023 16:36:16 +0100
Subject: [PATCH] refactor(snackager): rotate secrets and use proper access
 token for git imports

---
 snackager/.env-cmdrc.js                        |   2 +-
 snackager/k8s/production/secrets/snackager.env | Bin 267 -> 323 bytes
 snackager/k8s/staging/secrets/snackager.env    | Bin 267 -> 323 bytes
 snackager/src/git.ts                           |   4 +++-
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/snackager/.env-cmdrc.js b/snackager/.env-cmdrc.js
index 16ad1562..df93f3f5 100644
--- a/snackager/.env-cmdrc.js
+++ b/snackager/.env-cmdrc.js
@@ -16,7 +16,7 @@ module.exports = (async function () {
 
   delete stagingSecrets['REDIS_URL']; // this is set above for the proxy
 
-  if (!stagingSecrets.GIT_SESSION_SECRET && !processArgs.includes('env-cmd -e test')) {
+  if (!stagingSecrets.EXPO_GIT_TOKEN && !processArgs.includes('env-cmd -e test')) {
     console.error(
       'Secrets are locked, unable to start Snackager. External contributors cannot start Snackager and can ignore this error. snack-proxies will redirect traffic to the Snackager service running on the staging environment.\n'
     );
diff --git a/snackager/k8s/production/secrets/snackager.env b/snackager/k8s/production/secrets/snackager.env
index 046204b9bf8837b075fb5c8dd4c4f93db9a91dea..61eab245d4785098715e8f372f3a110adb267324 100644
GIT binary patch
literal 323
zcmV-J0lfYIM@dveQdv+`0KF#qW$1;;%XG6x_5$<$)8M=giPv0x50Yk9n@qx;q`X+*
zzazGDNlk9ob^TR@LSUuSfW3$auwuNFWYN4TC-5;J82p&4wv&@57{zBoqPkhGi}V(k
zk0=-Q$(e~IYV>b|)wONH0`ch-vsBVGS*T*%%GDJw>n6?nLnFwzA47^0MCtiL-at#9
z3yMz&p^zr0Gq9h9DqTH^bFg@@uX<w)Ucy1yV<Zv-e99}HbQrVJhft`>#>$}N83I<`
z{;p*;gyp$vZ|%KJnr>K86&Spv!J-WJd+lZ|<dz~FGt~pRi>T4cnan_BA614Ek-C~e
z2e0h2{M@DN!7k#7$V05Dab>;ou4bt~y0^_nRdbV6ZhpN-JZiRC+YSNGY(mrvbcJ^E
VqK=-X<|u}Rc3Vx)K8gE`eUN)Zr2_x}

literal 267
zcmV+m0rdU=M@dveQdv+`0AY*im%Fqg$n=2!R_g!WR+1Pd>_d<6b4_(<YoqIAcC)vn
zpB)0m9@+A^+}!*A&6u)V1WD5FEatCv$`EMyL<=TxLKgG4zvnCcHpx4z{!RmNp>%;V
zdz~|9YTv3iJ+{Lf2`u?{(w2BjL6w<_&0!@{B>7_tk{o%h4<$kvbgRVaNZklbO4_}4
z-S&ZJ`khKzzRDdj3$Z$4cNCxO{Mo4T1%LRVtCvn<^9ep$<m4>xktu6@9XWWxsZjXQ
z$h0xXiz6iE1&#o$<r{>AHz&C|6Y=|r>U7Z*0vpVtf7*jtSN1m$$X^Lgp<yeviiJ6_
RIO4Wm?^5YBLT*ET0Bs>(g>V1>

diff --git a/snackager/k8s/staging/secrets/snackager.env b/snackager/k8s/staging/secrets/snackager.env
index 222cd854b2e5632163278fcfba3d8bfb56135fa2..7ceb45638cbbbb6a6f49622bd144e7dcfdc42fa4 100644
GIT binary patch
literal 323
zcmV-J0lfYIM@dveQdv+`06ykhNTRUl`A!xc2h3v0xW7ehjuE?;9v1JNfm&Cv5Qia^
zuLwHo8g<*ocGm>EuP(<t%{bCnjN~Oa>_tBNQ!Z{nW9(gRPOb@;$-`*7N1n6_jUMEY
zr9`nk-nxU~2_LNje-&{s0nZ4sQsH8%!a56Tf;lEXngewOt(p>|tOo$ZQ0G#=<~dE)
zLtYMkVTTPP{qSy4Uox@E=q;k4Rgvg)ghHxNM_oAjMaMm`2DmQRy0<fLi(X6fE>uS|
zwu1bO#)Nwy@p1bq3vm!CFP!kWCu18RVXG#ZaKl7((cY~C^i)|bW?J0UVN2j#G?G!Y
zQ2mh^I?QW2*0%$!|KYgg*c(46C7*+oYS@zHKwn&CsmY{;UW%b2(3`>bOHApT)W=j^
Vf@3UF{Lg<-<bA@DAUkKc(*40_nyml;

literal 267
zcmV+m0rdU=M@dveQdv+`0JibgOtOCO1+d_u-R;eg>nSLC5WliD{-+&Fwi7%QAOACp
zKgnox==2JhLjEWc_%Mo1S#VEr8LDKX5d*!OrVbp@fS<A6J&56TQZ?7L_PmqCX7LQa
zC7`yUB#bn@wtx`VQ%M%1iM+5qYcn{wWFmO=w+5?{jc5DoLAfy1?A(DKU1?^JY~I_7
z!to~}GdZ8;)Io?f4BEX-BdnK<UBO<#mqcK;A00#Z45)1AL74uaIIWLFd%Dd$*1BUO
zw-(WD&{Xo%50_x07pks(057iHtFcPUY>COY`0hqP|6BkkF~~I8R%MMz(^uadT78b#
Rp51c;TNJ}J!H)$Gt*hAEgy#SN

diff --git a/snackager/src/git.ts b/snackager/src/git.ts
index 57e1398b..35e1f9f7 100644
--- a/snackager/src/git.ts
+++ b/snackager/src/git.ts
@@ -113,7 +113,9 @@ export async function importAsync(options: Config): Promise<string> {
     sdkVersion,
     name,
     description,
-    user: { sessionSecret: process.env.GIT_SESSION_SECRET },
+    user: {
+      accessToken: process.env.EXPO_GIT_TOKEN,
+    },
   });
 
   logger.info(options, 'saving repository');