systemprompt_cli/commands/admin/setup/secrets/
mod.rs

1//! Secret collection and persistence for the setup wizard.
2//!
3//! The `collect_*` functions gather the OAuth at-rest pepper, database URL, and
4//! AI-provider keys interactively or from flags; `save` writes the file with
5//! `0600` permissions on Unix. The data model and default-provider resolution
6//! live in `data`; the interactive prompts live in [`prompts`].
7//!
8//! Copyright (c) systemprompt.io — Business Source License 1.1.
9//! See <https://systemprompt.io> for licensing details.
10
11mod data;
12pub mod prompts;
13
14use anyhow::{Context, Result};
15use std::path::Path;
16use systemprompt_identifiers::ProviderId;
17use systemprompt_logging::CliService;
18
19use super::SetupArgs;
20use crate::CliConfig;
21use crate::interactive::Prompter;
22use crate::shared::generate_identity;
23use data::resolve_primary;
24use prompts::{resolve_interactive_primary, select_provider_keys};
25
26pub use data::SecretsData;
27
28pub(super) fn collect_non_interactive(
29    args: &SetupArgs,
30    config: &CliConfig,
31) -> Result<(SecretsData, Option<ProviderId>)> {
32    if !config.is_json_output() {
33        CliService::section("Secrets Setup");
34    }
35
36    let identity = generate_identity()?;
37    if !config.is_json_output() {
38        CliService::success(
39            "Generated OAuth at-rest pepper, manifest signing seed and signing key",
40        );
41    }
42
43    let secrets = SecretsData {
44        oauth_at_rest_pepper: identity.oauth_at_rest_pepper,
45        manifest_signing_secret_seed: Some(identity.manifest_signing_secret_seed),
46        signing_key_pem: Some(identity.signing_key_pem),
47        database_url: None,
48        gemini: args.gemini_key.clone(),
49        anthropic: args.anthropic_key.clone(),
50        openai: args.openai_key.clone(),
51        github: args.github_token.clone(),
52    };
53
54    validate_secrets(&secrets)?;
55    let primary = resolve_primary(args, &secrets)?;
56
57    if !config.is_json_output() {
58        CliService::success(&format!("Configured keys: {}", secrets.summary()));
59    }
60
61    Ok((secrets, primary))
62}
63
64pub(super) fn collect_interactive(
65    args: &SetupArgs,
66    prompter: &dyn Prompter,
67    env_name: &str,
68    _config: &CliConfig,
69) -> Result<(SecretsData, Option<ProviderId>)> {
70    CliService::section(&format!("Secrets Setup ({})", env_name));
71    CliService::info("At least one AI provider API key is required.");
72
73    let identity = generate_identity()?;
74    CliService::success("Generated OAuth at-rest pepper, manifest signing seed and signing key");
75
76    let mut secrets = SecretsData {
77        oauth_at_rest_pepper: identity.oauth_at_rest_pepper,
78        manifest_signing_secret_seed: Some(identity.manifest_signing_secret_seed),
79        signing_key_pem: Some(identity.signing_key_pem),
80        ..Default::default()
81    };
82
83    if args.has_ai_provider() {
84        args.gemini_key.clone_into(&mut secrets.gemini);
85        args.anthropic_key.clone_into(&mut secrets.anthropic);
86        args.openai_key.clone_into(&mut secrets.openai);
87        args.github_token.clone_into(&mut secrets.github);
88        CliService::success(&format!("Using provided keys: {}", secrets.summary()));
89        let primary = resolve_primary(args, &secrets)?;
90        return Ok((secrets, primary));
91    }
92
93    let explicit = select_provider_keys(prompter, &mut secrets)?;
94    validate_secrets(&secrets)?;
95    let primary = resolve_interactive_primary(prompter, explicit, &secrets)?;
96
97    CliService::success(&format!("Configured keys: {}", secrets.summary()));
98
99    Ok((secrets, primary))
100}
101
102fn validate_secrets(secrets: &SecretsData) -> Result<()> {
103    if secrets.oauth_at_rest_pepper.len() < 32 {
104        anyhow::bail!("OAuth at-rest pepper must be at least 32 characters");
105    }
106
107    if !secrets.has_ai_provider() {
108        anyhow::bail!(
109            "At least one AI provider API key is required.\n\n\
110             Provide one of:\n\
111             --gemini-key <KEY>     Google AI (Gemini)\n\
112             --anthropic-key <KEY>  Anthropic (Claude)\n\
113             --openai-key <KEY>     OpenAI (GPT)\n\n\
114             Or set environment variables:\n\
115             GEMINI_API_KEY, ANTHROPIC_API_KEY, or OPENAI_API_KEY"
116        );
117    }
118
119    Ok(())
120}
121
122pub(super) fn save(secrets: &SecretsData, secrets_path: &Path) -> Result<()> {
123    if let Some(parent) = secrets_path.parent() {
124        std::fs::create_dir_all(parent)
125            .with_context(|| format!("Failed to create directory {}", parent.display()))?;
126    }
127
128    let content = serde_json::to_string_pretty(secrets).context("Failed to serialize secrets")?;
129
130    std::fs::write(secrets_path, content)
131        .with_context(|| format!("Failed to write {}", secrets_path.display()))?;
132
133    #[cfg(unix)]
134    {
135        use std::os::unix::fs::PermissionsExt;
136        let permissions = std::fs::Permissions::from_mode(0o600);
137        std::fs::set_permissions(secrets_path, permissions)
138            .with_context(|| format!("Failed to set permissions on {}", secrets_path.display()))?;
139    }
140
141    CliService::success(&format!("Saved secrets to {}", secrets_path.display()));
142
143    Ok(())
144}
systemprompt_cli/commands/admin/setup/secrets/mod.rs

systemprompt_cli/commands/admin/setup/secrets/
mod.rs
