Introduce APP_SECRET to replace SECRETS

[FelixMalfait]

Context

We currently have 4 environment variables to specify our SECRETS in packages/twenty-server/.env:

• ACCESS_TOKEN_SECRET
• LOGIN_TOKEN_SECRET
• REFRESH_TOKEN_SECRET
• FILE_TOKEN_SECRET

We would like to replace those by a unique APP_SECRET env variable and to generate those 4 when needed as:

• ACCESS_TOKEN_SECRET=SHA256({APP_SECRET}+{workspaceId}+"ACCESS")
• LOGIN_TOKEN_SECRET=SHA256({APP_SECRET}+{workspaceId}+"FILE")
• ...

What & How

• Remove those 4 secrets from the code base
• introduce APP_SECRET instead (this needs to be introduced in several places, I would recommend look for ACCESS_TOKEN_SECRET and to mimick it)
• compute accessTokenSecret based on the formula above whenever it's needed

[charlesBochet]

I have updated the tickets desc, ready to be picked!

[charlesBochet]

/oss.gg 500

[oss-gg]

Thanks for opening an issue! It's live on oss.gg!

[charlesBochet]

@Devessier Let's go with sha as discussed together!

[vishnud05]

/assign

[oss-gg]

Assigned to @vishnud05! Please open a draft PR linking this issue within 48h ⚠️ If we can't detect a PR from you linking this issue in 48h, you'll be unassigned automatically 🕹️ Excited to have you ship this 🚀

[Fahad-Dezloper]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[riazahmedshah]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[oss-gg]

@vishnud05, Just a little reminder: Please open a draft PR linking this issue within 12 hours. If we can't detect a PR in 12h, you will be unassigned automatically.

[AbhishekKhot]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[BasitShafiq]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[mr-rayeen]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[amit-y11]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[charlesBochet]

/unassign

[oss-gg]

Issue unassigned.

[oss-gg]

Issue unassigned.

[HarshithAlfred]

/assign

[oss-gg]

Assigned to @HarshithAlfred! Please open a draft PR linking this issue within 48h ⚠️ If we can't detect a PR from you linking this issue in 48h, you'll be unassigned automatically 🕹️ Excited to have you ship this 🚀

[oss-gg]

@vishnud05, Just a little reminder: Please open a draft PR linking this issue within 12 hours. If we can't detect a PR in 12h, you will be unassigned automatically.

[oss-gg]

@HarshithAlfred, Just a little reminder: Please open a draft PR linking this issue within 12 hours. If we can't detect a PR in 12h, you will be unassigned automatically.

[oss-gg]

@amit-y11, Just a little reminder: Please open a draft PR linking this issue within 12 hours. If we can't detect a PR in 12h, you will be unassigned automatically.

[charlesBochet]

/unassign

[oss-gg]

Issue unassigned.

[Khaan25]

/assign

[oss-gg]

You already have an open issue assigned to you here. Once that's closed or unassigned, only then we recommend you to take up more.

[Khaan25]

If I'm not wrong, we'll have a function.

function generateSecret(workspaceId: string, type: 'ACCESS' | 'LOGIN' | 'REFRESH' | 'FILE'): string

Which is gonna return ${appSecret}${workspaceId}${type}

where appSecret = process.env.APP_SECRET
where workspaceId = we will pass it?

Please correct me if I'm wrong.

@FelixMalfait @Bonapara

[FelixMalfait]

@Khaan25 that's correct! Thank you

[devhiteshk]

/assign

[oss-gg]

This issue is already assigned to another person. Please find more issues here.

[Khaan25]

One quick question, @FelixMalfait,

I see some functions

They don't have workspaceId as prop, I believe we're gonna modify the function params to include it? Right?

[Khaan25]

Maybe we can make the workspaceId optional?
Could you please guide me here?

[FelixMalfait]

@Khaan25 no we don't want to make workspaceId optional, you should usually be able to retrieve it in the context (it's available at the resolver level usually since most API calls require to be logged in). Thanks

[charlesBochet]

@Khaan25 in some sign-in / sign-up cases, we indeed don't have the workspaceId available.

@FelixMalfait, we could either append the userId in this case or try to get the defaultWorkspaceId

[Khaan25]

Well, let's do defaultWorkspaceId, how do we get that?

there's workspaceRespository.getId() function but not sure if that's correct to use. I'll dig into further.
Is there any function or anything to get or we can pass userId?

@charlesBochet