feat: secure organization provider credentials

hub/src/hub.ts

@@ -5,7 +5,10 @@ import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client
 import { makeTriggerHandler } from "./feishu/trigger.js";
 import { removeAbandonedMessageResourceStages } from "./feishu/resourceStaging.js";
 import { triggerQueue } from "./feishu/triggerQueue.js";
-import { createEnvRuntimeSettings } from "./settings/runtime.js";
+import { LocalSecretEnvelope, loadLocalSecretKeyring } from "./security/secretEnvelope.js";
+import { createDatabaseRuntimeSettings } from "./settings/runtime.js";
+import { verifyStoredProviderEnvelopes } from "./connections/providerConnections.js";
+import { openProviderProxyLease } from "./connections/providerProxy.js";
 import { readServerBinding } from "./settings/server.js";
 
 function requireEnv(name: string): string {
@@ -31,8 +34,25 @@ export async function startHub(): Promise<void> {
   const abandonedStages = await removeAbandonedMessageResourceStages(projectWorkspaceRoot);
   app.log.info({ removed: abandonedStages }, "startup: removed abandoned Feishu resource stages");
 
-  const runtimeSettings = createEnvRuntimeSettings();
-  await runtimeSettings.provider("openrouter");
+  const secretEnvelope = new LocalSecretEnvelope(await loadLocalSecretKeyring());
+  const verifiedProviderEnvelopes = await verifyStoredProviderEnvelopes(prisma, secretEnvelope);
+  app.log.info({ verified: verifiedProviderEnvelopes }, "startup: authenticated stored provider envelopes");
+  const runtimeSettings = createDatabaseRuntimeSettings(
+    prisma,
+    secretEnvelope,
+    process.env,
+    (credential, context) => openProviderProxyLease(credential, {
+      onDiagnostic: (diagnostic) => {
+        app.log.error({
+          runId: context.runId,
+          projectId: context.projectId,
+          providerId: context.providerId,
+          errorCode: diagnostic.code,
+          failureCategory: diagnostic.category,
+        }, "provider proxy diagnostic");
+      },
+    }),
+  );
 
   const feishuAppId = requireEnv("FEISHU_APP_ID");
   const feishuAppSecret = requireEnv("FEISHU_APP_SECRET");
@@ -58,6 +78,7 @@ export async function startHub(): Promise<void> {
     feishuAppId,
     feishuAppSecret,
     projectWorkspaceRoot,
+    secretEnvelope,
   });
 
   const address = await app.listen(bind);