feat: secure organization provider credentials

2026-07-10 22:04:43 +08:00
parent e049cb6880
commit 848f913597
51 changed files with 3280 additions and 230 deletions
@@ -10,8 +10,10 @@
 * Org admin (ADR-0021): Feishu OAuth session + `/api/org/:orgSlug/*`.
 *
 * Env (see .env.example):
- *  DATABASE_URL, ANTHROPIC_AUTH_TOKEN, FEISHU_APP_ID/SECRET/BOT_OPEN_ID, PORT,
- *  HUB_PROJECT_WORKSPACE_ROOT, HUB_SESSION_SECRET, HUB_PUBLIC_BASE_URL
+ *  DATABASE_URL, FEISHU_APP_ID/SECRET/BOT_OPEN_ID, PORT,
+ *  HUB_PROJECT_WORKSPACE_ROOT, HUB_SESSION_SECRET, HUB_PUBLIC_BASE_URL.
+ * Provider credentials are org-scoped encrypted records; production receives
+ * the local master-key keyring only through systemd CREDENTIALS_DIRECTORY.
 */
 import "dotenv/config";
 import { startHub } from "./hub.js";