migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso-key fallback retained

b6135d4d2d71a22f9111b0923c3133e2261a8b80 · 2026-07-27 20:04:55 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M scripts/cncp-refresh.mjs

Diff

commit b6135d4d2d71a22f9111b0923c3133e2261a8b80
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 27 20:04:55 2026 -0700

    migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso-key fallback retained
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/cncp-refresh.mjs | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/scripts/cncp-refresh.mjs b/scripts/cncp-refresh.mjs
index cfb3eae..8b2eab8 100755
--- a/scripts/cncp-refresh.mjs
+++ b/scripts/cncp-refresh.mjs
@@ -115,7 +115,8 @@ async function fetchGoDaddyDomains() {
   // Load API creds from secrets manager .env
   let key = process.env.GODADDY_API_KEY;
   let secret = process.env.GODADDY_API_SECRET;
-  if (!key || !secret) {
+  let pat = process.env.GODADDY_PAT;
+  if (!key || !secret || !pat) {
     // Try secrets-manager .env file
     try {
       const envText = await fs.readFile(
@@ -124,19 +125,26 @@ async function fetchGoDaddyDomains() {
       );
       for (const line of envText.split("\n")) {
         const m = line.match(/^GODADDY_API_(KEY|SECRET)=(.+)$/);
-        if (!m) continue;
-        const val = m[2].replace(/^["']|["']$/g, "");
-        if (m[1] === "KEY") key = val;
-        else secret = val;
+        if (m) {
+          const val = m[2].replace(/^["']|["']$/g, "");
+          if (m[1] === "KEY") key = key || val;
+          else secret = secret || val;
+          continue;
+        }
+        const p = line.match(/^GODADDY_PAT=(.+)$/);
+        if (p && !pat) pat = p[1].replace(/^["']|["']$/g, "");
       }
     } catch {}
   }
-  if (!key || !secret) {
+  if (!pat && (!key || !secret)) {
     throw new Error(
-      "GoDaddy API creds not found. Set GODADDY_API_KEY and GODADDY_API_SECRET, " +
+      "GoDaddy API creds not found. Set GODADDY_PAT (preferred) or " +
+      "GODADDY_API_KEY and GODADDY_API_SECRET, " +
       "or place them in ~/Projects/secrets-manager/.env."
     );
   }
+  // Prefer a Bearer PAT when present (TK-10 key rotation); else legacy sso-key.
+  const GD_AUTH = pat ? `Bearer ${pat}` : `sso-key ${key}:${secret}`;
 
   const all = [];
   let marker = null;
@@ -146,7 +154,7 @@ async function fetchGoDaddyDomains() {
     if (marker) url.searchParams.set("marker", marker);
     const res = await fetch(url, {
       headers: {
-        Authorization: `sso-key ${key}:${secret}`,
+        Authorization: GD_AUTH,
         Accept: "application/json",
       },
     });

← 9cc6d6b feat(reconciler): skip stale-flagging for entries marked reg · back to Cncp Mcp · (newest)