← back to Credentials Agentabrams

data/credentials.json

118 lines

{
  "meta": {
    "title": "Credential Actions — agentabrams",
    "umbrella_ticket": "TK-11786",
    "source": "~/Projects/secrets-manager/ROTATION-CHECKLIST.md",
    "note": "Every credential/secret that Steve must personally rotate or supply. Console-only actions are Steve's; Claude cannot mint keys or run prod credential changes. No secret VALUES stored here — only key names, mint URLs, and route-back commands.",
    "generated_at": "2026-09-22T17:48:00-07:00"
  },
  "items": [
    {
      "id": "dw-admin-pg-pw",
      "title": "PG dw_admin password",
      "priority": "P1",
      "status": "OUTSTANDING",
      "class": "console-only",
      "created_at": "2026-05-30T00:00:00-07:00",
      "origin": "2026-05-30 Kamatera compromise",
      "exposed": "Old plaintext still live in 4 local .env.local DATABASE_URL DSNs; apps connect cleanly → dw_admin role still uses the compromised pw.",
      "runbook": "~/Projects/_shared/docs/pg-rotation-runbook.md",
      "mint_url": null,
      "console_steps": "Pick new ≥20-char pw → ALTER ROLE dw_admin WITH PASSWORD on prod Kamatera (sudo -u postgres psql) AND local Mac2 → restart pm2 fleet → fan out.",
      "route_back": "NOT a `secrets add` key — dw_admin is embedded inline inside DATABASE_URL across ~40 pm2 apps + ~80 scripts (found by grepping for the OLD PASSWORD VALUE, not a var name). The runbook's own Step 2 script does the fan-out (search-and-replace across every .env). DW_ADMIN_DB_PASSWORD is unregistered in routes.json BY DESIGN — registering it generically would not correctly rewrite all those embedded DSNs. Follow the runbook exactly.",
      "verify": "node ~/Projects/secrets-manager/cli.js check",
      "why": "dw_admin is the shared admin used by wallco, the DW fleet, Norma sdcc, etc. Stays compromised until this runs. ~32 min operation covering local + Kamatera."
    },
    {
      "id": "gemini-key-1",
      "title": "Gemini API key #1 (Patty)",
      "priority": "P2",
      "status": "OUTSTANDING",
      "class": "console-mint",
      "created_at": "2026-06-01T00:00:00-07:00",
      "exposed": "Hardcoded in 7 Patty routes + 3 DW docs.",
      "runbook": null,
      "mint_url": "https://aistudio.google.com/apikey",
      "console_steps": "Create new key, DELETE the old one in the same console.",
      "route_back": "printf 'GEMINI_API_KEY_PATTY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste  (registered 2026-09-23 → fans to ~/Projects/Patty/.env.local as GEMINI_API_KEY)",
      "verify": "node ~/Projects/secrets-manager/cli.js check (hits Gemini /models)",
      "why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach Patty) — fixed 2026-09-23."
    },
    {
      "id": "gemini-key-2",
      "title": "Gemini API key #2 (PoppyPetitions)",
      "priority": "P2",
      "status": "OUTSTANDING",
      "class": "console-mint",
      "created_at": "2026-06-01T00:00:00-07:00",
      "exposed": "Hardcoded in PoppyPetitions/lib/gemini.ts.",
      "runbook": null,
      "mint_url": "https://aistudio.google.com/apikey",
      "console_steps": "Create new key, DELETE the old one in the same console.",
      "route_back": "printf 'GEMINI_API_KEY_POPPY=<NEW_KEY>' | node ~/Projects/secrets-manager/cli.js import-paste  (registered 2026-09-23 → fans to ~/Projects/PoppyPetitions/.env.local as GEMINI_API_KEY)",
      "verify": "node ~/Projects/secrets-manager/cli.js check",
      "why": "Exposed key on-disk; rotate + delete old. Route was previously UNREGISTERED (master GEMINI_API_KEY doesn't reach PoppyPetitions) — fixed 2026-09-23."
    },
    {
      "id": "repl-user-pg-pw",
      "title": "PG repl_user replication password",
      "priority": "P2",
      "status": "OUTSTANDING",
      "class": "console-only",
      "created_at": "2026-06-03T00:00:00-07:00",
      "exposed": "Lost (not leaked) — removed when the broken subscription was dropped 2026-06-03. dw_unified mirror stays frozen until reset.",
      "runbook": "~/cncp-starter/yolo-queue/pending-approval/mirror-resync-FIX.md",
      "mint_url": null,
      "console_steps": "On Kamatera publisher: ALTER ROLE repl_user WITH PASSWORD; clear stray legacy table from publication dw_unified_pub.",
      "route_back": "NOT a `secrets add` key — the new password is passed directly as an env var to the resync script (see verify), not fanned to any .env file. REPL_USER_DB_PASSWORD is intentionally unregistered in routes.json.",
      "verify": "REPL_PW=<NEW_PW> bash ~/cncp-starter/yolo-queue/run-mirror-resync.sh — max(synced_at) jumps to now",
      "why": "Unblocks the frozen dw_unified mirror (Vendors/edges/settlement panels)."
    },
    {
      "id": "shopify-admin-token",
      "title": "SHOPIFY_ADMIN_TOKEN (revoke leaked 7d19)",
      "priority": "P1",
      "status": "IN PROGRESS",
      "class": "console-mint",
      "created_at": "2026-09-22T00:00:00-07:00",
      "exposed": "TK-12015 (2026-09-22): token shpat_…7d19 (app '81026 API', Dev Dashboard) LEAKED via pm2 env dump. NEW token shpat_…6755 (custom app, STORE ADMIN) minted 2026-09-23, verified LIVE (HTTP 200), routed locally + deployed to Kamatera prod. Fleet now runs on 6755. BUT: the OLD leaked 7d19 is STILL LIVE — uninstalling the '81026 API' app REVOKES it (zero downtime, fleet already on 6755).",
      "runbook": "~/.claude/yolo-queue/pending-approval/TK-12015-rotate-shopify-admin-token-7d19.md",
      "mint_url": null,
      "console_steps": "Shopify store admin → Settings → Apps → Develop apps → find '81026 API' → uninstall. Then re-test: curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json → expect 401 (token dead).",
      "route_back": "(NEW token already routed 2026-09-23; only revoke remains)",
      "verify": "curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json — expect {\"errors\":\"[API] Invalid API key or access token\"} (HTTP 401)",
      "why": "Leaked token MUST be revoked, not just replaced. The fleet is safe on 6755. Uninstalling '81026 API' kills 7d19 cleanly with NO downtime."
    },
    {
      "id": "shopify-admin-token-new",
      "title": "SHOPIFY_ADMIN_TOKEN (new 6755)",
      "priority": "P1",
      "status": "CONNECTED",
      "class": "console-mint",
      "created_at": "2026-09-23T00:00:00-07:00",
      "exposed": "Replacement full-access token shpat_…6755 minted in the STORE ADMIN custom app.",
      "runbook": null,
      "mint_url": null,
      "console_steps": "Verified LIVE (HTTP 200, shop id 1541177456), routed to 6 local dests + alias, deployed to Kamatera /root/DW-Agents/.env + pm2 reload.",
      "route_back": "node ~/Projects/secrets-manager/cli.js add SHOPIFY_ADMIN_TOKEN …6755 (done)",
      "verify": "curl -s -H 'X-Shopify-Access-Token: shpat_…6755' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json → HTTP 200",
      "why": "The live working token the fleet now runs on. Connected 2026-09-23."
    },
    {
      "id": "slack-bot-token",
      "title": "SLACK_BOT_TOKEN",
      "priority": "P2",
      "status": "CONNECTED",
      "class": "console-mint",
      "created_at": "2026-09-22T00:00:00-07:00",
      "exposed": "Old xoxb-…jpmsq was in tracked source (ecosystem.config.cjs, git history).",
      "runbook": "~/.claude/yolo-queue/pending-approval/tk11786-rotate-exposed-secrets.md",
      "mint_url": "https://api.slack.com/apps",
      "console_steps": "Rotated by Steve → new token ends …OlqR, verified LIVE via auth.test (ok:true, team Designerwallcoverings, bot dw_reports_bot). Left: confirm old …jpmsq is revoked in Slack app admin + push new token to Kamatera prod.",
      "route_back": "node ~/Projects/secrets-manager/cli.js add SLACK_BOT_TOKEN …OlqR (done)",
      "verify": "curl -s -H 'Authorization: Bearer <token>' https://slack.com/api/auth.test → ok:true",
      "why": "Rotated + verified live this session. Connected 2026-09-22."
    }
  ]
}