`update-viewer/update-items.json`

118 lines
{
  "title": "Credentials & Tokens — Update Tracker",
  "origin": "2026-05-30 Kamatera compromise + ongoing token hygiene",
  "items": [
    {
      "id": "dw-admin-pg",
      "title": "PostgreSQL dw_admin password",
      "type": "db-password",
      "severity": "P1",
      "status": "outstanding",
      "gates": "Kamatera deploy (the do-not-deploy flag clears only after this)",
      "exposed": "hardcoded cleartext in 14+ files (scrubbed); Time Machine / Spotlight / possibly remote git history",
      "mintUrl": null,
      "console": [
        "Mint new ≥20-char pw (openssl rand -base64 24)",
        "Kamatera: ssh root@45.61.58.125 → sudo -u postgres psql -c \"ALTER ROLE dw_admin WITH PASSWORD '<NEW>';\"",
        "Local Mac2: psql -U postgres -c \"ALTER ROLE dw_admin WITH PASSWORD '<NEW>';\""
      ],
      "routeBack": "printf 'DW_ADMIN_DB_PASSWORD=<NEW>' | node ~/Projects/secrets-manager/cli.js import-paste",
      "restart": "local: pm2 restart wallco-ai-9905  |  Kamatera: pm2 restart all --update-env",
      "verify": "node ~/Projects/secrets-manager/cli.js check",
      "claudeCanRun": ["routeBack", "restart-local", "verify"]
    },
    {
      "id": "gemini-1",
      "title": "Gemini API key #1",
      "type": "api-key",
      "severity": "P2",
      "status": "outstanding",
      "gates": null,
      "exposed": "hardcoded in 7 Patty routes + 3 DW docs",
      "mintUrl": "https://aistudio.google.com/apikey",
      "console": ["Create new key, DELETE the old one in the same console"],
      "routeBack": "printf 'GEMINI_API_KEY=<NEW>' | node ~/Projects/secrets-manager/cli.js import-paste",
      "restart": null,
      "verify": "node ~/Projects/secrets-manager/cli.js check  (hits Gemini /models)",
      "claudeCanRun": ["routeBack", "verify"]
    },
    {
      "id": "gemini-2",
      "title": "Gemini API key #2",
      "type": "api-key",
      "severity": "P2",
      "status": "outstanding",
      "gates": null,
      "exposed": "hardcoded in PoppyPetitions/lib/gemini.ts",
      "mintUrl": "https://aistudio.google.com/apikey",
      "console": ["Create new key, delete old", "confirm KEY_NAME against routes.json (GEMINI_API_KEY_RALPH or poppy-specific)"],
      "routeBack": "printf '<KEY_NAME>=<NEW>' | node ~/Projects/secrets-manager/cli.js import-paste",
      "restart": null,
      "verify": "node ~/Projects/secrets-manager/cli.js check",
      "claudeCanRun": ["routeBack", "verify"]
    },
    {
      "id": "norma-scoped",
      "title": "Norma sdcc scoped PG user (norma_app_user)",
      "type": "db-scoped-role",
      "severity": "P3 (optional)",
      "status": "outstanding",
      "gates": null,
      "exposed": "Norma currently connects as shared dw_admin on local sdcc; this moves it to least-privilege (does NOT fix dw_admin)",
      "mintUrl": null,
      "console": ["~/Projects/_shared/scripts/rotate-pg-scoped.sh ~/Projects/Norma sdcc norma_app_user NORMA_APP_DB_PASSWORD  (LOCAL only, interactive: type new ≥16-char pw twice)"],
      "routeBack": "handled by the script",
      "restart": "pm2 restart norma-*",
      "verify": "node ~/Projects/secrets-manager/cli.js check",
      "claudeCanRun": []
    },
    {
      "id": "cfg-dw-agents",
      "title": "DW-Agents ecosystem.config.js → env-first DSN",
      "type": "config-fix",
      "severity": "prep",
      "status": "done",
      "gates": null,
      "exposed": "inline DSN wouldn't pick up rotated pw; fixed to process.env.DATABASE_URL || …",
      "mintUrl": null,
      "console": [],
      "routeBack": null,
      "restart": null,
      "verify": "committed f9a7548 on rotation-prestage",
      "claudeCanRun": []
    },
    {
      "id": "cfg-archive-agent",
      "title": "archive-agent ecosystem.config.js DSN",
      "type": "config-fix",
      "severity": "prep",
      "status": "done",
      "gates": null,
      "exposed": "already env-first (no pw literal)",
      "mintUrl": null,
      "console": [],
      "routeBack": null,
      "restart": null,
      "verify": "verified env-first",
      "claudeCanRun": []
    }
  ],
  "toConfigure": [
    { "name": "ANTHROPIC_API_KEY", "desc": "Anthropic API Key", "mintUrl": "https://console.anthropic.com/settings/keys" },
    { "name": "GEMINI_API_KEY_RALPH", "desc": "Gemini key — Letsbegin Ralph runner (rotation #2 target)", "mintUrl": "https://aistudio.google.com/apikey" },
    { "name": "RESEND_API_KEY", "desc": "Resend transactional email — wallco.ai magic-link sign-in", "mintUrl": "https://resend.com/api-keys" },
    { "name": "MAIL_FROM", "desc": "From identity for transactional email (must match verified Resend domain)", "mintUrl": null },
    { "name": "VERCEL_TOKEN", "desc": "Vercel API Token", "mintUrl": "https://vercel.com/account/tokens" },
    { "name": "HEYGEN_API_KEY", "desc": "HeyGen talking-head avatar render (session-debrief skill)", "mintUrl": "https://app.heygen.com/settings" },
    { "name": "STRIPE_WEBHOOK_SECRET", "desc": "Stripe Webhook Signing Secret", "mintUrl": "https://dashboard.stripe.com/webhooks" },
    { "name": "STRIPE_RESTRICTED_KEY", "desc": "Stripe Restricted Key (site-factory)", "mintUrl": "https://dashboard.stripe.com/apikeys" },
    { "name": "SHOPIFY_API_KEY", "desc": "Shopify API Key", "mintUrl": "https://admin.shopify.com" },
    { "name": "GOOGLE_PLACES_API_KEY", "desc": "Google Places API Key", "mintUrl": "https://console.cloud.google.com/apis/credentials" },
    { "name": "NEXT_PUBLIC_GOOGLE_MAPS_API_KEY", "desc": "Google Maps JS Key (browser-exposed; set HTTP-referrer restrictions)", "mintUrl": "https://console.cloud.google.com/apis/credentials" },
    { "name": "NPH_GOOGLE_OAUTH_CLIENT_ID", "desc": "Google OAuth Client ID — buyer sign-in on National Paper Hangers", "mintUrl": "https://console.cloud.google.com/apis/credentials" },
    { "name": "NPH_GOOGLE_OAUTH_CLIENT_SECRET", "desc": "Google OAuth Client Secret — National Paper Hangers", "mintUrl": "https://console.cloud.google.com/apis/credentials" },
    { "name": "GEORGE_AUTH", "desc": "George Gmail Basic Auth (DW microsite leads)", "mintUrl": null },
    { "name": "GOOGLE_GENERATIVE_AI_API_KEY", "desc": "alias of GEMINI_API_KEY (set if a lib expects this name)", "mintUrl": null }
  ]
}