dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(delmia-notifier): optional ScadaBridge:ApiKey in appsettings.json as a fallback to SCADABRIDGE_API_KEY (env still wins); README/env inventory/design row updated

Browse Source 
The 2026-06-26 design kept the key env-only. The file is now an explicit fallback: SCADABRIDGE_API_KEY (non-blank) -> ScadaBridge:ApiKey (non-blank, trimmed) -> not configured. Env-only stays the recommended production posture; the failure message names both sources.

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB
This commit is contained in:
Joseph Doherty
2026-09-02 12:43:21 -04:00
parent 7dc30085be
commit 8adb09a083
8 changed files with 65 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
env_variables.md
+1 -1
View File
@@ -114,7 +114,7 @@ Resolution order per value: command-line flag → env var → `~/.scadabridge/co
| Variable | Scope | In appsettings? | Purpose | Potential values | Required |
|---|---|---|---|---|---|
| `SCADABRIDGE_API_KEY` | Runtime (client) | No — the notifier's `appsettings.json` holds only `BaseUrls`/`TimeoutSeconds`/`LogPath`; the key is **env-only by design** | Inbound API key sent as `X-API-Key`. Read only from the environment, never a file. Missing/empty → prints `API key not configured (SCADABRIDGE_API_KEY)`, exit `-1`, no HTTP attempt. | e.g. `sbk_...` | Yes |
| `SCADABRIDGE_API_KEY` | Runtime (client) | Yes — optional `ScadaBridge:ApiKey` fallback (2026-09-02); env wins | Inbound API key sent as `X-API-Key`. Environment first, file fallback (`ScadaBridge:ApiKey`, used only when the variable is unset/blank). Neither set → prints `API key not configured (SCADABRIDGE_API_KEY or ScadaBridge:ApiKey)`, exit `-1`, no HTTP attempt. | e.g. `sbk_...` | Yes |
> This is also why `System.Environment` is wholly forbidden in the script trust model — it would let a
> site/inbound script exfiltrate `SCADABRIDGE_API_KEY` and other host env secrets.