@elytracms/studio 0.0.96 → 0.0.98

package/convex/ingest.test.ts

@@ -6,6 +6,7 @@ import {
   INGEST_MAX_BODY_BYTES,
   INGEST_RECEIVER_PATH,
   INGEST_SIGNATURE_HEADER,
+  ingestUploadSha256,
   signedIngestRequest,
 } from '@elytracms/core/ingest'
 import type { IngestHandlerResult, IngestPayload } from '@elytracms/core/ingest'
@@ -13,7 +14,15 @@ import { defineRecordKind } from '@elytracms/core/persistence'
 import schema from './schema'
 import { internalMutation } from './functions'
 import { defineStudioHttp } from './http'
-import { claimIngestUpload, ingestHandlerArgs, parseIngestPayload, recordIngestUpload, unclaimedIngestUploads } from './ingest'
+import { CONVEX_MAX_NESTING_DEPTH, measureMaxDepth } from '@elytracms/core/cms-core'
+import {
+  claimIngestUpload,
+  ingestHandlerArgs,
+  parseIngestPayload,
+  recordIngestUpload,
+  releaseIngestUploads,
+  unclaimedIngestUploads,
+} from './ingest'
 import type { IngestHandlerRef } from './ingest'
 import { saveRecord } from './record-functions'
 import { createIngestRoute } from '../../next/src/ingest'
@@ -178,6 +187,27 @@ async function storeFile(t: ReturnType<typeof backend>, bytes: number, contentTy
   })
 }
 
+/** EC-685: the SHA-256 an upload declares for the zero-filled `bytes` bytes {@link storeFile} stores. */
+async function sha256Of(bytes: number): Promise<string> {
+  const digest = await ingestUploadSha256(new Uint8Array(bytes))
+  if (!digest.ok) throw new Error(digest.message)
+  return digest.sha256
+}
+
+/** Whether stored bytes exist (`storage.get` yields a Blob, which is not a Convex value: answer a boolean). */
+function stored(t: ReturnType<typeof backend>, storageId: string): Promise<boolean> {
+  return t.run(async (ctx) => (await ctx.storage.get(storageId as never)) !== null)
+}
+
+/** An upload intent's claim columns, as stored. */
+function intentState(t: ReturnType<typeof backend>, uploadId: string) {
+  return t.run(async (ctx) => {
+    const row = (await ctx.db.query('records').collect()).find((r) => r.kind === 'ingestUpload' && r.recordId === uploadId)
+    const data = row?.data as { state?: string; storageId?: string } | undefined
+    return { state: data?.state, storageId: data?.storageId }
+  })
+}
+
 /** Sign an arbitrary raw body (for the invalid-shape case the typed builder refuses to build). */
 async function signedIngestRequestRaw(raw: string): Promise<string> {
   const { signRevalidationBody } = await import('@elytracms/core/revalidation')
@@ -243,7 +273,7 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
   it('an upload the handler accepts gets ONE storage URL and an upload id; one it refuses gets none', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    const upload = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
+    const upload = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500, sha256: await sha256Of(500) } as const
     const issued = await signedPost(t, upload)
     expect(issued.status).toBe(200)
     const body = (await issued.json()) as { uploadId: string; uploadUrl: string; expiresInSeconds: number }
@@ -252,32 +282,56 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
     expect(body.expiresInSeconds).toBe(3600)
     expect((await signedPost(t, { ...upload, size: 5000 })).status).toBe(413) // the handler's policy
     expect((await signedPost(t, { ...upload, contentType: 'application/x-msdownload' })).status).toBe(415)
+    // EC-685: the intent records the declared digest (what the claim compares).
+    const intent = await t.run(async (ctx) => (await ctx.db.query('records').collect()).find((row) => row.recordId === body.uploadId))
+    expect((intent!.data as { sha256: string }).sha256).toBe(upload.sha256)
+  })
+
+  it('EC-685 wire: an upload that declares no sha256, or one in another encoding, is a 400 — no intent, no URL', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const base = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
+    const hex = await sha256Of(500)
+    for (const payload of [base, { ...base, sha256: hex.toUpperCase() }, { ...base, sha256: hex.slice(1) }]) {
+      const raw = JSON.stringify(payload)
+      const answer = await t.fetch(INGEST_RECEIVER_PATH, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', [INGEST_SIGNATURE_HEADER]: await signedIngestRequestRaw(raw) },
+        body: raw,
+      })
+      expect(answer.status, raw).toBe(400) // the receiver's union (payload | probe) reports it at the root; the route's read names `sha256` (core test)
+    }
+    expect(await t.run(async (ctx) => (await ctx.db.query('records').collect()).length)).toBe(0)
+    // Control: the declared lowercase hex is accepted.
+    expect((await signedPost(t, { ...base, sha256: hex })).status).toBe(200)
   })
 
-  it('a submission claims its upload: the stored file must match the declaration; a mismatch is deleted', async () => {
+  it('a submission claims its upload: the stored file must match the declaration; a mismatch is refused, never deleted', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    const declare = async (contentType: string, size: number) =>
-      ((await (await signedPost(t, { kind: 'upload', target: 'contact', field: 'cv', contentType, size })).json()) as {
+    const declare = async (contentType: string, size: number, bytesOf: number) =>
+      ((await (await signedPost(t, { kind: 'upload', target: 'contact', field: 'cv', contentType, size, sha256: await sha256Of(bytesOf) })).json()) as {
         uploadId: string
       }).uploadId
-    const good = await declare('image/png', 500)
+    const good = await declare('image/png', 500, 400)
     const goodFile = await storeFile(t, 400, 'image/png')
     const ok = await signedPost(t, { ...SUBMISSION, uploads: [{ uploadId: good, storageId: goodFile }] })
     expect(ok.status).toBe(200)
     // A second claim of the same upload is a conflict.
     expect((await signedPost(t, { ...SUBMISSION, uploads: [{ uploadId: good, storageId: goodFile }] })).status).toBe(409)
 
-    const liar = await declare('image/png', 500)
+    const liar = await declare('image/png', 500, 10) // its own bytes: the mismatch is the type
     const wrongType = await storeFile(t, 10, 'text/html')
     expect((await signedPost(t, { ...SUBMISSION, uploads: [{ uploadId: liar, storageId: wrongType }] })).status).toBe(415)
-    expect(await t.run((ctx) => ctx.storage.get(wrongType))).toBeNull() // deleted, never kept
+    // EC-671: refused and KEPT — a claim never deletes the id it names (it is the visitor's word).
+    expect(await stored(t, wrongType)).toBe(true)
+    expect(await intentState(t, liar)).toEqual({ state: 'rejected', storageId: wrongType })
   })
 
   it('an upload no submission claims is listed once its life is over (the visible orphan finding)', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    await signedPost(t, { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 10 })
+    await signedPost(t, { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 10, sha256: await sha256Of(10) })
     const later = (offsetMs: number) => new Date(Date.parse('2026-10-26T12:00:00.000Z') + offsetMs).toISOString()
     expect(await t.run((ctx) => unclaimedIngestUploads(ctx, 'contact', later(30 * 60 * 1000)))).toEqual([])
     const orphans = await t.run((ctx) => unclaimedIngestUploads(ctx, 'contact', later(2 * 60 * 60 * 1000)))
@@ -285,6 +339,270 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
   })
 })
 
+/**
+ * EC-671 — a claim binds only bytes the deployment's own facts say are this intent's, each
+ * check isolated (the others pass by construction) beside a control the same harness claims;
+ * and `releaseIngestUploads` deletes only what a claim bound. The forms addon's end-to-end
+ * probe (its rollback and removal, the attacker's harvest) is
+ * `packages/forms/src/convex/claim-ownership.convex.test.ts`.
+ */
+describe('the claim binds only this intent’s bytes; release deletes only bound bytes (EC-671)', () => {
+  const PNG = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
+  /** An intent declaring a png of up to 500 bytes whose content is the `bytesOf` zero bytes the test then stores (EC-685). */
+  async function declare(t: ReturnType<typeof backend>, bytesOf = 400): Promise<string> {
+    return ((await (await signedPost(t, { ...PNG, sha256: await sha256Of(bytesOf) })).json()) as { uploadId: string }).uploadId
+  }
+  const claimWith = (t: ReturnType<typeof backend>, uploadId: string, storageId: string) =>
+    signedPost(t, { ...SUBMISSION, uploads: [{ uploadId, storageId }] })
+  async function insertAsset(t: ReturnType<typeof backend>, files: { storageKey: string; thumb?: string }) {
+    await t.run(async (ctx) => {
+      await ctx.db.insert('assets', {
+        assetId: `asset_${files.storageKey}`,
+        filename: 'hero.png',
+        contentType: 'image/png',
+        byteSize: 400,
+        storageKey: files.storageKey,
+        ...(files.thumb ? { thumb: { storageKey: files.thumb, url: 'https://cdn.invalid/t', width: 1, height: 1 } } : {}),
+        createdAt: '2026-10-26T12:00:00.000Z',
+        updatedAt: '2026-10-26T12:00:00.000Z',
+      })
+    })
+  }
+  const bindings = (t: ReturnType<typeof backend>) =>
+    t.run(async (ctx) =>
+      (await ctx.db.query('records').collect())
+        .filter((row) => row.kind === 'ingestBinding')
+        .map((row) => ({ storageId: row.recordId, uploadId: (row.data as { uploadId: string }).uploadId })),
+    )
+
+  it('(1) a file stored BEFORE the intent — in the same millisecond — is refused, rejected and kept; one stored after is claimed', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const earlier = await storeFile(t, 400, 'image/png') // the fake clock does not move: one millisecond for all
+    const uploadId = await declare(t)
+    // Why the rule reads the intent ROW's `_creationTime`, not `issuedAt`: in this millisecond
+    // the earlier file is NOT before `issuedAt` (the HTTP action's clock, ms grain) — that
+    // comparison would have admitted it. Both `_creationTime`s are the deployment's stamps.
+    const facts = await t.run(async (ctx) => {
+      const intent = (await ctx.db.query('records').collect()).find((row) => row.recordId === uploadId)!
+      const file = (await ctx.db.system.get(earlier as never)) as { _creationTime: number }
+      return { file: file._creationTime, issuedAt: Date.parse((intent.data as { issuedAt: string }).issuedAt), intent: intent._creationTime }
+    })
+    expect(facts.file).toBeGreaterThanOrEqual(facts.issuedAt)
+    expect(facts.file).toBeLessThan(facts.intent)
+    const refused = await claimWith(t, uploadId, earlier)
+    expect(refused.status).toBe(422)
+    expect(await refused.json()).toEqual({ error: `Upload “${uploadId}” did not store the file “${earlier}”.` })
+    expect(await intentState(t, uploadId)).toEqual({ state: 'rejected', storageId: earlier })
+    expect(await stored(t, earlier)).toBe(true)
+    expect(await bindings(t)).toEqual([])
+    // Control: a file stored after its intent is claimed and bound.
+    const fresh = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, fresh, own)).status).toBe(200)
+    expect(await bindings(t)).toEqual([{ storageId: own, uploadId: fresh }])
+  })
+
+  it('(2) a file another claim bound is refused for a second intent issued before it was stored', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const first = await declare(t)
+    const second = await declare(t) // issued BEFORE the file, so check (1) passes for it too
+    const file = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, first, file)).status).toBe(200) // control: the first claim binds it
+    expect((await claimWith(t, second, file)).status).toBe(422)
+    expect(await intentState(t, second)).toEqual({ state: 'rejected', storageId: file })
+    expect(await bindings(t)).toEqual([{ storageId: file, uploadId: first }])
+    expect(await stored(t, file)).toBe(true)
+  })
+
+  it('(3) a file an asset row references — as its file or as its preview — is refused; control: an unreferenced one is claimed', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const [asFile, asThumb, plain] = [await declare(t), await declare(t, 40), await declare(t)]
+    const original = await storeFile(t, 400, 'image/png') // all stored AFTER the three intents: check (1) passes
+    const preview = await storeFile(t, 40, 'image/png')
+    const unreferenced = await storeFile(t, 400, 'image/png')
+    await insertAsset(t, { storageKey: original, thumb: preview })
+    expect((await claimWith(t, asFile, original)).status).toBe(422)
+    expect((await claimWith(t, asThumb, preview)).status).toBe(422)
+    expect((await claimWith(t, plain, unreferenced)).status).toBe(200)
+    expect(await bindings(t)).toEqual([{ storageId: unreferenced, uploadId: plain }])
+    expect([await stored(t, original), await stored(t, preview)]).toEqual([true, true])
+  })
+
+  it('releaseIngestUploads deletes a bound file and its binding, keeps an unbound one (an asset’s), and dedupes', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const uploadId = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const assetFile = await storeFile(t, 400, 'image/png')
+    await insertAsset(t, { storageKey: assetFile })
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, [own, assetFile, own]))
+    expect(released).toEqual({ deleted: [own], kept: [assetFile] })
+    expect([await stored(t, own), await stored(t, assetFile)]).toEqual([false, true])
+    expect(await bindings(t)).toEqual([])
+  })
+
+  // EC-685 (Codex r4 F20, ordering 2): a fact checked at claim time is not permanent — an
+  // asset may acquire a bound file afterwards. Each delete path re-checks the OTHER owner.
+  async function asEditor(t: ReturnType<typeof backend>) {
+    await t.run(async (ctx) => {
+      await ctx.db.insert('members', { userId: 'user_editor', role: 'admin', createdAt: '2026-10-26T12:00:00.000Z', updatedAt: '2026-10-26T12:00:00.000Z' })
+    })
+    return t.withIdentity({ subject: 'user_editor', issuer: 'https://convex.test' })
+  }
+  const deleteBlob = makeFunctionReference<'mutation', { storageKey: string }, unknown>('assets:deleteBlob')
+
+  it('EC-685: release KEEPS a bound file an asset references now — the binding is spent, the bytes go with the asset', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const [asFile, asThumb, plain] = [await declare(t), await declare(t, 40), await declare(t)]
+    const promoted = await storeFile(t, 400, 'image/png')
+    const preview = await storeFile(t, 40, 'image/png')
+    const unreferenced = await storeFile(t, 400, 'image/png')
+    for (const [uploadId, file] of [[asFile, promoted], [asThumb, preview], [plain, unreferenced]] as const) {
+      expect((await claimWith(t, uploadId, file)).status).toBe(200)
+    }
+    // An editor promotes two of the uploads to an asset (its file and its preview) — after the claims.
+    await insertAsset(t, { storageKey: promoted, thumb: preview })
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, [promoted, preview, unreferenced]))
+    expect(released).toEqual({ deleted: [unreferenced], kept: [promoted, preview] })
+    expect([await stored(t, promoted), await stored(t, preview), await stored(t, unreferenced)]).toEqual([true, true, false])
+    expect(await bindings(t)).toEqual([]) // ownership passed: no binding is left to hold the asset's bytes
+    // …so the asset's own delete now deletes them (control: deleteBlob deletes unbound bytes).
+    const editor = await asEditor(t)
+    expect(await editor.mutation(deleteBlob, { storageKey: promoted })).toEqual({ deleted: true })
+    expect(await stored(t, promoted)).toBe(false)
+  })
+
+  it('EC-685 mirror: assets:deleteBlob KEEPS bytes an ingest binding holds and returns normally; release then deletes them', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const uploadId = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    await insertAsset(t, { storageKey: own }) // promoted to an asset while the submission still holds it
+    const editor = await asEditor(t)
+    expect(await editor.mutation(deleteBlob, { storageKey: own })).toEqual({ deleted: false, heldBy: 'ingest' })
+    expect(await stored(t, own)).toBe(true)
+    expect(await bindings(t)).toEqual([{ storageId: own, uploadId }])
+    // The asset row goes (the studio's `assets:remove`); the submission's release deletes the bytes.
+    await t.run(async (ctx) => {
+      for (const row of await ctx.db.query('assets').collect()) await ctx.db.delete(row._id)
+    })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, [own]))).toEqual({ deleted: [own], kept: [] })
+    expect(await stored(t, own)).toBe(false)
+  })
+
+  // EC-685 (Codex r4 F20, ordering 1): checks (1)–(3) are eligibility; (4) is causation.
+  async function storeBytes(t: ReturnType<typeof backend>, bytes: Uint8Array<ArrayBuffer>, contentType: string) {
+    return t.run(async (ctx) => {
+      const id = await ctx.storage.store(new Blob([bytes], { type: contentType }))
+      await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+      return id
+    })
+  }
+  const setStoredDigest = (t: ReturnType<typeof backend>, storageId: string, sha256: string) =>
+    t.run(async (ctx) => {
+      await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(storageId, { sha256 })
+    })
+
+  it('(4) EC-685: a file stored after the intent, unbound, no asset’s — but not the DECLARED bytes — is refused, rejected and kept', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const uploadId = await declare(t) // declares 400 zero bytes
+    const other = await storeBytes(t, new Uint8Array(400).fill(7), 'image/png') // same type and size, other bytes
+    const refused = await claimWith(t, uploadId, other)
+    expect(refused.status).toBe(422)
+    // The ONE answer of checks (1)–(4): which one failed is not the visitor's to learn.
+    expect(await refused.json()).toEqual({ error: `Upload “${uploadId}” did not store the file “${other}”.` })
+    expect(await intentState(t, uploadId)).toEqual({ state: 'rejected', storageId: other })
+    expect(await stored(t, other)).toBe(true)
+    expect(await bindings(t)).toEqual([])
+    // Control: the declared bytes, stored after their intent, are claimed.
+    const fresh = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, fresh, own)).status).toBe(200)
+  })
+
+  it('EC-685: the comparator reads the stored digest by its FORM — convex-test’s base64 (measured) and hex both match', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const first = await declare(t)
+    const asStored = await storeFile(t, 400, 'image/png')
+    const stamped = await t.run(async (ctx) => ((await ctx.db.system.get(asStored as never)) as { sha256: string }).sha256)
+    expect(stamped).toMatch(/^[A-Za-z0-9+/]{43}=$/) // convex-test 0.0.54 fills `_storage.sha256` with base64 (`blobSha`)
+    expect((await claimWith(t, first, asStored)).status).toBe(200)
+    // The same digest in hex (`storage.getMetadata`'s documented form) reads the same.
+    const second = await declare(t)
+    const asHex = await storeFile(t, 400, 'image/png')
+    await setStoredDigest(t, asHex, (await sha256Of(400)).toUpperCase())
+    expect((await claimWith(t, second, asHex)).status).toBe(200)
+  })
+
+  it('EC-685: a stored digest in NEITHER form is refused visibly with its own reason, never read as a match', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const uploadId = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    // A base64url spelling of the right digest is still neither form: refused, not guessed at.
+    const url = btoa(String.fromCharCode(...Array.from((await sha256Of(400)).match(/../g)!, (pair) => parseInt(pair, 16))))
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=+$/, '')
+    await setStoredDigest(t, own, url)
+    const refused = await claimWith(t, uploadId, own)
+    expect(refused.status).toBe(422)
+    expect(await refused.json()).toEqual({
+      error: `The deployment's stored digest of “${own}” is in neither form the claim reads (64 hex or 44 base64 characters), so the upload cannot be verified.`,
+    })
+    expect(await intentState(t, uploadId)).toEqual({ state: 'rejected', storageId: own })
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('LEGACY (EC-685): an intent issued before uploads declared a digest is refused before any write — no crash, the row untouched', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const issuedAt = '2026-10-26T12:00:00.000Z'
+    await t.run(async (ctx) => {
+      // A row as the previous release wrote it: no `sha256` column (the kind now requires one).
+      await ctx.db.insert('records', {
+        kind: 'ingestUpload',
+        recordId: 'upload_legacy',
+        data: { target: 'contact', field: 'cv', contentType: 'image/png', size: 500, state: 'issued', issuedAt },
+        key1: 'contact',
+        key2: 'issued',
+        at: issuedAt,
+        createdAt: issuedAt,
+        updatedAt: issuedAt,
+      })
+    })
+    const file = await storeFile(t, 400, 'image/png')
+    const refused = await claimWith(t, 'upload_legacy', file)
+    expect(refused.status).toBe(422)
+    expect(await refused.json()).toEqual({
+      error: 'Upload “upload_legacy” was issued before uploads declared their SHA-256 — upload the file again.',
+    })
+    expect(await intentState(t, 'upload_legacy')).toEqual({ state: 'issued', storageId: undefined })
+    expect(await bindings(t)).toEqual([])
+    expect(await stored(t, file)).toBe(true)
+  })
+
+  it('the binding row is flat — its stored nesting is far inside Convex’s limit', async () => {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend()
+    const uploadId = await declare(t)
+    const own = await storeFile(t, 400, 'image/png')
+    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const row = await t.run(async (ctx) => (await ctx.db.query('records').collect()).find((r) => r.kind === 'ingestBinding')!)
+    expect(row.data).toEqual({ uploadId, target: 'contact', boundAt: '2026-10-26T12:00:00.000Z' })
+    expect(measureMaxDepth(row).depth).toBe(2) // the row object → `data` → its string columns
+    expect(measureMaxDepth(row).depth).toBeLessThanOrEqual(CONVEX_MAX_NESTING_DEPTH)
+  })
+})
+
 describe('the site’s route → the receiver, end to end (EC-617)', () => {
   it('a visitor’s submission through createIngestRoute lands a record; a mismatched site secret is a 502', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET