toga-ai 1.0.1186 → 1.0.1187

package/knowledge/sessions/2026-10-28-secrets-manager-migration-amadda.md

@@ -0,0 +1,76 @@
+---
+type: session
+slug: secrets-manager-migration
+title: Move committed secrets to AWS Secrets Manager (TRUE-83197) — scoping
+author: amadda
+repos: [worker2, api2, worker, tools, togadesk, library, talos-backend, toga2-commerce]
+framework: "both"
+client: shared
+status: active
+created: 2026-10-28
+updated: 2026-10-28
+---
+
+# Session: secrets-manager-migration
+**Date:** 2026-10-28
+**Project/Repo:** many (both 1.0 and 2.0) — started in worker2
+**Task:** TRUE-83197 — scope the work to move every committed secret (passwords, keys, tokens) out of code into AWS Secrets Manager and have code read them at runtime. No code changed yet; this session was understanding + a first-pass inventory.
+
+---
+
+## What WORKED
+- `/start TRUE-83197` done: ticket verified, KB primed, harness updated 1.0.1181 → 1.0.1185. Ticket set to `in progress`, Today checked, title now "TOGA Tech - Move secrets out of code".
+- Found the team standard: `knowledge/2.0/standards/secrets-and-build-credentials.md` — all secrets go in Secrets Manager, **prod account 654654170868, us-east-1**, KMS `alias/toga-secrets`; cross-account readers use full ARN + resource policy on the secret. `saml` already loads its certs this way (working example to copy).
+- Confirmed examples of secrets in code (values NOT recorded here):
+  - worker2 `Config/production.ini` (and beta, sandbox-dev, 4 `dev-*` ini files): DB passwords, NetSuite, FedEx, UPS, SharePoint, Teams, Vapi, Cal.com, AIG SFTP.
+  - worker2 `.ebextensions/git.json`: full GitHub token (likely the `agilantgit` token the ticket names).
+  - worker2 PHP constants: `Worker/Ai/Bdr/Vapi.php:6` `VAPI_BEARER_TOKEN` (used at line 642), `Worker/Vapi.php:7` `API_SECRET`.
+- First-pass inventory (grep on locally cloned repos, names only) — by system → repos:
+  1. Database passwords — api2, worker2, worker, tools, togadesk
+  2. NetSuite (login + EC key file) — api2, worker2, worker, tools, togadesk, library
+  3. api2 API keys `[api]` — api2, worker2, worker, tools, togadesk
+  4. AWS access keys — worker, tools, talos-backend
+  5. Talos — worker2, tools
+  6. FedEx, UPS, PayPal, Vapi, Cal.com — api2, worker2
+  7. SFTP / AIG / Staples — worker2, worker, togadesk
+  8. ClickUp, OneUptime, QuickBooks, SharePoint, Teams — worker2
+  9. Email SMTP — worker, tools, togadesk
+  10. Payeezy, MTP, LStore (1.0) — worker, tools, togadesk, library
+  11. Private key files (ssl/, ssl/toga, ssl/doe, sso) — library
+  12. Sentry / GitHub tokens — toga2-commerce, worker2
+
+## What did NOT work — DO NOT RETRY THESE
+- Masking secret values with `sed 's/(=\s*"?)(.{3})[^"]*("?)$/.../'` — fails on lines ending in `";` and on JSON lines; two real values (FedEx keys, GitHub token) printed in full to local tool output. Use a mask that replaces any quoted run of 8+ chars, and test it before running on real files.
+- macOS `awk` with `IGNORECASE` / `\s` — not supported (BSD awk), returned empty results. Use `perl -ne` instead.
+- `aws sts get-caller-identity` — `command not found: aws`. AWS CLI is not installed on this machine.
+- Raw keyword grep across repos gives ~1,300 hits (lots of false hits: field names, NetSuite schema words, talos settings reading env vars). Not usable as the final list.
+
+## Not tried yet (candidates for next session)
+- Install and run `gitleaks` on every repo (current files + git history) for the real inventory; then review hits by hand.
+- Scan repos not cloned locally: saml, worker1.5, api, store, vision, togatech, toga25-desk/iq/blox/supply, toga2-template (FontAwesome / npm tokens likely in `.npmrc`).
+- Design the shared helper: one in `_underscore` (2.0) and one in `library` (1.0) that fetches a secret by name and caches it per process; config keeps the secret NAME, not the value. Copy the `saml` Secrets Manager pattern.
+- Secret naming scheme, e.g. one JSON secret per system per app (`worker2/netsuite` = {username, password, ...}).
+- Script that reads values from current config files and runs `aws secretsmanager create-secret --kms-key-id alias/toga-secrets` without printing values; a person with prod access runs it.
+- CTO second opinion before finalizing approach (touches many repos + core).
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| (no repo code files changed) | — | Only research this session |
+| ~/.claude/.../memory/concise-responses.md | modified | Developer wants 3-6 line replies |
+
+## Decisions made
+- Scope = **every** committed secret, not only the 7 listed in the ticket ("Put every committed secret..."). The 7 are examples. Developer may confirm with ticket owner if they want to narrow it.
+- Target = Secrets Manager in prod account 654654170868 (team standard), KMS `alias/toga-secrets`. (Earlier guess that 654654170868 was "Talos only" was wrong.)
+- No rotation in this ticket (that is ticket 2.13), unless a secret shows misuse.
+- Claude will not create secrets in AWS itself without per-command approval; mutating AWS needs a human OK.
+
+## Blockers
+- AWS CLI not installed / no prod AWS login on this machine. Need to know who has prod access (developer or Jeff).
+- Repo list not yet confirmed by developer (Application = "Infrastructure", no repo mapping). Suggested: start with worker2.
+
+## Exact next step
+> Get the developer's OK on the repo list, then install `gitleaks` and run it (read-only, values redacted) on every repo under ~/Desktop/Projects to build the exact secret inventory.
+
+---
+_Saved by /session-save on 2026-10-28_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1186",
+  "version": "1.0.1187",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",