refactor(settings): adopt environment-only runtime secret flow

packages/api/src/router/settings.ts

@@ -6,7 +6,7 @@ import { VALUE_SCORE_WEIGHTS } from "@capakraken/shared";
 import { testSmtpConnection } from "../lib/email.js";
 import { createAuditEntry } from "../lib/audit.js";
 import { logger } from "../lib/logger.js";
-import { resolveSystemSettingsRuntime } from "../lib/system-settings-runtime.js";
+import { getRuntimeSecretStatuses, RUNTIME_SECRET_FIELDS, resolveSystemSettingsRuntime } from "../lib/system-settings-runtime.js";
 
 /** Fields that must never appear in audit log values */
 const SENSITIVE_FIELDS = new Set([
@@ -23,6 +23,10 @@ export const settingsRouter = createTRPCRouter({
       where: { id: "singleton" },
     });
     const runtimeSettings = resolveSystemSettingsRuntime(settings);
+    const runtimeSecrets = getRuntimeSecretStatuses(settings);
+    const legacyStoredSecretFields = RUNTIME_SECRET_FIELDS.filter(
+      (field) => runtimeSecrets[field].hasStoredValue,
+    );
 
     const defaultWeights = {
       skillDepth: VALUE_SCORE_WEIGHTS.SKILL_DEPTH,
@@ -42,6 +46,8 @@ export const settingsRouter = createTRPCRouter({
       aiSummaryPrompt: settings?.aiSummaryPrompt ?? null,
       defaultSummaryPrompt: DEFAULT_SUMMARY_PROMPT,
       hasApiKey: !!runtimeSettings.azureOpenAiApiKey,
+      runtimeSecrets,
+      legacyStoredSecretFields,
       scoreWeights: (settings?.scoreWeights as unknown as typeof defaultWeights) ?? defaultWeights,
       scoreVisibleRoles: (settings?.scoreVisibleRoles as unknown as string[]) ?? ["ADMIN", "MANAGER"],
       // SMTP
@@ -125,13 +131,14 @@ export const settingsRouter = createTRPCRouter({
     )
     .mutation(async ({ ctx, input }) => {
       const data: Record<string, unknown> = {};
+      const ignoredSecretFields: string[] = [];
       if (input.aiProvider !== undefined) data.aiProvider = input.aiProvider;
       if (input.azureOpenAiEndpoint !== undefined)
         data.azureOpenAiEndpoint = input.azureOpenAiEndpoint || null;
       if (input.azureOpenAiDeployment !== undefined)
         data.azureOpenAiDeployment = input.azureOpenAiDeployment || null;
       if (input.azureOpenAiApiKey !== undefined)
-        data.azureOpenAiApiKey = input.azureOpenAiApiKey || null;
+        ignoredSecretFields.push("azureOpenAiApiKey");
       if (input.azureApiVersion !== undefined)
         data.azureApiVersion = input.azureApiVersion || null;
       if (input.aiMaxCompletionTokens !== undefined)
@@ -148,16 +155,13 @@ export const settingsRouter = createTRPCRouter({
       if (input.smtpHost !== undefined) data.smtpHost = input.smtpHost || null;
       if (input.smtpPort !== undefined) data.smtpPort = input.smtpPort;
       if (input.smtpUser !== undefined) data.smtpUser = input.smtpUser || null;
-      if (input.smtpPassword !== undefined) data.smtpPassword = input.smtpPassword || null;
+      if (input.smtpPassword !== undefined) ignoredSecretFields.push("smtpPassword");
       if (input.smtpFrom !== undefined) data.smtpFrom = input.smtpFrom || null;
       if (input.smtpTls !== undefined) data.smtpTls = input.smtpTls;
       // Global anonymization
       if (input.anonymizationEnabled !== undefined) data.anonymizationEnabled = input.anonymizationEnabled;
       if (input.anonymizationDomain !== undefined) data.anonymizationDomain = input.anonymizationDomain || "superhartmut.de";
-      if (input.anonymizationSeed !== undefined) {
-        data.anonymizationSeed = input.anonymizationSeed || null;
-        data.anonymizationAliases = null;
-      }
+      if (input.anonymizationSeed !== undefined) ignoredSecretFields.push("anonymizationSeed");
       if (input.anonymizationMode !== undefined) {
         data.anonymizationMode = input.anonymizationMode;
         data.anonymizationAliases = null;
@@ -168,10 +172,10 @@ export const settingsRouter = createTRPCRouter({
       if (input.azureDalleEndpoint !== undefined)
         data.azureDalleEndpoint = input.azureDalleEndpoint || null;
       if (input.azureDalleApiKey !== undefined)
-        data.azureDalleApiKey = input.azureDalleApiKey || null;
+        ignoredSecretFields.push("azureDalleApiKey");
       // Gemini
       if (input.geminiApiKey !== undefined)
-        data.geminiApiKey = input.geminiApiKey || null;
+        ignoredSecretFields.push("geminiApiKey");
       if (input.geminiModel !== undefined)
         data.geminiModel = input.geminiModel || null;
       // Image provider
@@ -182,6 +186,14 @@ export const settingsRouter = createTRPCRouter({
       // Timeline
       if (input.timelineUndoMaxSteps !== undefined) data.timelineUndoMaxSteps = input.timelineUndoMaxSteps;
 
+      if (Object.keys(data).length === 0) {
+        return {
+          ok: true,
+          ignoredSecretFields,
+          secretStorageMode: "environment-only" as const,
+        };
+      }
+
       // Fetch current settings for before-snapshot
       const before = await ctx.db.systemSettings.findUnique({ where: { id: "singleton" } });
 
@@ -215,9 +227,47 @@ export const settingsRouter = createTRPCRouter({
         source: "ui",
       });
 
-      return { ok: true };
+      return {
+        ok: true,
+        ignoredSecretFields,
+        secretStorageMode: "environment-only" as const,
+      };
     }),
 
+  clearStoredRuntimeSecrets: adminProcedure.mutation(async ({ ctx }) => {
+    const existing = await ctx.db.systemSettings.findUnique({
+      where: { id: "singleton" },
+      select: Object.fromEntries(
+        RUNTIME_SECRET_FIELDS.map((field) => [field, true]),
+      ) as Record<(typeof RUNTIME_SECRET_FIELDS)[number], true>,
+    });
+
+    const clearedFields = RUNTIME_SECRET_FIELDS.filter((field) => !!existing?.[field]);
+
+    if (clearedFields.length === 0) {
+      return { ok: true, clearedFields: [] as string[] };
+    }
+
+    await ctx.db.systemSettings.update({
+      where: { id: "singleton" },
+      data: Object.fromEntries(clearedFields.map((field) => [field, null])),
+    });
+
+    void createAuditEntry({
+      db: ctx.db,
+      entityType: "SystemSettings",
+      entityId: "singleton",
+      entityName: "Runtime Secrets",
+      action: "UPDATE",
+      userId: ctx.dbUser?.id,
+      after: { clearedFields },
+      source: "ui",
+      summary: `Cleared ${clearedFields.length} legacy runtime secret field(s) from database storage`,
+    });
+
+    return { ok: true, clearedFields };
+  }),
+
   testAiConnection: adminProcedure.mutation(async ({ ctx }) => {
     const settings = resolveSystemSettingsRuntime(await ctx.db.systemSettings.findUnique({
       where: { id: "singleton" },