officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

invoiceshelf: accounts are configured from the ui, not the environment

Browse Source 
The same registry photos got: any number of labelled instances stored encrypted in
invoiceshelf_accounts, one selected, switchable from the nav. The token is write-only across
the sidecar boundary — the list has no field that could carry it back — and nothing reads
INVOICESHELF_URL/TOKEN/COMPANY_ID any more, so officer's own process.env no longer holds a
credential only the sidecar can use.

The company is pinned on the account row rather than resolved per request. InvoiceShelf's
`company` header does not error on a wrong or missing value; it silently returns another
company's books. So the choice is made once, at add time, and a token that can act for several
answers 409 with the list instead of guessing.

Both apps also take an email and password now, because neither service makes a key easy to get:
InvoiceShelf 2.4.2 ships no screen that issues tokens at all (POST /auth/login is the only way),
and Immich's is buried in account settings. The sidecar does the exchange — InvoiceShelf mints a
Sanctum token, Immich logs in, creates an all-permissions API key and closes the session again —
and stores only what comes back. The password is never persisted. Pasting a key still works.

Verified against the live instances: InvoiceShelf 2.4.2 and Immich 3.1.0, routes and DTOs read
from the running containers. The two sign-in paths are untested end to end — no second login to
try them with.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-03 17:44:28 +00:00
co-authored by Claude Opus 5
parent 632d5a1c1f
commit f20d4a300e
21 changed files with 1785 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+5 -16
View File
@@ -28,16 +28,9 @@ TRANSMISSION_USER=
TRANSMISSION_PASS=
# TRANSMISSION_RPC_PATH=/transmission/rpc
# InvoiceShelf (officer-invoiceshelf). The token is a Sanctum personal access token — mint one with
# POST /api/v1/auth/login {username: <email>, password, device_name} and copy the `token` field. It has
# full abilities and never expires, so treat it as a password.
# INVOICESHELF_COMPANY_ID pins which company every request is scoped to. Leave it unset on a
# single-company install and the sidecar resolves it once at boot and LOGS the choice — worth setting
# explicitly if you have more than one, because InvoiceShelf does not error on a wrong company header,
# it silently returns the other company's data.
INVOICESHELF_URL=https://invoice.example.com
INVOICESHELF_TOKEN="<sanctum api token, e.g. 1|xxxxxxxx>"
# INVOICESHELF_COMPANY_ID=1
# InvoiceShelf (officer-invoiceshelf) is configured from the app, not from here — Invoices → Connection.
# Instances, their Sanctum tokens and the company each one is pinned to live encrypted in
# `invoiceshelf_accounts`, so nothing outside the sidecar can read a token.
# slskd (officer-slskd). The key is injected as X-API-Key on every forwarded request.
SLSKD_URL=http://127.0.0.1:5030
@@ -78,9 +71,5 @@ VAULT_STORE_KEY="<generate with: openssl rand -base64 32>"
# seals it. Both are required to spend. If you lose VAULT_STORE_KEY, every stored seed is
# unrecoverable — back up the mnemonics separately, offline.
# Immich (officer-photos). The key is injected as x-api-key on every forwarded request; the platform never
# sees it. Create it in Immich: Account Settings → API Keys → New API Key. Immich keys are SCOPED — grant
# all permissions unless you want a read-only library, because a missing permission answers 403 on that one
# route and looks like a broken feature rather than a bad credential.
IMMICH_URL=http://127.0.0.1:2283
IMMICH_API_KEY="<immich api key>"
# Immich (officer-photos) is configured from the app, not from here — Photos → Connection. Instances and
# their API keys live encrypted in `photos_config`, so the platform never sees a key.