algorithm: random_hex emits secrets.token_hex(64), which is 128 lowercase hex
characters. The declared pattern demanded 64 characters from a set that
includes uppercase, so it could never match a value its own generator produced.
web-app-gitlab and web-app-bigbluebutton already spell the same algorithm as
^[a-f0-9]{128}$.
Nothing enforces the validation field today - utils/cache/schema_credentials.py
treats it as a leaf marker only - so this corrects a declaration that lied
rather than a live failure. It matters the moment anyone wires the field up.
Found while triaging the ONLYOFFICE connector in run 34294297836; the same
unsatisfiable shape sat in web-svc-coturn, where the credential has since been
replaced by a declared user.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
meta/schema.yml held credential definitions and their runtime values, but the
name said 'schema' and read like structural metadata next to services.yml and
volumes.yml. Nothing in the file is a schema in the sense the other meta files
use the word, and a contributor had to open it to learn it holds secrets.
62 role files renamed. ROLE_FILE_META_SCHEMA becomes ROLE_FILE_META_SECRETS and
keeps its role as the SPOT the path is built from.
Two readers bypassed that constant and spelled the name themselves:
utils/cache/applications.py built meta_dir / 'schema.yml' twice, and
plugins/lookup/application_gid.py carries the filename in the marker list it
detects application roles by. Left behind, the rename would not have raised —
credentials would have resolved empty and the role would have stopped counting
as an application.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5