Skip to content

feat(aso-overlay): document ASO_OVERLAY_API_KEY_PREVIOUS in .env.example#2834

Open
abhishekgarg18 wants to merge 1 commit into
mainfrom
chore/aso-overlay-api-key-previous-env-example-v2
Open

feat(aso-overlay): document ASO_OVERLAY_API_KEY_PREVIOUS in .env.example#2834
abhishekgarg18 wants to merge 1 commit into
mainfrom
chore/aso-overlay-api-key-previous-env-example-v2

Conversation

@abhishekgarg18

@abhishekgarg18 abhishekgarg18 commented Jul 16, 2026

Copy link
Copy Markdown
Member

Summary

Documents the ASO_OVERLAY_API_KEY_PREVIOUS env var in .env.example. This is a pure docs / dev-onboarding change — no runtime behavior changes.

Context

AsoOverlayKeyHandler (src/support/aso-overlay-key-handler.js:109) already reads ASO_OVERLAY_API_KEY_PREVIOUS and falls back to it when the current key doesn't match — see the dual-key rotation logic at lines 107-124. But the dev-onboarding template (.env.example) didn't list it, so every new engineer had to reverse-engineer the rotation setup from the handler code + the deploy pipeline.

Empty in steady state (the if (previousKey && ...) guard at handler line 118 treats empty string as falsy). Populated during a key-rotation window so dispatcher pods still holding the old value are not 401'd during EVO secret propagation.

Why re-open (replaces #2797)

Original PR #2797 was opened from a personal fork (abhishekgarg18/spacecat-api-service), which meant several org-scoped CI checks were skipped. Re-opened from an internal branch so the full pipeline runs.

Diff

  • .env.example: adds ASO_OVERLAY_API_KEY_PREVIOUS= with a comment block explaining rotation semantics + the vault lookup command aligned with the existing ASO_OVERLAY_API_KEY entry. Comment section is 6 lines added, 3 removed.

Test plan

  • Self-review: auth handler behavior matches the comment (verified at aso-overlay-key-handler.js:107-124)
  • Only 2 code sites reference ASO_OVERLAY_API_KEY_PREVIOUS (JSDoc + handler read); both consistent
  • No Terraform / deploy-manifest drift — this var flows via Vault → helix-deploy secret resolution, same as ASO_OVERLAY_API_KEY
  • Tests already cover current-key, previous-key, and empty-previous scenarios (test/support/aso-overlay-key-handler.test.js dual-key rotation describe block)

Related

🤖 Generated with Claude Code

…mple

Non-blocking follow-up from Alina's review of PR #2663 (dual-key overlap
for API key rotation): the handler already accepts ASO_OVERLAY_API_KEY_PREVIOUS
as the previous-key fallback, but the env var was undocumented in the
example file, so local devs had no signal it exists.

Empty in steady state; operators populate it during a rotation window
(populating both aso_keys_previous at Fastly and ASO_OVERLAY_API_KEY_PREVIOUS
here in lockstep — see spacecat-infrastructure#627 MIGRATION-lite-e.md
for the rotation flow) so dispatcher pods still holding the old key are
not 401'd during EVO propagation.

Co-Authored-By: Claude <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

This PR will trigger no release when merged.

@codecov

codecov Bot commented Jul 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@abhishekgarg18 abhishekgarg18 changed the title chore(aso-overlay): document ASO_OVERLAY_API_KEY_PREVIOUS in .env.example feat(aso-overlay): document ASO_OVERLAY_API_KEY_PREVIOUS in .env.example Jul 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant