From 832c32b1cb44b87f2b955ad8e1b5c42c7bbcacbc Mon Sep 17 00:00:00 2001
From: charles <charles.englebert@protonmail.com>
Date: Mon, 16 Feb 2026 15:35:41 +0100
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8(core)=20automate=20oidc-store-refresh?=
 =?UTF-8?q?-token-key=20generation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OIDC_STORE_REFRESH_TOKEN_KEY is a mandatory secret key.
We can not push it on github and we want any contributor
to be able to run the app by only running bootstrap.
We then must generate the variable in the bootstrap.

Signed-off-by: charles <charles.englebert@protonmail.com>
---
 Makefile                                     |  8 +++++++-
 bin/fernetkey                                |  6 ------
 bin/generate-oidc-store-refresh-token-key.sh | 13 +++++++++++++
 docs/search.md                               |  2 +-
 4 files changed, 21 insertions(+), 8 deletions(-)
 delete mode 100755 bin/fernetkey
 create mode 100755 bin/generate-oidc-store-refresh-token-key.sh

diff --git a/Makefile b/Makefile
index 13319999b..2f7c18fc6 100644
--- a/Makefile
+++ b/Makefile
@@ -79,10 +79,16 @@ create-env-local-files:
 	@touch env.d/development/kc_postgresql.local
 .PHONY: create-env-local-files
 
+generate-secret-keys:
+generate-secret-keys: ## generate secret keys to be stored in common.local
+	@bin/generate-oidc-store-refresh-token-key.sh
+.PHONY: generate-secret-keys
+
 pre-bootstrap: \
 	data/media \
 	data/static \
-	create-env-local-files
+	create-env-local-files \
+	generate-secret-keys
 .PHONY: pre-bootstrap
 
 post-bootstrap: \
diff --git a/bin/fernetkey b/bin/fernetkey
deleted file mode 100755
index 8bbac1096..000000000
--- a/bin/fernetkey
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-# shellcheck source=bin/_config.sh
-source "$(dirname "${BASH_SOURCE[0]}")/_config.sh"
-
-_dc_run app-dev python -c 'from cryptography.fernet import Fernet;import sys; sys.stdout.write("\n" + Fernet.generate_key().decode() + "\n");'
diff --git a/bin/generate-oidc-store-refresh-token-key.sh b/bin/generate-oidc-store-refresh-token-key.sh
new file mode 100755
index 000000000..87746d84e
--- /dev/null
+++ b/bin/generate-oidc-store-refresh-token-key.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Generate the secret OIDC_STORE_REFRESH_TOKEN_KEY and store it to common.local
+
+set -eo pipefail
+
+COMMON_LOCAL="env.d/development/common.local"
+
+OIDC_STORE_REFRESH_TOKEN_KEY=$(openssl rand -base64 32)
+
+echo "" >> "${COMMON_LOCAL}"
+echo "OIDC_STORE_REFRESH_TOKEN_KEY=${OIDC_STORE_REFRESH_TOKEN_KEY}" >> "${COMMON_LOCAL}"
+echo "✓ OIDC_STORE_REFRESH_TOKEN_KEY generated and stored in ${COMMON_LOCAL}"
diff --git a/docs/search.md b/docs/search.md
index cb077eae0..f2de68ad9 100644
--- a/docs/search.md
+++ b/docs/search.md
@@ -38,4 +38,4 @@ OIDC_STORE_REFRESH_TOKEN_KEY="<your-32-byte-encryption-key==>"
 ```
 
 `OIDC_STORE_REFRESH_TOKEN_KEY` must be a valid Fernet key (32 url-safe base64-encoded bytes).
-To create one, use the `bin/fernetkey` command.
+To create one, use the `bin/generate-oidc-store-refresh-token-key.sh` command.