Marie
9de1b6330c
## Summary Adds an internal support endpoint to regenerate a customer's enterprise key when they've lost the one issued at activation. The key payload is deterministic from the Stripe subscription, so this re-emits an equivalent valid key without any new state. `GET /api/enterprise/reissue/<subscriptionId>/<secret>` - Guarded by a shared secret (`ENTERPRISE_ADMIN_API_SECRET`), compared in constant time and fail-closed when unset. - Looks up the subscription in Stripe (for the licensee) and signs the key with `signEnterpriseKey()`, reading `ENTERPRISE_JWT_PRIVATE_KEY` from the environment — the private key is never accepted from the request. - No subscription-status gate: the key alone grants nothing. Feature access still requires a validity token, which `/api/enterprise/validate` only issues after re-checking the subscription is active. ## Notes / follow-ups - The admin secret travels in the URL path, so it can land in server/proxy/CDN access logs — rotate `ENTERPRISE_ADMIN_API_SECRET` if logs are ever exposed. - No audit logging yet; worth adding (who reissued which subscription, when). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21660?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>
51 lines
2.2 KiB
Bash
51 lines
2.2 KiB
Bash
PARTNER_APPLICATION_WEBHOOK_URL=
|
||
|
||
# Optional GitHub personal-access token (no scopes required) used by the
|
||
# community-stats fetcher (`src/lib/community/fetch-github-star-count.ts`).
|
||
# When set, requests use the 5000/hr authenticated limit instead of the
|
||
# 60/hr unauthenticated per-IP limit. Both responses are also cached for
|
||
# one hour via `unstable_cache`, so dev without a token still works.
|
||
# GITHUB_TOKEN=
|
||
|
||
# Public site URL — canonical origin used by `metadataBase`, sitemap, robots,
|
||
# OG/Twitter card URLs, Stripe checkout success URL, and billing portal return.
|
||
# No trailing slash. Defaults to https://twenty.com when unset.
|
||
NEXT_PUBLIC_WEBSITE_URL=
|
||
|
||
# --- Visual runtime kill switches ---------------------------------------
|
||
# Hard kill switch for every WebGL/Three/R3F decorative visual on the site.
|
||
# Set to "1" / "true" to ship a build with all heavy visuals statically
|
||
# replaced by their fallbacks (e.g. during a GPU-driver-related incident).
|
||
# NEXT_PUBLIC_DISABLE_HEAVY_VISUALS=
|
||
|
||
# Soft cap on the number of concurrent WebGL contexts the page is allowed
|
||
# to spin up. The browser's own hard cap is typically 8–16; we default to 8
|
||
# so a single page that mounts every illustration cannot exhaust the GPU
|
||
# context pool on integrated graphics.
|
||
# NEXT_PUBLIC_MAX_WEBGL_CONTEXTS=8
|
||
|
||
# Stripe — self-hosted enterprise checkout & subscription APIs
|
||
STRIPE_SECRET_KEY=
|
||
STRIPE_ENTERPRISE_MONTHLY_PRICE_ID=
|
||
STRIPE_ENTERPRISE_YEARLY_PRICE_ID=
|
||
|
||
# RS256 key pair used to sign enterprise license JWTs (use literal \n in PEM for env)
|
||
ENTERPRISE_JWT_PRIVATE_KEY=
|
||
ENTERPRISE_JWT_PUBLIC_KEY=
|
||
|
||
# Optional: short-lived validity token length in days (default 30)
|
||
# ENTERPRISE_VALIDITY_TOKEN_DURATION_DAYS=
|
||
|
||
# Shared secret guarding the internal enterprise key reissue support endpoint,
|
||
# used to regenerate an enterprise key
|
||
ENTERPRISE_ADMIN_API_SECRET=
|
||
|
||
# Twenty workspace the partners marketplace reads partner data from
|
||
# (server-side only) via the /s/partners REST endpoint.
|
||
TWENTY_PARTNERS_API_URL=
|
||
TWENTY_PARTNERS_API_KEY=
|
||
|
||
# Cal.com path (no host) the partner application success screen books the intro
|
||
# call onto, e.g. acme/partner-intro. Falls back to a built-in default when unset.
|
||
NEXT_PUBLIC_PARTNER_INTRO_CAL_LINK=
|