From 30f29d65dc7f51b0b7ddcfd8134de2945bc56938 Mon Sep 17 00:00:00 2001 From: Ilia Pasechnikov Date: Tue, 7 Jul 2026 22:10:44 +0900 Subject: [PATCH] refactor: rename Aidbox creds to AIDBOX_CLIENT_ID / AIDBOX_CLIENT_SECRET Match the engine's renamed env vars (interbox 1.4.0). The aidbox sender now authenticates as env("AIDBOX_CLIENT_ID", "root") with env("AIDBOX_CLIENT_SECRET"), so a scoped least-privilege Aidbox client can replace root. Renamed the compose env keys and .env.example to match. Co-Authored-By: Claude Opus 4.8 (1M context) --- .env.example | 7 +++++-- docker-compose.yaml | 6 ++++-- src/pipelines/hl7-to-aidbox/index.ts | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 01baf7c..6847cbc 100644 --- a/.env.example +++ b/.env.example @@ -15,8 +15,11 @@ INTERBOX_LICENSE= # value so Aidbox starts in activation mode instead of crashing. Or paste a free # dev license JWT from the Aidbox portal here to skip the in-dashboard step. AIDBOX_LICENSE= -# Shared secret for the root client (any value; keep it consistent). -AIDBOX_SECRET=secret +# The Aidbox Client interbox authenticates as. CLIENT_ID is optional — the sender +# defaults to `root`; set a scoped client for least privilege. SECRET must match the +# Client's secret in Aidbox (BOX_ROOT_CLIENT_SECRET for the default root client). +# AIDBOX_CLIENT_ID=root +AIDBOX_CLIENT_SECRET=secret # ── Dashboard assistant (Claude Code over ACP) ─────────────────────────────── # Optional — leave blank and the dashboard still works, the assistant just can't diff --git a/docker-compose.yaml b/docker-compose.yaml index bca11e3..6ba8f8d 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -74,7 +74,9 @@ services: INTERBOX_WORKSPACE_POLL_MS: "2000" # snappy hot reload in dev # Pipeline sender target. AIDBOX_URL: http://aidbox:8080 - AIDBOX_SECRET: ${AIDBOX_SECRET:-secret} + # Client interbox authenticates as — id defaults to root; set a scoped one for least privilege. + AIDBOX_CLIENT_ID: ${AIDBOX_CLIENT_ID:-root} + AIDBOX_CLIENT_SECRET: ${AIDBOX_CLIENT_SECRET:-secret} # License: env activation (or use the dashboard's activation screen instead). INTERBOX_LICENSE: ${INTERBOX_LICENSE:-} # Dashboard assistant (Claude Code over ACP) auth — pick ONE (all blank = the @@ -123,7 +125,7 @@ services: environment: AIDBOX_LICENSE: ${AIDBOX_LICENSE} BOX_ADMIN_PASSWORD: admin - BOX_ROOT_CLIENT_SECRET: ${AIDBOX_SECRET:-secret} + BOX_ROOT_CLIENT_SECRET: ${AIDBOX_CLIENT_SECRET:-secret} BOX_BOOTSTRAP_FHIR_PACKAGES: hl7.fhir.r4.core#4.0.1 BOX_FHIR_SCHEMA_VALIDATION: "true" BOX_FHIR_COMPLIANT_MODE: "true" diff --git a/src/pipelines/hl7-to-aidbox/index.ts b/src/pipelines/hl7-to-aidbox/index.ts index e775b80..640f17c 100644 --- a/src/pipelines/hl7-to-aidbox/index.ts +++ b/src/pipelines/hl7-to-aidbox/index.ts @@ -20,6 +20,6 @@ pipeline("hl7-to-aidbox") .sender( aidboxSender({ url: env("AIDBOX_URL"), - auth: { kind: "basic", user: "root", password: env("AIDBOX_SECRET") }, + auth: { kind: "basic", user: env("AIDBOX_CLIENT_ID", "root"), password: env("AIDBOX_CLIENT_SECRET") }, }), );