fix(staging): bootstrap database model key

deploy/README.md

@@ -87,6 +87,7 @@ RECTIFICATION_PRICE_CREDITS=3
 
 # Required to encrypt/decrypt model-provider API keys stored in the admin database.
 # Base64 decoding must produce exactly 32 random bytes; do not reuse other keys.
+# Staging migration/deploy creates this once when absent and removes legacy model API-key settings.
 MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=<independent-base64-encoded-32-byte-key>
 # OpenAI-compatible origins must be explicitly server-allowlisted.
 # MODEL_PROVIDER_BASE_URL_ALLOWLIST=https://api.deepseek.com

deploy/prepare-staging-model-provider-env.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+set +x
+
+ENV_FILE="${1:-.env.staging}"
+if [ ! -f "$ENV_FILE" ] || [ -L "$ENV_FILE" ]; then
+  echo "staging environment file is missing or unsafe: $ENV_FILE" >&2
+  exit 1
+fi
+
+legacy_pattern='^(OPENAI_API_KEY|ANTHROPIC_API_KEY|DEEPSEEK_API_KEY|LLM_API_KEY|LLM_MODELS_JSON|LLM_BASE_URL|LLM_MODEL|LLM_DEFAULT_MODEL_ID|LLM_PROVIDER_ID|MASTRA_MODEL|MODEL_PROVIDER_[A-Z0-9_]+_API_KEY)='
+key_count="$(grep -Ec '^MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=' "$ENV_FILE" || true)"
+if [ "$key_count" -gt 1 ]; then
+  echo "duplicate staging model provider encryption key" >&2
+  exit 1
+fi
+
+if mode="$(stat -c '%a' "$ENV_FILE" 2>/dev/null)"; then
+  owner="$(stat -c '%u' "$ENV_FILE")"
+  group="$(stat -c '%g' "$ENV_FILE")"
+else
+  mode="$(stat -f '%Lp' "$ENV_FILE")"
+  owner="$(stat -f '%u' "$ENV_FILE")"
+  group="$(stat -f '%g' "$ENV_FILE")"
+fi
+temporary="$(mktemp "${ENV_FILE}.tmp.XXXXXX")"
+trap 'rm -f -- "$temporary"' EXIT
+
+grep -Ev "$legacy_pattern" "$ENV_FILE" > "$temporary" || true
+if [ "$key_count" -eq 0 ]; then
+  key="$(openssl rand -base64 32 | tr -d '\n')"
+  [[ "$key" =~ ^[A-Za-z0-9+/]{43}=$ ]] || exit 1
+  printf 'MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY=%s\n' "$key" >> "$temporary"
+fi
+
+chmod "$mode" "$temporary"
+chown "$owner:$group" "$temporary"
+mv -f -- "$temporary" "$ENV_FILE"
+trap - EXIT

deploy/run-staging-deploy.sh

@@ -126,6 +126,7 @@ EXPECTED_STAGING_ENV_OWNER_UID="$(stat -c '%u' "$DEPLOY_PATH" 2>/dev/null || sta
   exit 1
 }
 export EXPECTED_STAGING_ENV_OWNER_UID
+bash deploy/prepare-staging-model-provider-env.sh .env.staging
 bash deploy/validate-staging-env.sh \
   .env.staging staging.jyotisha.chat deploy/Caddyfile.staging
 bash deploy/validate-staging-database-env.sh .env.staging.database

deploy/run-staging-migration.sh

@@ -78,6 +78,7 @@ EXPECTED_STAGING_ENV_OWNER_UID="$(stat -c '%u' "$DEPLOY_PATH" 2>/dev/null || sta
   exit 1
 }
 export EXPECTED_STAGING_ENV_OWNER_UID
+bash deploy/prepare-staging-model-provider-env.sh .env.staging
 bash deploy/validate-staging-env.sh \
   .env.staging staging.jyotisha.chat deploy/Caddyfile.staging
 bash deploy/validate-staging-database-env.sh .env.staging.database