feat: manage epay settings securely

deploy/.env.staging.identity.example

@@ -16,4 +16,6 @@ BETTER_AUTH_USER_SECRET=<independent-openssl-rand-base64-32-output>
 RESEND_API_KEY=<staging-only-resend-api-key>
 RESEND_FROM_EMAIL=Jyotisha Staging <login@staging.jyotisha.chat>
 ADMIN_EMAILS=<comma-separated-staging-admin-emails>
+EPAY_CONFIG_ENCRYPTION_KEY=<independent-openssl-rand-base64-32-output>
+EPAY_CHAT_ENABLED=false
 JYOTISH_DYNAMIC_RECTIFICATION_TOKEN=<independent-openssl-rand-base64-32-output>

deploy/README.md

@@ -73,6 +73,14 @@ NEXT_PUBLIC_SUPABASE_ANON_KEY=...
 SUPABASE_SERVICE_ROLE_KEY=...
 ADMIN_EMAILS=...
 
+# Required to save/read database-backed 易支付 settings. Base64 decoding must
+# produce exactly 32 random bytes. Generate independently; never reuse auth keys.
+EPAY_CONFIG_ENCRYPTION_KEY=<independent-base64-encoded-32-byte-key>
+# Legacy EPAY_GATEWAY_URL / EPAY_PID / EPAY_KEY / EPAY_NOTIFY_URL /
+# EPAY_RETURN_URL / EPAY_SITE_NAME remain fallback-only when no database row exists.
+# Online packages stay hidden by default; only explicit true enables the fallback.
+EPAY_CHAT_ENABLED=false
+
 # Conversational birth-time rectification rollout controls.
 # Keep migrations false until the ordered database gate below has passed.
 RECTIFICATION_PRICE_CREDITS=3

deploy/validate-staging-env.sh

@@ -97,6 +97,13 @@ if [[ "$LITERAL_VALUE" != *@* ]]; then
   echo "invalid staging identity setting: ADMIN_EMAILS" >&2
   exit 1
 fi
+require_literal EPAY_CONFIG_ENCRYPTION_KEY 44
+if [ "${#LITERAL_VALUE}" -ne 44 ] ||
+  [[ ! "$LITERAL_VALUE" =~ ^[A-Za-z0-9+/]{43}=$ ]]; then
+  echo "invalid staging identity setting: EPAY_CONFIG_ENCRYPTION_KEY" >&2
+  exit 1
+fi
+require_selector EPAY_CHAT_ENABLED false
 require_literal JYOTISH_DYNAMIC_RECTIFICATION_TOKEN 32
 
 echo "staging environment selectors: valid"