[loks0n]

What

The /v1/* auth hook compared the bearer against OPR_EXECUTOR_SECRET alone. Rotating that secret meant the executor and every caller had to switch at the same moment, or calls failed in between.

The executor now also accepts an optional OPR_EXECUTOR_SECRET_PREVIOUS. A rotation becomes three steps:

1. Set OPR_EXECUTOR_SECRET_PREVIOUS to the new value, so the executor accepts both.
2. Move callers to the new value. Then swap: OPR_EXECUTOR_SECRET becomes the new value, and _PREVIOUS holds the old one until every caller has moved.
3. Unset _PREVIOUS.

The comparison uses hash_equals instead of !==. Empty and "0" secrets are still refused.

Tests

• testPreviousSecretAuthorizes (e2e) checks that a request with the previous secret gets 200 on /v1/runtimes, and that an unknown secret gets 401. docker-compose.yml and .env set OPR_EXECUTOR_SECRET_PREVIOUS for it.
• Ran locally against the compose stack together with testGetRuntimesUnauthorized and testCommandsUnauthorized: 3 tests, 7 assertions, OK.
• I have not run it against the unchanged hook to see it fail.

🤖 Generated with Claude Code

[hansi-codes]

🔵 Tier A · Mergeable after minor fixes

The auth change is sound, but the README setup example needs to forward the documented variable for the feature to work there.

The executor auth hook now accepts either the primary secret or an optional previous secret, using hash_equals for comparisons. The compose configuration and end-to-end tests exercise the additional credential, and the README lists the new setting.

Verdict	New comments	Fixed	Still open
✅ Approved	1	0	0

	Finding	Where
🟡	Forward the new variable in the README compose example	README.md:210

Fix with agent prompt

### Issue 1
README.md:210
**Forward the new variable in the README compose example**

The Getting Started `docker-compose.yml` example at lines 50–64 explicitly forwards environment variables but omits `OPR_EXECUTOR_SECRET_PREVIOUS`. Setting this documented option in the example's `.env` therefore won't reach the executor, so the second key is not accepted for users following that setup.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 5

File	Change
.env	Adds a previous secret for the local compose test setup.
README.md	Documents the optional previous-secret setting.
app/controllers.php	Checks the supplied bearer against both configured secrets.
docker-compose.yml	Forwards the previous-secret environment variable to the executor.
tests/e2e/ExecutorTest.php	Tests access with the previous secret and rejection of an unknown secret.

---

_{Reviewed 220c425 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary

[hansi-codes]

Forward the new variable in the README compose example

The Getting Started docker-compose.yml example at lines 50–64 explicitly forwards environment variables but omits OPR_EXECUTOR_SECRET_PREVIOUS. Setting this documented option in the example's .env therefore won't reach the executor, so the second key is not accepted for users following that setup.

Prompt To Fix With AI

This is a comment left during a code review.
Path: README.md
Line: 210

Comment:
**Forward the new variable in the README compose example**

The Getting Started `docker-compose.yml` example at lines 50–64 explicitly forwards environment variables but omits `OPR_EXECUTOR_SECRET_PREVIOUS`. Setting this documented option in the example's `.env` therefore won't reach the executor, so the second key is not accepted for users following that setup.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟡 Minor · documentation · Reply if this doesn't apply.}