tegwick 0fb7150956 Read credentials from files, not only the environment ... Found by packaging the service for Railiance (rapp-canned-prompts). Every other rapp in the fleet mounts its database credential as a file; this service could only read CANNED_PROMPTS_DATABASE_URL from the environment, which would have put a database password into kubectl describe, into crash dumps, and in reach of anything able to read /proc. Adds CANNED_PROMPTS_DATABASE_URL_FILE and CANNED_PROMPTS_PUBLISH_TOKEN_FILE. A mounted secret stays a file. When both forms are set the file wins, because a rotated secret must take effect rather than be shadowed by a stale env var, and an unreadable secret file fails loudly rather than falling back to a value that may be older. Service tests 33 -> 36. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502		2026-09-06 21:45:29 +02:00
..
conftest.py	CANP-WP-0006 T03: read API	2026-09-06 20:23:25 +02:00
test_health.py	Read credentials from files, not only the environment	2026-09-06 21:45:29 +02:00
test_publish_api.py	CANP-WP-0006 T04: publish API	2026-09-06 20:30:00 +02:00
test_read_api.py	CANP-WP-0006 T03: read API	2026-09-06 20:23:25 +02:00
test_schema.py	CANP-WP-0006 T01-T02: service skeleton and tenant-keyed schema	2026-09-06 19:57:47 +02:00