Separate event and mail delivery credentials

src/user_engine/adapters/delivery.py

@@ -17,13 +17,15 @@ class HTTPOutboxDeliveryAdapter:
         self,
         *,
         event_url: str,
-        bearer_token: str,
+        event_bearer_token: str,
         mail_url: str | None = None,
+        mail_bearer_token: str | None = None,
         timeout_seconds: float = 5.0,
     ) -> None:
         self.event_url = event_url
         self.mail_url = mail_url
-        self.bearer_token = bearer_token
+        self.event_bearer_token = event_bearer_token
+        self.mail_bearer_token = mail_bearer_token
         self.timeout_seconds = timeout_seconds
 
     def __call__(self, event: OutboxEvent) -> None:
@@ -38,22 +40,26 @@ class HTTPOutboxDeliveryAdapter:
             "data": dict(event.payload),
         }
         if self.mail_url and event.event_type in _MAIL_EVENTS:
-            self._post(self.mail_url, envelope)
+            if not self.mail_bearer_token:
+                raise RuntimeError("mail delivery token is required")
+            self._post(self.mail_url, envelope, self.mail_bearer_token)
         event_envelope = dict(envelope)
         event_data = dict(envelope["data"])
         if "primary_email" in event_data:
             event_data["recipient_present"] = True
             del event_data["primary_email"]
         event_envelope["data"] = event_data
-        self._post(self.event_url, event_envelope)
+        self._post(self.event_url, event_envelope, self.event_bearer_token)
 
-    def _post(self, url: str, envelope: dict[str, object]) -> None:
+    def _post(
+        self, url: str, envelope: dict[str, object], bearer_token: str
+    ) -> None:
         with urlopen(
             Request(
                 url,
                 data=json.dumps(envelope).encode(),
                 headers={
-                    "Authorization": f"Bearer {self.bearer_token}",
+                    "Authorization": f"Bearer {bearer_token}",
                     "Content-Type": "application/json",
                     "Idempotency-Key": str(envelope["id"]),
                 },

src/user_engine/runtime.py

@@ -52,8 +52,13 @@ def create_application() -> PortalApplication:
         )
     outbox_delivery = HTTPOutboxDeliveryAdapter(
         event_url=_required("USER_ENGINE_EVENT_URL"),
+        event_bearer_token=_required("USER_ENGINE_EVENT_TOKEN"),
         mail_url=os.environ.get("USER_ENGINE_MAIL_URL"),
-        bearer_token=_required("USER_ENGINE_DELIVERY_TOKEN"),
+        mail_bearer_token=(
+            _required("USER_ENGINE_MAIL_TOKEN")
+            if os.environ.get("USER_ENGINE_MAIL_URL")
+            else None
+        ),
         timeout_seconds=float(os.environ.get("USER_ENGINE_DELIVERY_TIMEOUT", "5")),
     )
     return PortalApplication(