Moves a bucket's cloud keys into the Integrations system.
A bucket used to carry its own access_key_id / secret_access_key. Keys now
belong to an object_storage connection (Settings → Integrations), which
buckets reference by integration_uuid: one place to rotate or revoke a key,
one encrypted copy, and the same connection can serve several buckets.
A bucket that still carries its own keys is legacy and keeps working for
as long as it is left alone: Providers.S3.resolve_credentials/1 reads either
source. Nothing here runs by itself. An operator moves a bucket, or all of
them, on purpose, and move_to_integration/2 refuses to clear a key it could
not read back through the new connection.
The bucket keeps its own region and endpoint. They are not secrets, and
reading them from the connection would put a settings lookup behind every
public URL a file grid builds.
Summary
Functions
Whether bucket is a cloud bucket that still carries its own keys, with no
connection set.
Every bucket that still carries its own keys.
Moves every legacy bucket. Returns [{bucket, {:ok, moved} | {:error, reason}}],
one entry per bucket that was tried; a bucket that fails does not stop the rest.
Moves one bucket's keys into a system object_storage connection.
The Integrations provider key a bucket's keys move into.
Types
@type reason() :: :not_legacy | :unreadable_credentials | :credentials_mismatch | Ecto.Changeset.t() | term()
Functions
@spec legacy?(PhoenixKit.Modules.Storage.Bucket.t()) :: boolean()
Whether bucket is a cloud bucket that still carries its own keys, with no
connection set.
@spec legacy_buckets() :: [PhoenixKit.Modules.Storage.Bucket.t()]
Every bucket that still carries its own keys.
@spec move_all_to_integrations(keyword()) :: [ {PhoenixKit.Modules.Storage.Bucket.t(), {:ok, PhoenixKit.Modules.Storage.Bucket.t()} | {:error, reason()}} ]
Moves every legacy bucket. Returns [{bucket, {:ok, moved} | {:error, reason}}],
one entry per bucket that was tried; a bucket that fails does not stop the rest.
@spec move_to_integration(PhoenixKit.Modules.Storage.Bucket.t(), keyword()) :: {:ok, PhoenixKit.Modules.Storage.Bucket.t()} | {:error, reason()}
Moves one bucket's keys into a system object_storage connection.
A connection that already holds the same key pair is reused, so buckets in one account share a single connection. Otherwise one is created, named after the bucket. The bucket's own keys are cleared only after the connection is read back and returns exactly the keys the bucket had; any failure rolls the whole move back, the new connection included.
Options: :actor_uuid (recorded on the connection's activity entries).
@spec provider_key() :: String.t()
The Integrations provider key a bucket's keys move into.