fix: validate Sub2API pool key through admin API

scripts/src/platform-infra/apply-script.ts

@@ -258,6 +258,7 @@ export function applyScript(
         appSourcePath: secretMaterial.appSourcePath,
         sourceAction: secretMaterial.action,
         fingerprint: secretMaterial.fingerprint,
+        adminEmail: secretMaterial.adminEmail,
         valuesPrinted: false,
       }))})`;
   const exposureSecretFile = publicExposureSecretMaterial === null

scripts/src/platform-infra/entry.ts

@@ -287,6 +287,7 @@ export interface ExternalActiveSecretMaterial {
   appSourcePath: string;
   action: "create" | "update" | "none";
   fingerprint: string;
+  adminEmail: string;
   values: Record<typeof requiredSecretKeys[number], string>;
 }
 

scripts/src/platform-infra/host-docker.ts

@@ -91,7 +91,7 @@ export function hostDockerEnvFile(sub2api: Sub2ApiConfig, target: Sub2ApiTargetC
     REDIS_POOL_SIZE: "32",
     REDIS_MIN_IDLE_CONNS: "2",
     REDIS_ENABLE_TLS: "false",
-    ADMIN_EMAIL: "admin@sub2api.platform-infra.local",
+    ADMIN_EMAIL: secretMaterial.adminEmail,
     ADMIN_PASSWORD: secretMaterial.values.ADMIN_PASSWORD,
     JWT_SECRET: secretMaterial.values.JWT_SECRET,
     TOTP_ENCRYPTION_KEY: secretMaterial.values.TOTP_ENCRYPTION_KEY,
@@ -240,6 +240,7 @@ export function hostDockerApplyScript(sub2api: Sub2ApiConfig, target: Sub2ApiTar
     appSourcePath: secretMaterial.appSourcePath,
     sourceAction: secretMaterial.action,
     fingerprint: secretMaterial.fingerprint,
+    adminEmail: secretMaterial.adminEmail,
     valuesPrinted: false,
   };
   return `

scripts/src/platform-infra/secrets-and-egress.ts

@@ -64,6 +64,7 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
   const existing = existedBefore ? parseEnvFile(readFileSync(appSourcePath, "utf8")) : {};
   const next = { ...existing };
   next.POSTGRES_PASSWORD = dbPassword;
+  if (next.ADMIN_EMAIL === undefined || next.ADMIN_EMAIL.length === 0) next.ADMIN_EMAIL = "admin@sub2api.platform-infra.local";
   if (next.ADMIN_PASSWORD === undefined || next.ADMIN_PASSWORD.length === 0) next.ADMIN_PASSWORD = randomBytes(16).toString("hex");
   if (next.JWT_SECRET === undefined || next.JWT_SECRET.length === 0) next.JWT_SECRET = randomBytes(32).toString("hex");
   if (next.TOTP_ENCRYPTION_KEY === undefined || next.TOTP_ENCRYPTION_KEY.length === 0) next.TOTP_ENCRYPTION_KEY = randomBytes(32).toString("hex");
@@ -75,12 +76,13 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
   };
   const missing = requiredSecretKeys.filter((key) => values[key].length === 0);
   if (missing.length > 0) throw new Error(`external-active app secret source is missing ${missing.join(", ")}`);
+  const managedAppSourceKeys = [...requiredSecretKeys, "ADMIN_EMAIL"] as const;
   const action = !existedBefore
     ? "create"
-    : requiredSecretKeys.some((key) => existing[key] !== values[key])
+    : managedAppSourceKeys.some((key) => existing[key] !== next[key])
       ? "update"
       : "none";
-  if (action !== "none") writeEnvFile(appSourcePath, { ...existing, ...values });
+  if (action !== "none") writeEnvFile(appSourcePath, { ...existing, ...values, ADMIN_EMAIL: next.ADMIN_EMAIL });
   return {
     sourceRef: database.sourceRef,
     sourcePath: dbSource.sourcePathRedacted,
@@ -88,6 +90,7 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
     appSourcePath: redactRepoPath(appSourcePath),
     action,
     fingerprint: fingerprintSecretValues(values, [...requiredSecretKeys]),
+    adminEmail: next.ADMIN_EMAIL,
     values,
   };
 }