Secure first-loop control-plane auth and mount routing.

Protect the control-plane API with explicit bearer auth, add node-scoped
registration/heartbeat credentials, and make export mount paths an explicit
contract field so mount profiles stay correct across runtimes.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Harivansh Rathi 2026-04-01 14:13:14 +00:00
parent a7f85f4871
commit ed40da7326
23 changed files with 3676 additions and 124 deletions

View file

@ -27,5 +27,17 @@ class ControlPlaneConfig {
return rtrim($configuredUrl, '/');
}
}
public function getApiToken(): string {
$environmentToken = getenv('BETTERNAS_CONTROL_PLANE_API_TOKEN');
if (is_string($environmentToken) && $environmentToken !== '') {
return $environmentToken;
}
return $this->appConfig->getValueString(
Application::APP_ID,
'control_plane_api_token',
'',
);
}
}