Make BraintreeConfiguration.publicKey a SecretString

service/config/sample-secrets-bundle.yml

@@ -3,6 +3,7 @@ datadog.apiKey: unset
 stripe.apiKey: unset
 stripe.idempotencyKeyGenerator: abcdefg12345678= # base64 for creating request idempotency hash
 
+braintree.publicKey: unset
 braintree.privateKey: unset
 
 googlePlayBilling.credentialsJson: |

service/config/sample.yml

@@ -57,7 +57,7 @@ stripe:
 
 braintree:
   merchantId: unset
-  publicKey: unset
+  publicKey: secret://braintree.publicKey
   privateKey: secret://braintree.privateKey
   environment: unset
   graphqlUrl: unset

service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java

@@ -740,7 +740,7 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     StripeManager stripeManager = new StripeManager(config.getStripe().apiKey().value(), subscriptionProcessorExecutor,
         config.getStripe().idempotencyKeyGenerator().value(), config.getStripe().boostDescription(), config.getStripe().supportedCurrenciesByPaymentMethod());
     BraintreeManager braintreeManager = new BraintreeManager(config.getBraintree().merchantId(),
-        config.getBraintree().publicKey(), config.getBraintree().privateKey().value(),
+        config.getBraintree().publicKey().value(), config.getBraintree().privateKey().value(),
         config.getBraintree().environment(),
         config.getBraintree().supportedCurrenciesByPaymentMethod(), config.getBraintree().merchantAccounts(),
         config.getBraintree().graphqlUrl(), currencyManager, config.getBraintree().pubSubPublisher().build(),

service/src/main/java/org/whispersystems/textsecuregcm/configuration/BraintreeConfiguration.java

@@ -27,7 +27,7 @@ import org.whispersystems.textsecuregcm.subscriptions.PaymentMethod;
  *                                        GraphQL HTTP client; if `null`, uses the global default configuration
  */
 public record BraintreeConfiguration(@NotBlank String merchantId,
-                                     @NotBlank String publicKey,
+                                     @NotNull SecretString publicKey,
                                      @NotNull SecretString privateKey,
                                      @NotBlank String environment,
                                      @Valid @NotEmpty Map<PaymentMethod, Set<@NotBlank String>> supportedCurrenciesByPaymentMethod,

service/src/test/resources/config/test-secrets-bundle.yml

@@ -4,6 +4,7 @@ aws.secretAccessKey: secretAccess
 stripe.apiKey: unset
 stripe.idempotencyKeyGenerator: abcdefg12345678= # base64 for creating request idempotency hash
 
+braintree.publicKey: unset
 braintree.privateKey: unset
 
 # The below private key was generated exclusively for testing purposes. Do not use it in any other context.

service/src/test/resources/config/test.yml

@@ -56,7 +56,7 @@ stripe:
 
 braintree:
   merchantId: unset
-  publicKey: unset
+  publicKey: secret://braintree.publicKey
   privateKey: secret://braintree.privateKey
   environment: sandbox
   graphqlUrl: unset