From 6e42b2898c38e2b59dcd8a41c662f14a36a0eae6 Mon Sep 17 00:00:00 2001
From: Chris Eager <chris@signal.org>
Date: Wed, 1 Oct 2025 12:15:37 -0500
Subject: [PATCH] Make BraintreeConfiguration.publicKey a SecretString

---
 service/config/sample-secrets-bundle.yml                        | 1 +
 service/config/sample.yml                                       | 2 +-
 .../org/whispersystems/textsecuregcm/WhisperServerService.java  | 2 +-
 .../textsecuregcm/configuration/BraintreeConfiguration.java     | 2 +-
 service/src/test/resources/config/test-secrets-bundle.yml       | 1 +
 service/src/test/resources/config/test.yml                      | 2 +-
 6 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/service/config/sample-secrets-bundle.yml b/service/config/sample-secrets-bundle.yml
index 2f14cc6d1..c136bf451 100644
--- a/service/config/sample-secrets-bundle.yml
+++ b/service/config/sample-secrets-bundle.yml
@@ -3,6 +3,7 @@ datadog.apiKey: unset
 stripe.apiKey: unset
 stripe.idempotencyKeyGenerator: abcdefg12345678= # base64 for creating request idempotency hash
 
+braintree.publicKey: unset
 braintree.privateKey: unset
 
 googlePlayBilling.credentialsJson: |
diff --git a/service/config/sample.yml b/service/config/sample.yml
index 8c7cd5d71..9f684c2f9 100644
--- a/service/config/sample.yml
+++ b/service/config/sample.yml
@@ -57,7 +57,7 @@ stripe:
 
 braintree:
   merchantId: unset
-  publicKey: unset
+  publicKey: secret://braintree.publicKey
   privateKey: secret://braintree.privateKey
   environment: unset
   graphqlUrl: unset
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
index 427a4ce67..2bb6110e3 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -740,7 +740,7 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
     StripeManager stripeManager = new StripeManager(config.getStripe().apiKey().value(), subscriptionProcessorExecutor,
         config.getStripe().idempotencyKeyGenerator().value(), config.getStripe().boostDescription(), config.getStripe().supportedCurrenciesByPaymentMethod());
     BraintreeManager braintreeManager = new BraintreeManager(config.getBraintree().merchantId(),
-        config.getBraintree().publicKey(), config.getBraintree().privateKey().value(),
+        config.getBraintree().publicKey().value(), config.getBraintree().privateKey().value(),
         config.getBraintree().environment(),
         config.getBraintree().supportedCurrenciesByPaymentMethod(), config.getBraintree().merchantAccounts(),
         config.getBraintree().graphqlUrl(), currencyManager, config.getBraintree().pubSubPublisher().build(),
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/BraintreeConfiguration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/BraintreeConfiguration.java
index a2c9e74d2..b22c396f4 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/BraintreeConfiguration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/BraintreeConfiguration.java
@@ -27,7 +27,7 @@ import org.whispersystems.textsecuregcm.subscriptions.PaymentMethod;
  *                                        GraphQL HTTP client; if `null`, uses the global default configuration
  */
 public record BraintreeConfiguration(@NotBlank String merchantId,
-                                     @NotBlank String publicKey,
+                                     @NotNull SecretString publicKey,
                                      @NotNull SecretString privateKey,
                                      @NotBlank String environment,
                                      @Valid @NotEmpty Map<PaymentMethod, Set<@NotBlank String>> supportedCurrenciesByPaymentMethod,
diff --git a/service/src/test/resources/config/test-secrets-bundle.yml b/service/src/test/resources/config/test-secrets-bundle.yml
index 2a59f475a..bfa7c7490 100644
--- a/service/src/test/resources/config/test-secrets-bundle.yml
+++ b/service/src/test/resources/config/test-secrets-bundle.yml
@@ -4,6 +4,7 @@ aws.secretAccessKey: secretAccess
 stripe.apiKey: unset
 stripe.idempotencyKeyGenerator: abcdefg12345678= # base64 for creating request idempotency hash
 
+braintree.publicKey: unset
 braintree.privateKey: unset
 
 # The below private key was generated exclusively for testing purposes. Do not use it in any other context.
diff --git a/service/src/test/resources/config/test.yml b/service/src/test/resources/config/test.yml
index b4e75036e..07a52741f 100644
--- a/service/src/test/resources/config/test.yml
+++ b/service/src/test/resources/config/test.yml
@@ -56,7 +56,7 @@ stripe:
 
 braintree:
   merchantId: unset
-  publicKey: unset
+  publicKey: secret://braintree.publicKey
   privateKey: secret://braintree.privateKey
   environment: sandbox
   graphqlUrl: unset