12# Rotate SESSION_SECRET across every prod worker: scripts/rotate-session-secret.sh3#4# All hosts on the shared .tribes.pub cookie domain must hold the SAME secret5# (a session cookie minted on the apex must verify on every versioned host).6# Rotation therefore pushes one fresh value everywhere at once, plus the GH7# secret TRIBES_SESSION_SECRET (write-only mirror used by release.sh runs).8# Cost of rotation: every live session cookie stops verifying — users simply9# log in again (shoo link or device keypair re-mint). The value is never10# printed, stored on disk, or exported beyond this process.11set -euo pipefail12cd "$(dirname "$0")/.."1314WORKERS=(tribes-prod tribes-v0-4-0 tribes-v0-3-1 tribes-v0-3-0 tribes-v0-2-0 tribes-v0-1-0)1516SECRET="$(openssl rand -hex 32)"1718for w in "${WORKERS[@]}"; do19 if printf '%s' "$SECRET" | npx wrangler secret put SESSION_SECRET --name "$w" >/dev/null 2>&1; then20 echo "ok $w"21 else22 echo "skip $w (worker missing or put failed)"23 fi24done2526if command -v gh >/dev/null && printf '%s' "$SECRET" | gh secret set TRIBES_SESSION_SECRET --repo FelineStateMachine/tribes 2>/dev/null; then27 echo "ok gh secret TRIBES_SESSION_SECRET"28else29 echo "skip gh secret (gh missing or set failed)"30fi3132echo "done: rotated SESSION_SECRET on the workers marked ok; existing sessions are now logged out"