From 5a953b56b158ad59799753a92fba8fbc01416d3d Mon Sep 17 00:00:00 2001 From: Tim Paine <3105306+timkpaine@users.noreply.github.com> Date: Tue, 6 Oct 2026 19:20:25 -0400 Subject: [PATCH] Add a Symphony backend preset for RSA key authentication The symphony preset authenticates with a certificate, so every bot using an RSA private key has to hand-write an override. RSA is what symphony-bdk configurations use and what Symphony's developer sandbox issues, so it is worth a preset of its own. backend=symphony_rsa sets bot_private_key_path from SYMPHONY_BOT_PRIVATE_KEY_PATH, keeping the key on disk rather than in the environment, as the certificate preset does. The certificate preset is unchanged. Verified by running csp-bot against a Symphony developer sandbox bot with backend=[symphony_rsa]: the config resolves and the bot connects. Signed-off-by: Tim Paine <3105306+timkpaine@users.noreply.github.com> --- csp_bot/config/backend/symphony_rsa.yaml | 15 +++++++++++++++ docs/wiki/Backends.md | 20 +++++++++++--------- 2 files changed, 26 insertions(+), 9 deletions(-) create mode 100644 csp_bot/config/backend/symphony_rsa.yaml diff --git a/csp_bot/config/backend/symphony_rsa.yaml b/csp_bot/config/backend/symphony_rsa.yaml new file mode 100644 index 0000000..7871c69 --- /dev/null +++ b/csp_bot/config/backend/symphony_rsa.yaml @@ -0,0 +1,15 @@ +# @package modules.bot.config +# Symphony authenticated with an RSA private key rather than a certificate. +# +# This is what `symphony-bdk` configurations use, and what Symphony's developer +# sandbox issues, so it is offered alongside the certificate preset rather than +# left to a hand-written override. +symphony: + _target_: csp_bot.SymphonyConfig + bot_name: ${bot_name} + config: + _target_: chatom.symphony.SymphonyConfig + host: ${oc.env:SYMPHONY_HOST} + bot_username: ${oc.env:SYMPHONY_BOT_USERNAME} + # A path keeps long-lived key material out of the process environment. + bot_private_key_path: ${oc.env:SYMPHONY_BOT_PRIVATE_KEY_PATH} diff --git a/docs/wiki/Backends.md b/docs/wiki/Backends.md index b9bf7fa..244da72 100644 --- a/docs/wiki/Backends.md +++ b/docs/wiki/Backends.md @@ -20,26 +20,28 @@ pip install csp-adapter-slack csp-adapter-telegram Each backend reads its credentials from environment variables, matching the names used by the built-in `backend` configs. -| Backend | Environment variables | `chatom` config field | -| :------- | :------------------------------------------------------------- | :--------------------------------------------- | -| Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `bot_token`, `app_token` | -| Discord | `DISCORD_TOKEN` | `token` | -| Symphony | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH` | `host`, `bot_username`, `bot_certificate_path` | -| Telegram | `TELEGRAM_BOT_TOKEN` | `bot_token` | +| Backend | Environment variables | `chatom` config field | +| :------------- | :------------------------------------------------------------------------ | :--------------------------------------------- | +| Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `bot_token`, `app_token` | +| Discord | `DISCORD_TOKEN` | `token` | +| Symphony | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH` | `host`, `bot_username`, `bot_certificate_path` | +| Symphony (RSA) | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_BOT_PRIVATE_KEY_PATH` | `host`, `bot_username`, `bot_private_key_path` | +| Telegram | `TELEGRAM_BOT_TOKEN` | `bot_token` | Symphony needs a host, a bot username, and either a certificate or an RSA private key. -The built-in preset uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`); a path keeps long-lived key material out of the process environment. +Two presets cover both: `backend=symphony` uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`), and `backend=symphony_rsa` uses an RSA private key (`bot_private_key_path`), which is what `symphony-bdk` configurations and Symphony's developer sandbox use. +Either way a path keeps long-lived key material out of the process environment. Discord's `message_content` is a [privileged intent](https://discord.com/developers/docs/topics/gateway#privileged-intents). The built-in preset requests it, but it must also be enabled for the bot in the Discord Developer Portal, or the bot will not receive command text in guild channels. -To set a field other than the defaults — for example, to authenticate Symphony with an RSA key instead of a certificate — override it in your own config: +To set a field neither preset covers, override it in your own config: ```yaml # @package modules.bot.config symphony: config: - bot_private_key_path: /path/to/bot-key.pem + key_manager_host: km.example.com ``` For platform-specific setup of tokens and bot accounts, follow the adapter guides: