From dc33b0e687472659854c96de26d488772d7885a9 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sat, 31 Oct 2026 13:59:56 -0700
Subject: [PATCH] fix(paperless): align the stale client-secret key with the
 live secret

The paperless-oidc Secret carries the OIDC client secret twice: once as
`client-secret` and once inside SOCIALACCOUNT_PROVIDERS_JSON, which is what
allauth actually reads. Only the JSON copy was updated during the ZITADEL
migration, so `client-secret` held a superseded rotation.

That is invisible in normal use but makes the Secret misleading to verify:
a token-endpoint probe using `client-secret` answers "invalid secret" while
Paperless itself logs in fine. Both keys now carry the same live value.
---
 k8s/argocd/secrets/paperless-oidc.enc.yaml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/k8s/argocd/secrets/paperless-oidc.enc.yaml b/k8s/argocd/secrets/paperless-oidc.enc.yaml
index 8bfc0bb..a230cf1 100644
--- a/k8s/argocd/secrets/paperless-oidc.enc.yaml
+++ b/k8s/argocd/secrets/paperless-oidc.enc.yaml
@@ -8,20 +8,20 @@ metadata:
         app.kubernetes.io/part-of: iam
 type: Opaque
 stringData:
-    SOCIALACCOUNT_PROVIDERS_JSON: ENC[AES256_GCM,data:mz6fvwB8/E881pnl0fX2sXj5vdnGUoN0jQsYX7OqzRhZxAmXwvsIt3ZdqXPdoz8xXJOM+2P082aFV24q5jKjU6m4pGVxZT79kooNQdPImcthBl/1oSvgbuQrKnX9kDdlcfTaONckya1SycXyixyqWIx+dQmosLcPXQZgVrbJ0XgPYAnHAqdNB8S0yLNCPQMmf+isC+JQY/iw5gVYbVehTTZnJkZoh07d2amMFLbx1janzKuGWsSeXEEwFPfntBEDcq8CMD+uGfZmiaunTvztLZCIYfm/ZriBeWroY42nrncAhBcjMWfT7hFjK6I+SMY1+/uDjVuhlmg96C6uwnFBgzTDiqz46W8kg+qYVg3DAO1KdORL84N54vhMOj+NMoG0GxL1SW4M9JPoMCjnkpVvhE0C6m9MeNcV5CEDN+wPQuoDA60F5NrGmp9cnPD4GVXBOGqdUjr9QQbfkZeGrzIyREYS5krBD/89mx7a,iv:dCXz2VwJGXqKnETGEKrtg8afTjQZ80fdQetQkQbWFmA=,tag:3fSADqRQrqE2Kmap0cMYCQ==,type:str]
-    client-secret: ENC[AES256_GCM,data:960UNsowQT3xrBdQ0pD4VrFQSFFi/2yiN3RPVnK4a0yySDjcxlsZVLn0fWnLEVHbmAWEe10j36xhGS2pzTx06A==,iv:ztpJi0zHCKx7Jjk40wtDNHhatr2vCOMdD8XIUnfIzTU=,tag:efTUtQmPvteeEtX9ZOT1nw==,type:str]
+    SOCIALACCOUNT_PROVIDERS_JSON: ENC[AES256_GCM,data:/muYqHv+LRPhAl3u7uHv1a0O9vG9nZ0zJawcAmUTHA1x3VKnoaiqQCQrYL8Mg4TtOkXHn/ESwuq5Nbyr/P3E6n9C6BG7Dg7/7vtj/OiL6URN8apjsKQvQAswfycmhWJZV8kMRJNT9IBWjQ9D02MhLan+WwVBWOlT2bWBa+mMogBRgNSorbTRYXao24Qh2KRS9NRDCyOQ0Mp386tyjC9JQzXJ4R82RNh9VuipfPFgo4Mk/wXUihft/lMe1xcVrgl8uxecspbOFlgUMjtuhfEHc+tIVxD5P3I8RwXKFNtO1Yol8tnRAl2liOPaYWCRMQkOqFj5FUrJ0n1Q+vFmf8kjUmPASD1k22LDbywdOQKHeg9YYtbdg/barXrBSeshw69XqlfDlrjf3Zjjd+FSfUzQCLKS9b3xh4d8t8M+9U8DvcuOynwiL5CoinpgYamfNZkKrsSYyDVyNMh2feCSb1q/9B+lNMoJBQyT6E+S,iv:ab2EzS3CKYDaLtkLUq2O2OKz/bGFeGd39/NUWHeJxPw=,tag:ToRTsuNQIlE3CwTwoyhlaA==,type:str]
+    client-secret: ENC[AES256_GCM,data:aN5d4DLlEtKj1rjhisMuHKoT7+6UMsRjXtc22UIa8sEOvSrEWOiDraA1lziFXv9crl9q8k0SMbKdSYNtXDiIrQ==,iv:ZXHezTA/8oi+8FdKsc2UKAKCLGqh4u4o68IeIeAskMQ=,tag:4U1d99cAq5EEhNh3ftvQzw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdW01dUY4ZXZYeWdWeU5B
-            Uk9kUkRDS2tLUXc5dVVMOFJJVUcxbmtEbjNVCk4vK3ZVYlppT0lwSGtTeXJiM1ZU
-            SEZyTWlrYjNVNFBxU01YcGs1Q2YrOEEKLS0tIHlyR2JnWDBpUkcyUTNDM2IxMjkr
-            NTROVkVyd3RpS014WktISi9Ba3dZOE0KoP8Q30KCrLF+mqVIIfp6k6B727yiUBIj
-            1H3krVQt6eOadTZZd+EPS0nvJA4wzUyaCco6oiB00gckhPnZu8m4jw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3M1dsQ1pqU3VLN2RGK3Rj
+            dlkzYWF3VThuQVhOVmg2QXFBUlFIcW1BYjFnCkgxQVQ0MmJwY0NmNjRocHdtNXR1
+            LytjZUU1WkEwOXRYVGhab0xMQ2xKaGcKLS0tIGZ5UjNHRjRLSVJlNWQrM2srSktY
+            S0tGYWhJdTdpU3VidGNBeVI4MHVUYWMKOTEqu+u5fWhG/Gwc+GMCY6WBOvNLMwPN
+            bwghAsCteT3k8SuEWql/hLNlfVzFLuPMYFBtUywk2QGhi59ziz+BiQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-10-31T03:41:24Z"
-    mac: ENC[AES256_GCM,data:xB4NS9KAjJ9e14kCrP87PcXyW5F4eBNwWnmkBOXYAVb9RMsFuEG6zAslENLur+LBO2TYyYE+YSV0HVvGICU2jJ8LxsJXdfCm0ADxrhkBcneBgLwqDPMURZDwQSCLJxdh3AyV2+vRDGdrjyjzUE507fWpYd84HPEgyrVJ4w+V6TA=,iv:foISE6qjTurY6Mll8FEdirvx9QXOalsUPdWx+sK59CM=,tag:3hmGRXsMFkKw4+VYcNypdA==,type:str]
+    lastmodified: "2026-10-31T20:59:50Z"
+    mac: ENC[AES256_GCM,data:KU760wyocphtQfBrVc2qlZffj4f+jOOcJowwO4TOiaAd5PqPU/PL+y6gPuT6LpK8Vt9pUhncZDjn/T/9K995oQoNzYgpm5ihyDhQbzHjszzlsA8Kbg1c/PAxy1r1kU8HahvuO9qlYa2k68NO8g0qnFByvR6oIF/lSFavXIaINOw=,iv:u+9OuFSgyx7L9WHBi0vv6GnOm5W5zk5y1N1HEKwS0Fs=,tag:9+H9NsFEKer4hQMs8yql3w==,type:str]
     version: 3.13.2