From 79a3b47f1d1c2114ace6ba71d32f739595639e1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Wed, 4 Nov 2026 16:41:44 +0400
Subject: [PATCH] Upgrade Liquor Cabinet to 2.0.0-rc.2 and enable hashed access
 tokens

---
 site-cookbooks/liquor_cabinet/CHANGELOG.md             | 7 +++++++
 site-cookbooks/liquor_cabinet/attributes/default.rb    | 3 ++-
 site-cookbooks/liquor_cabinet/metadata.rb              | 2 +-
 site-cookbooks/liquor_cabinet/recipes/default.rb       | 3 ++-
 site-cookbooks/liquor_cabinet/templates/config.yml.erb | 1 +
 5 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/site-cookbooks/liquor_cabinet/CHANGELOG.md b/site-cookbooks/liquor_cabinet/CHANGELOG.md
index 8191071..53476bf 100644
--- a/site-cookbooks/liquor_cabinet/CHANGELOG.md
+++ b/site-cookbooks/liquor_cabinet/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 This file is used to list changes made in each version of the liquor_cabinet cookbook.
 
+## 0.3.0
+
+- Pin Liquor Cabinet to the 2.0.0-rc.2 release.
+- Enable hashed remoteStorage access token lookup (`hashed_access_tokens`),
+  so authorizations are read by the SHA256 digest of the bearer token, with
+  the plaintext key kept as a fallback.
+
 ## 0.2.0
 
 - Add Redis password support.
diff --git a/site-cookbooks/liquor_cabinet/attributes/default.rb b/site-cookbooks/liquor_cabinet/attributes/default.rb
index 467aebb..e0045fd 100644
--- a/site-cookbooks/liquor_cabinet/attributes/default.rb
+++ b/site-cookbooks/liquor_cabinet/attributes/default.rb
@@ -2,7 +2,7 @@ node.default['liquor-cabinet']['app_name'] = "liquor-cabinet"
 node.default['liquor-cabinet']['user'] = "deploy"
 node.default['liquor-cabinet']['group'] = "deploy"
 node.default['liquor-cabinet']['repo'] = 'https://gitea.kosmos.org/5apps/liquor-cabinet.git'
-node.default['liquor-cabinet']['revision'] = 'master'
+node.default['liquor-cabinet']['revision'] = '2.0.0-rc.2'
 node.default['liquor-cabinet']['deploy_path'] = "/opt/#{node['liquor-cabinet']['app_name']}"
 node.default['liquor-cabinet']['redis_server_role'] = 'redis_server'
 node.default['liquor-cabinet']['redis_port'] = 6379
@@ -12,6 +12,7 @@ node.default['liquor-cabinet']['s3_region'] = nil
 node.default['liquor-cabinet']['s3_bucket'] = nil
 node.default['liquor-cabinet']['ufw_source_allowed'] = nil
 node.default['liquor-cabinet']['maintenance_mode_enabled'] = false
+node.default['liquor-cabinet']['hashed_access_tokens'] = true
 node.default['liquor-cabinet']['ruby']['version'] = "3.1.4"
 node.default['liquor-cabinet']['rainbows'] = {
   'port' => 3000,
diff --git a/site-cookbooks/liquor_cabinet/metadata.rb b/site-cookbooks/liquor_cabinet/metadata.rb
index 20eecaa..0998949 100644
--- a/site-cookbooks/liquor_cabinet/metadata.rb
+++ b/site-cookbooks/liquor_cabinet/metadata.rb
@@ -3,7 +3,7 @@ maintainer 'Kosmos Developers'
 maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures the Liquor Cabinet remoteStorage API server'
-version '0.2.0'
+version '0.3.0'
 chef_version '>= 18.2'
 issues_url 'https://gitea.kosmos.org/kosmos/chef/issues'
 # source_url 'https://gitea.kosmos.org/kosmos/chef'
diff --git a/site-cookbooks/liquor_cabinet/recipes/default.rb b/site-cookbooks/liquor_cabinet/recipes/default.rb
index 027b2fd..49e78f1 100644
--- a/site-cookbooks/liquor_cabinet/recipes/default.rb
+++ b/site-cookbooks/liquor_cabinet/recipes/default.rb
@@ -79,7 +79,8 @@ template "#{deploy_path}/config.yml.erb" do
             s3_bucket: node[app_name]['s3_bucket'],
             s3_access_key: credentials['s3_access_key'],
             s3_secret_key: credentials['s3_secret_key'],
-            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled']
+            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled'],
+            hashed_access_tokens: node[app_name]['hashed_access_tokens']
             # TODO sentry_dsn: credentials['sentry_dsn']
   notifies :restart, "service[#{app_name}]", :delayed
 end
diff --git a/site-cookbooks/liquor_cabinet/templates/config.yml.erb b/site-cookbooks/liquor_cabinet/templates/config.yml.erb
index 810dea2..dc7c1d8 100644
--- a/site-cookbooks/liquor_cabinet/templates/config.yml.erb
+++ b/site-cookbooks/liquor_cabinet/templates/config.yml.erb
@@ -1,5 +1,6 @@
 <%= @environment %>:
   maintenance: <%= @maintenance_mode_enabled %>
+  hashed_access_tokens: <%= @hashed_access_tokens %>
   redis:
     host: <%= @redis_host %>
     port: <%= @redis_port %>