Wire LOGIN_INTERNAL_API_KEY env var into backend deploy

Author: hg1g

.env.example

@@ -18,6 +18,13 @@ OSM_REDIRECT_URI=https://dev.login.hotosm.org/api/auth/osm/callback
 OSM_URL=https://www.openstreetmap.org
 OSM_SCOPE=read_prefs
 
+# ==========================================
+# Internal service-to-service shared secret
+# Used by consumer projects (fAIr, drone-tm, OAM) to resolve PATs
+# Same value must be set on each consumer project
+# ==========================================
+LOGIN_INTERNAL_API_KEY=
+
 # ==========================================
 # SMTP Configuration (for email verification)
 # ==========================================

.github/workflows/deploy-dev.yml

@@ -171,6 +171,11 @@ jobs:
             sed -i 's|^OSM_CLIENT_ID=.*|OSM_CLIENT_ID=${{ secrets.OSM_CLIENT_ID }}|' .env
             sed -i 's|^OSM_CLIENT_SECRET=.*|OSM_CLIENT_SECRET=${{ secrets.OSM_CLIENT_SECRET }}|' .env
             sed -i 's|^OSM_REDIRECT_URI=.*|OSM_REDIRECT_URI=${{ secrets.OSM_REDIRECT_URI }}|' .env
+            if grep -q '^LOGIN_INTERNAL_API_KEY=' .env; then
+              sed -i 's|^LOGIN_INTERNAL_API_KEY=.*|LOGIN_INTERNAL_API_KEY=${{ secrets.LOGIN_INTERNAL_API_KEY }}|' .env
+            else
+              echo 'LOGIN_INTERNAL_API_KEY=${{ secrets.LOGIN_INTERNAL_API_KEY }}' >> .env
+            fi
             echo "✓ Updated secrets in .env"
 
             # Login to GitHub Container Registry

docker-compose.yml

@@ -155,6 +155,7 @@ services:
       - OSM_URL=${OSM_URL:-https://www.openstreetmap.org}
       - OSM_SCOPE=${OSM_SCOPE:-read_prefs}
       - LOG_LEVEL=INFO
+      - LOGIN_INTERNAL_API_KEY=${LOGIN_INTERNAL_API_KEY}
       - ADMIN_EMAILS=hernangigena@gmail.com,justina@animus.com.ar,andreatchirillano@hotmail.com,emilio.mariscal@hotosm.org,dakota.benjamin@hotosm.org,sam.woodcock@hotosm.org
       # App URLs for admin proxy (public URLs, not internal Docker)
       - DRONETM_BACKEND_URL=https://dev.drone.hotosm.org