feat: Adjust AI credentials flow

backend/companion/getKcpToken.js

@@ -1,17 +1,20 @@
 export async function getKcpToken() {
   const tokenUrl = 'https://kymatest.accounts400.ondemand.com/oauth2/token';
   const grantType = 'client_credentials';
+
+  const secretManagerCredentials = getSecretManagerCredentials();
+
   const clientId =
-    process.env.COMPANION_KCP_AUTH_CLIENT_ID ?? getLocalCredentials()?.clientId;
+    secretManagerCredentials?.clientId ?? getLocalCredentials()?.clientId;
   const clientSecret =
-    process.env.COMPANION_KCP_AUTH_CLIENT_SECRET ??
+    secretManagerCredentials?.clientSecret ??
     getLocalCredentials()?.clientSecret;
 
   if (!clientId) {
-    throw new Error('COMPANION_KCP_AUTH_CLIENT_ID is not set');
+    throw new Error('Client ID is not configured.');
   }
   if (!clientSecret) {
-    throw new Error('COMPANION_KCP_AUTH_CLIENT_SECRET is not set');
+    throw new Error('Client Secret is not configured.');
   }
 
   // Prepare request data
@@ -53,3 +56,20 @@ function getLocalCredentials() {
     return null;
   }
 }
+
+function getSecretManagerCredentials() {
+  const fs = require('fs');
+  try {
+    return {
+      clientId: fs
+        .readFileSync('/secrets/companion_kcp_auth_client_id', 'utf8')
+        .trim(),
+      clientSecret: fs
+        .readFileSync('/secrets/companion_kcp_auth_client_secret', 'utf8')
+        .trim(),
+    };
+  } catch (error) {
+    console.warn('Secret Manager credentials could not be read');
+    return null;
+  }
+}