Resolve typed credentials safely

2026-09-07 04:29:00 +00:00
parent d31ba5a410
commit 92432232ef
34 changed files with 572 additions and 260 deletions
--- a/internal/adapters/audita/subprocess.go
+++ b/internal/adapters/audita/subprocess.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/url"
-	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -24,7 +23,8 @@ const MaxReportOutputBytes int64 = 16 * 1024 * 1024
 type SubprocessRunnerConfig struct {
 	Binary                   string
 	Timeout                  time.Duration
-	LLMAPIKeyEnv             string
+	LLMAPIKey                string
+	LLMAPIKeyReference       string
 	Modules                  []string
 	BaseURL                  string
 	Model                    string
@@ -43,7 +43,8 @@ type SubprocessRunnerConfig struct {
 type SubprocessRunner struct {
 	binary                   string
 	timeout                  time.Duration
-	llmAPIKeyEnv             string
+	llmAPIKey                string
+	llmAPIKeyReference       string
 	modules                  []string
 	baseURL                  string
 	model                    string
@@ -62,7 +63,8 @@ type SubprocessRunner struct {
 func NewSubprocessRunnerFromConfigValues(
 	binary string,
 	timeout string,
-	llmAPIKeyEnv string,
+	llmAPIKey string,
+	llmAPIKeyReference string,
 	modules []string,
 	baseURL string,
 	model string,
@@ -86,7 +88,8 @@ func NewSubprocessRunnerFromConfigValues(
 	return NewSubprocessRunner(SubprocessRunnerConfig{
 		Binary:                   binary,
 		Timeout:                  parsedTimeout,
-		LLMAPIKeyEnv:             llmAPIKeyEnv,
+		LLMAPIKey:                llmAPIKey,
+		LLMAPIKeyReference:       llmAPIKeyReference,
 		Modules:                  modules,
 		BaseURL:                  baseURL,
 		Model:                    model,
@@ -110,6 +113,9 @@ func NewSubprocessRunner(cfg SubprocessRunnerConfig) (*SubprocessRunner, error)
 	if cfg.Timeout <= 0 {
 		return nil, fmt.Errorf("audita timeout must be > 0")
 	}
+	if (cfg.LLMAPIKey == "") != (strings.TrimSpace(cfg.LLMAPIKeyReference) == "") {
+		return nil, fmt.Errorf("audita credential value and reference must be provided together")
+	}
 	for i, module := range cfg.Modules {
 		if strings.TrimSpace(module) == "" {
 			return nil, fmt.Errorf("audita module at index %d is empty", i)
@@ -152,7 +158,8 @@ func NewSubprocessRunner(cfg SubprocessRunnerConfig) (*SubprocessRunner, error)
 	return &SubprocessRunner{
 		binary:                   strings.TrimSpace(cfg.Binary),
 		timeout:                  cfg.Timeout,
-		llmAPIKeyEnv:             strings.TrimSpace(cfg.LLMAPIKeyEnv),
+		llmAPIKey:                cfg.LLMAPIKey,
+		llmAPIKeyReference:       strings.TrimSpace(cfg.LLMAPIKeyReference),
 		modules:                  modules,
 		baseURL:                  strings.TrimSpace(cfg.BaseURL),
 		model:                    strings.TrimSpace(cfg.Model),
@@ -195,16 +202,10 @@ func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishRe
 	}
 	args := r.buildArgs(req, reqModules)

-	credentialEnvVar := strings.TrimSpace(r.llmAPIKeyEnv)
-	credentialPresent := false
+	credentialPresent := r.llmAPIKeyReference != ""
 	env := map[string]string{}
-	if credentialEnvVar != "" {
-		credential, ok := os.LookupEnv(credentialEnvVar)
-		if !ok || strings.TrimSpace(credential) == "" {
-			return PolishResult{}, fmt.Errorf("audita: required credential environment variable %s is not set", credentialEnvVar)
-		}
-		env["AUDITA_LLM_API_KEY"] = credential
-		credentialPresent = true
+	if credentialPresent {
+		env["AUDITA_LLM_API_KEY"] = r.llmAPIKey
 	}

 	if req.GeneratedConfigPath != "" {
@@ -269,7 +270,7 @@ func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishRe
 			"total_llm_concurrency":      r.totalLLMConcurrency,
 			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
 			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyEnv,
+			"credential_env_var":         r.llmAPIKeyReference,
 			"credential_present":         credentialPresent,
 		},
 	}, nil
@@ -299,7 +300,7 @@ func (r *SubprocessRunner) failureResult(req PolishRequest, modules []string, ru
 			"total_llm_concurrency":      r.totalLLMConcurrency,
 			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
 			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyEnv,
+			"credential_env_var":         r.llmAPIKeyReference,
 			"credential_present":         credentialPresent,
 		},
 	}
@@ -375,7 +376,7 @@ func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args []strin
 		"output_path":                req.OutputProcessedPath,
 		"report_path":                req.ReportPath,
 		"work_dir":                   req.WorkDir,
-		"credential_env_var":         r.llmAPIKeyEnv,
+		"credential_env_var":         r.llmAPIKeyReference,
 		"credential_present":         credentialPresent,
 	}
 	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
--- a/internal/adapters/audita/subprocess_test.go
+++ b/internal/adapters/audita/subprocess_test.go
@@ -27,7 +27,8 @@ func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
 	runner, err := NewSubprocessRunner(SubprocessRunnerConfig{
 		Binary:                   wrapper,
 		Timeout:                  mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv:             "OPENAI_KEY_SOURCE",
+		LLMAPIKey:                "super-secret",
+		LLMAPIKeyReference:       "OPENAI_KEY_SOURCE",
 		Modules:                  []string{"glossary", "homophones", "glossary"},
 		BaseURL:                  "https://openrouter.ai/api/v1",
 		Model:                    "openrouter/google/gemma-4-31b-it",
@@ -44,6 +45,7 @@ func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
 	if err != nil {
 		t.Fatalf("NewSubprocessRunner() error = %v", err)
 	}
+	t.Setenv("OPENAI_KEY_SOURCE", "changed-after-resolution")

 	dir := t.TempDir()
 	req := PolishRequest{
@@ -128,24 +130,14 @@ func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
 	}
 }

-func TestSubprocessRunnerMissingConfiguredCredentialFails(t *testing.T) {
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "MISSING_AUDITA_KEY",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+func TestSubprocessRunnerRejectsIncompleteResolvedCredential(t *testing.T) {
+	_, err := NewSubprocessRunner(SubprocessRunnerConfig{
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKeyReference: "MISSING_AUDITA_KEY",
 	})
-	req := auditaReqForTest(t, false)
-
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "required credential environment variable MISSING_AUDITA_KEY is not set") {
-		t.Fatalf("error = %q, want missing credential guidance", err.Error())
+	if err == nil || !strings.Contains(err.Error(), "credential value and reference must be provided together") {
+		t.Fatalf("NewSubprocessRunner() error = %v, want credential pair error", err)
 	}
 }

@@ -156,13 +148,13 @@ func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T)
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+		Binary:    writeAuditaHelperWrapper(t),
+		Timeout:   mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey: "",
+		Modules:   []string{"glossary"},
+		BaseURL:   "https://openrouter.ai/api/v1",
+		Model:     "openrouter/google/gemma-4-31b-it",
+		Report:    false,
 	})
 	req := auditaReqForTest(t, false)

@@ -187,13 +179,13 @@ func TestSubprocessRunnerOmitsUnspecifiedParentEnvironment(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-		LLMAPIKeyEnv: "",
+		Binary:    writeAuditaHelperWrapper(t),
+		Timeout:   mustParseAuditaDuration(t, "2s"),
+		Modules:   []string{"glossary"},
+		BaseURL:   "https://openrouter.ai/api/v1",
+		Model:     "openrouter/google/gemma-4-31b-it",
+		Report:    false,
+		LLMAPIKey: "",
 	})
 	req := auditaReqForTest(t, false)
 	if _, err := runner.Run(context.Background(), req); err != nil {
@@ -213,12 +205,12 @@ func TestSubprocessRunnerOmitsModulesFlagWhenNotConfigured(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+		Binary:    writeAuditaHelperWrapper(t),
+		Timeout:   mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey: "",
+		BaseURL:   "https://openrouter.ai/api/v1",
+		Model:     "openrouter/google/gemma-4-31b-it",
+		Report:    false,
 	})
 	req := auditaReqForTest(t, false)
 	if _, err := runner.Run(context.Background(), req); err != nil {
@@ -239,10 +231,10 @@ func TestSubprocessRunnerOmitsBaseURLAndModelFlagsWhenNotConfigured(t *testing.T
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		Report:       false,
+		Binary:    writeAuditaHelperWrapper(t),
+		Timeout:   mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey: "",
+		Report:    false,
 	})
 	req := auditaReqForTest(t, false)
 	if _, err := runner.Run(context.Background(), req); err != nil {
@@ -266,13 +258,14 @@ func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             true,
 	})
 	req := auditaReqForTest(t, true)
 	_, err := runner.Run(context.Background(), req)
@@ -288,6 +281,9 @@ func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
 	if !strings.Contains(err.Error(), req.StdoutLogPath) || !strings.Contains(err.Error(), req.StderrLogPath) {
 		t.Fatalf("error = %q, want stdout/stderr log paths", err.Error())
 	}
+	if strings.Contains(err.Error(), "super-secret") {
+		t.Fatalf("failure diagnostic exposed credential value: %q", err.Error())
+	}
 }

 func TestSubprocessRunnerSubprocessFailureAddsStderrDescriptorHint(t *testing.T) {
@@ -297,13 +293,14 @@ func TestSubprocessRunnerSubprocessFailureAddsStderrDescriptorHint(t *testing.T)
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             true,
 	})
 	req := auditaReqForTest(t, true)
 	_, err := runner.Run(context.Background(), req)
@@ -322,13 +319,14 @@ func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             false,
 	})
 	req := auditaReqForTest(t, false)
 	_, err := runner.Run(context.Background(), req)
@@ -347,13 +345,14 @@ func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             false,
 	})
 	req := auditaReqForTest(t, false)
 	_, err := runner.Run(context.Background(), req)
@@ -372,13 +371,14 @@ func TestSubprocessRunnerSegmentsMissingFails(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             false,
 	})
 	req := auditaReqForTest(t, false)
 	_, err := runner.Run(context.Background(), req)
@@ -397,13 +397,14 @@ func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
 	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))

 	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
+		Binary:             writeAuditaHelperWrapper(t),
+		Timeout:            mustParseAuditaDuration(t, "2s"),
+		LLMAPIKey:          "super-secret",
+		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
+		Modules:            []string{"glossary"},
+		BaseURL:            "https://openrouter.ai/api/v1",
+		Model:              "openrouter/google/gemma-4-31b-it",
+		Report:             true,
 	})
 	req := auditaReqForTest(t, true)
 	_, err := runner.Run(context.Background(), req)
@@ -416,21 +417,22 @@ func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
 }

 func TestSubprocessRunnerConstructorValidation(t *testing.T) {
-	_, err := NewSubprocessRunnerFromConfigValues("", "3h", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
+	_, err := NewSubprocessRunnerFromConfigValues("", "3h", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
 	if err == nil {
 		t.Fatal("expected binary validation error")
 	}
-	_, err = NewSubprocessRunnerFromConfigValues("audita", "bad", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
+	_, err = NewSubprocessRunnerFromConfigValues("audita", "bad", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
 	if err == nil {
 		t.Fatal("expected timeout parse error")
 	}
 	_, err = NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:       "audita",
-		Timeout:      mustParseAuditaDuration(t, "1s"),
-		LLMAPIKeyEnv: "AUDITA_LLM_API_KEY",
-		Modules:      []string{"glossary"},
-		BaseURL:      "://",
-		Model:        "openrouter/google/gemma-4-31b-it",
+		Binary:             "audita",
+		Timeout:            mustParseAuditaDuration(t, "1s"),
+		LLMAPIKey:          "synthetic-secret",
+		LLMAPIKeyReference: "AUDITA_LLM_API_KEY",
+		Modules:            []string{"glossary"},
+		BaseURL:            "://",
+		Model:              "openrouter/google/gemma-4-31b-it",
 	})
 	if err == nil {
 		t.Fatal("expected base url validation error")
--- a/internal/adapters/storage/s3_backend.go
+++ b/internal/adapters/storage/s3_backend.go
@@ -37,8 +37,12 @@ type s3ClientOptions struct {
 	Region         string
 	Endpoint       string
 	ForcePathStyle bool
-	AccessKeyID    string
-	SecretKey      string
+	Credentials    *s3StaticCredentials
+}
+
+type s3StaticCredentials struct {
+	AccessKeyID     string
+	SecretAccessKey string
 }

 var newS3Client = func(ctx context.Context, opts s3ClientOptions) (s3API, error) {
@@ -46,11 +50,11 @@ var newS3Client = func(ctx context.Context, opts s3ClientOptions) (s3API, error)
 	if strings.TrimSpace(opts.Region) != "" {
 		loadOpts = append(loadOpts, awsconfig.WithRegion(strings.TrimSpace(opts.Region)))
 	}
-	if strings.TrimSpace(opts.AccessKeyID) != "" && strings.TrimSpace(opts.SecretKey) != "" {
+	if opts.Credentials != nil {
 		loadOpts = append(loadOpts, awsconfig.WithCredentialsProvider(
 			credentials.NewStaticCredentialsProvider(
-				strings.TrimSpace(opts.AccessKeyID),
-				strings.TrimSpace(opts.SecretKey),
+				opts.Credentials.AccessKeyID,
+				opts.Credentials.SecretAccessKey,
 				"",
 			),
 		))
@@ -75,14 +79,24 @@ func NewS3BackendFromConfig(ctx context.Context, cfg config.StorageS3Config) (*S
 	if bucket == "" {
 		return nil, fmt.Errorf("storage.s3.bucket is required")
 	}
+	if (cfg.AccessKeyID == nil) != (cfg.SecretAccessKey == nil) {
+		return nil, fmt.Errorf("storage.s3 access key ID and secret access key references must be configured together")
+	}
+	if cfg.AccessKeyID != nil && (!cfg.AccessKeyID.IsResolved() || !cfg.SecretAccessKey.IsResolved()) {
+		return nil, fmt.Errorf("storage.s3 configured credential references must be resolved")
+	}

-	client, err := newS3Client(ctx, s3ClientOptions{
+	clientOptions := s3ClientOptions{
 		Region:         cfg.Region,
 		Endpoint:       cfg.Endpoint,
 		ForcePathStyle: cfg.ForcePathStyle,
-		AccessKeyID:    s3CredentialFromEnv(orDefaultEnvName(cfg.AccessKeyIDEnv, config.DefaultS3AccessKeyIDEnv)),
-		SecretKey:      s3CredentialFromEnv(orDefaultEnvName(cfg.SecretKeyEnv, config.DefaultS3SecretAccessKeyEnv)),
-	})
+	}
+	if cfg.AccessKeyID != nil && cfg.SecretAccessKey != nil {
+		clientOptions.Credentials = &s3StaticCredentials{
+			AccessKeyID: cfg.AccessKeyID.Value(), SecretAccessKey: cfg.SecretAccessKey.Value(),
+		}
+	}
+	client, err := newS3Client(ctx, clientOptions)
 	if err != nil {
 		return nil, fmt.Errorf("build s3 client: %w", err)
 	}
@@ -93,26 +107,6 @@ func NewS3BackendFromConfig(ctx context.Context, cfg config.StorageS3Config) (*S
 	}, nil
 }

-func s3CredentialFromEnv(envVarName string) string {
-	name := strings.TrimSpace(envVarName)
-	if name == "" {
-		return ""
-	}
-	value, ok := os.LookupEnv(name)
-	if !ok {
-		return ""
-	}
-	return strings.TrimSpace(value)
-}
-
-func orDefaultEnvName(name, fallback string) string {
-	trimmed := strings.TrimSpace(name)
-	if trimmed == "" {
-		return fallback
-	}
-	return trimmed
-}
-
 // List returns objects under prefix.
 func (b *S3Backend) List(ctx context.Context, prefix string) ([]ObjectInfo, error) {
 	normalizedPrefix := normalizeObjectKey(prefix)
--- a/internal/adapters/storage/s3_backend_test.go
+++ b/internal/adapters/storage/s3_backend_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/smithy-go"

+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )

@@ -319,8 +320,10 @@ func TestS3BackendDeleteHonorsCancellation(t *testing.T) {
 func TestNewS3BackendFromConfigUsesClientOptions(t *testing.T) {
 	original := newS3Client
 	t.Cleanup(func() { newS3Client = original })
-	t.Setenv("OBJECT_STORAGE_KEY_ID", "id-123")
-	t.Setenv("OBJECT_STORAGE_KEY", "secret-abc")
+	accessKey := resolvedTestSecret(t, "NARRATIO_S3_TEST_ACCESS", "id-123")
+	secretKey := resolvedTestSecret(t, "NARRATIO_S3_TEST_SECRET", "secret-abc")
+	t.Setenv("NARRATIO_S3_TEST_ACCESS", "changed-id")
+	t.Setenv("NARRATIO_S3_TEST_SECRET", "changed-secret")

 	var got s3ClientOptions
 	newS3Client = func(_ context.Context, opts s3ClientOptions) (s3API, error) {
@@ -329,10 +332,12 @@ func TestNewS3BackendFromConfigUsesClientOptions(t *testing.T) {
 	}

 	backend, err := NewS3BackendFromConfig(context.Background(), config.StorageS3Config{
-		Bucket:         "my-archive",
-		Region:         "us-east-1",
-		Endpoint:       "http://localhost:9000",
-		ForcePathStyle: true,
+		Bucket:          "my-archive",
+		Region:          "us-east-1",
+		Endpoint:        "http://localhost:9000",
+		ForcePathStyle:  true,
+		AccessKeyID:     accessKey,
+		SecretAccessKey: secretKey,
 	})
 	if err != nil {
 		t.Fatalf("NewS3BackendFromConfig() error = %v", err)
@@ -343,7 +348,7 @@ func TestNewS3BackendFromConfigUsesClientOptions(t *testing.T) {
 	if got.Region != "us-east-1" || got.Endpoint != "http://localhost:9000" || !got.ForcePathStyle {
 		t.Fatalf("client options = %#v, want region/endpoint/path-style values", got)
 	}
-	if got.AccessKeyID != "id-123" || got.SecretKey != "secret-abc" {
+	if got.Credentials == nil || got.Credentials.AccessKeyID != "id-123" || got.Credentials.SecretAccessKey != "secret-abc" {
 		t.Fatalf("client options credentials = %#v, want env-resolved static credentials", got)
 	}
 }
@@ -355,7 +360,21 @@ func TestNewS3BackendFromConfigRequiresBucket(t *testing.T) {
 	}
 }

-func TestNewS3BackendFromConfigFallsBackWhenCredentialEnvMissing(t *testing.T) {
+func TestNewS3BackendFromConfigRejectsIncompleteOrUnresolvedCredentials(t *testing.T) {
+	unresolved := configkit.SecretEnv("NARRATIO_UNRESOLVED_S3_KEY")
+	for name, cfg := range map[string]config.StorageS3Config{
+		"partial":    {Bucket: "my-archive", AccessKeyID: &unresolved},
+		"unresolved": {Bucket: "my-archive", AccessKeyID: &unresolved, SecretAccessKey: &unresolved},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if _, err := NewS3BackendFromConfig(context.Background(), cfg); err == nil {
+				t.Fatal("NewS3BackendFromConfig() succeeded, want credential error")
+			}
+		})
+	}
+}
+
+func TestNewS3BackendFromConfigUsesDefaultProviderWithoutCredentialReferences(t *testing.T) {
 	original := newS3Client
 	t.Cleanup(func() { newS3Client = original })

@@ -366,19 +385,30 @@ func TestNewS3BackendFromConfigFallsBackWhenCredentialEnvMissing(t *testing.T) {
 	}

 	_, err := NewS3BackendFromConfig(context.Background(), config.StorageS3Config{
-		Bucket:         "my-archive",
-		Region:         "us-east-1",
-		AccessKeyIDEnv: "MISSING_ACCESS_KEY_ID",
-		SecretKeyEnv:   "MISSING_SECRET_KEY",
+		Bucket: "my-archive",
+		Region: "us-east-1",
 	})
 	if err != nil {
 		t.Fatalf("NewS3BackendFromConfig() error = %v", err)
 	}
-	if got.AccessKeyID != "" || got.SecretKey != "" {
-		t.Fatalf("client options credentials = %#v, want empty fallback values", got)
+	if got.Credentials != nil {
+		t.Fatalf("client options credentials = %#v, want default provider chain", got.Credentials)
 	}
 }

+func resolvedTestSecret(t *testing.T, name, value string) *configkit.Secret {
+	t.Helper()
+	t.Setenv(name, value)
+	type document struct {
+		Secret *configkit.Secret `yaml:"secret"`
+	}
+	result, err := configkit.Load(configkit.Bytes("test.yml", []byte("secret: "+name+"\n")), configkit.Options[document]{})
+	if err != nil {
+		t.Fatalf("resolve test secret: %v", err)
+	}
+	return result.Config.Secret
+}
+
 func strPtr(v string) *string { return &v }
 func int64Ptr(v int64) *int64 { return &v }
 func boolPtr(v bool) *bool    { return &v }