fix(webapp): seal public token subjects with their own secret

Add PUBLIC_TOKEN_SUBJECT_SECRET, a dedicated key for the encrypted
environment id in public access tokens. When it is unset the webapp
keeps using ENCRYPTION_KEY, so self-hosted instances need no change.

Mono-RevId: 18984b40421bf99ba9a0f7201ea1e89076de1efb

Author: ericallam

apps/webapp/app/env.server.ts

@@ -417,6 +417,11 @@ const EnvironmentSchema = z
       )
       .refine(isNotInsecureSecret, INSECURE_SECRET_MESSAGE),
     PUBLIC_TOKEN_SEALED_SUBJECT_ENABLED: BoolEnv.default(false),
+    PUBLIC_TOKEN_SUBJECT_SECRET: z
+      .string()
+      .min(32)
+      .refine(isNotInsecureSecret, INSECURE_SECRET_MESSAGE)
+      .optional(),
     // Enables the AWS_KMS secret store provider. Callers opt in per secret; everything else
     // stays encrypted with ENCRYPTION_KEY.
     SECRET_STORE_AWS_KMS_KEY_ID: z.string().optional(),
@@ -2879,9 +2884,10 @@ if (env.ALLOW_INSECURE_DEFAULT_SECRETS) {
       ["MAGIC_LINK_SECRET", env.MAGIC_LINK_SECRET],
       ["ENCRYPTION_KEY", env.ENCRYPTION_KEY],
       ["MANAGED_WORKER_SECRET", env.MANAGED_WORKER_SECRET],
+      ["PUBLIC_TOKEN_SUBJECT_SECRET", env.PUBLIC_TOKEN_SUBJECT_SECRET],
     ] as const
   )
-    .filter(([, value]) => INSECURE_SECRET_VALUES.includes(value))
+    .filter(([, value]) => value !== undefined && INSECURE_SECRET_VALUES.includes(value))
     .map(([name]) => name);
 
   if (insecure.length > 0) {

apps/webapp/app/services/publicTokenSubject.server.ts

@@ -4,7 +4,7 @@ import { env } from "~/env.server";
 let codec: PublicTokenSubjectCodec | undefined;
 
 function getCodec(): PublicTokenSubjectCodec {
-  codec ??= createPublicTokenSubjectCodec(env.ENCRYPTION_KEY);
+  codec ??= createPublicTokenSubjectCodec(env.PUBLIC_TOKEN_SUBJECT_SECRET ?? env.ENCRYPTION_KEY);
   return codec;
 }
 

docs/self-hosting/env/webapp.mdx

@@ -12,6 +12,8 @@ mode: "wide"
 | `MAGIC_LINK_SECRET`                              | Yes      | —                     | Magic link encryption secret. Run: `openssl rand -hex 16`                                                          |
 | `ENCRYPTION_KEY`                                 | Yes      | —                     | Secret store encryption key. Run: `openssl rand -hex 16`                                                           |
 | `MANAGED_WORKER_SECRET`                          | Yes      | —                     | Managed worker secret. Must be set and match supervisor. Run: `openssl rand -hex 32`                               |
+| `PUBLIC_TOKEN_SUBJECT_SECRET`                    | No       | `ENCRYPTION_KEY`      | Key that encrypts the environment id inside public access tokens. Set it to keep this separate from the secret store key. Run: `openssl rand -hex 32` |
+| `PUBLIC_TOKEN_SEALED_SUBJECT_ENABLED`            | No       | false                 | Encrypt the environment id inside newly minted public access tokens. Turn on only once every webapp instance runs a version that can read them. |
 | `ALLOW_INSECURE_DEFAULT_SECRETS`                 | No       | false                 | Boot even if a secret is still a known-insecure published default. Temporary escape hatch for values you can't safely rotate yet (see [Secrets](/self-hosting/kubernetes#secrets)). |
 | **Domains & ports**                              |          |                       |                                                                                                                    |
 | `REMIX_APP_PORT`                                 | No       | 3030                  | Remix app port.                                                                                                    |