docs: add configuration & secrets plan (slice 1, plan 3a)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-10 19:45:08 +02:00
parent d3bec2ee10
commit 349f699bb6
1 changed files with 706 additions and 0 deletions
@@ -0,0 +1,706 @@
+# Lyra Configuration & Secrets Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Give Lyra an encrypted key/value configuration store so the upcoming real source adapters can read credentials (Qobuz login, slskd URL + API key) that the user enters through a settings page — secrets encrypted at rest and shared across the Node web app (which writes them) and the Python worker (which reads them).
+
+**Architecture:** A Prisma-owned `Config` table holds `key → value` rows, with a `secret` flag marking values stored as an AES-256-GCM envelope. Both runtimes share one 32-byte key from the `LYRA_SECRET_KEY` env var and one envelope format (`{iv, ct, tag}`, all base64). The Next.js settings page posts credentials to `PUT /api/config`, which encrypts secret fields before upserting; `GET /api/config` never returns secret values, only whether each is set. The worker's `config.get_config(conn)` reads and decrypts everything for the adapters.
+
+**Tech Stack:** Prisma 6 / PostgreSQL 17; Next.js App Router + Node `crypto` (AES-256-GCM); Python 3.12 + the `cryptography` package (`AESGCM`). Tests: Vitest (web), pytest (worker), including a cross-language test proving the Python worker decrypts a Node-produced envelope.
+
+## Global Constraints
+
+- Prisma owns the schema; the worker uses raw psycopg v3 SQL only (no DDL).
+- **Crypto contract (both runtimes MUST match exactly):** AES-256-GCM. Key = 32 raw bytes decoded from base64 env var `LYRA_SECRET_KEY`. Nonce/IV = 12 random bytes per encryption. Envelope = a JSON string `{"iv": b64, "ct": b64, "tag": b64}` where `ct` is the ciphertext WITHOUT the tag and `tag` is the 16-byte GCM tag. (Node keeps the tag separate via `getAuthTag()`; Python's `AESGCM` appends the tag to ciphertext, so Python code must split/join the last 16 bytes — shown in the tasks.)
+- Secrets NEVER leave the backend in plaintext: `GET /api/config` returns booleans (`*Set`) for secret fields, never their values.
+- Config keys (fixed): `qobuz.email` (plain), `qobuz.password` (secret), `slskd.url` (plain), `slskd.api_key` (secret). Later adapter plans read these.
+- `LYRA_SECRET_KEY` is provided to BOTH the `web` and `worker` services via environment.
+- Every task ends with a commit.
+
+## Shared interfaces (defined by tasks below; listed for consistency)
+
+```
+web/src/lib/crypto.ts     (Task 2): encryptSecret(plaintext: string): string ; decryptSecret(envelope: string): string
+web/src/app/api/config/route.ts (Task 3): GET -> masked config ; PUT (partial settings) -> upsert (encrypt secrets)
+worker/lyra_worker/crypto.py (Task 5): encrypt_secret(plaintext: str) -> str ; decrypt_secret(envelope: str) -> str
+worker/lyra_worker/config.py (Task 6): get_config(conn) -> dict[str, str]   # secrets decrypted
+```
+
+---
+
+### Task 1: Config schema + migration
+
+**Files:**
+- Modify: `web/prisma/schema.prisma`
+
+**Interfaces:**
+- Produces: a `Config` table — `key String @id`, `value String`, `secret Boolean @default(false)`, `updatedAt DateTime @updatedAt`.
+
+- [ ] **Step 1: Add the model**
+
+Append to `web/prisma/schema.prisma`:
+```prisma
+model Config {
+  key       String   @id
+  value     String
+  secret    Boolean  @default(false)
+  updatedAt DateTime @updatedAt
+}
+```
+
+- [ ] **Step 2: Create and apply the migration**
+
+Run (Postgres up via `docker compose up -d db`):
+```bash
+cd web
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+npx prisma migrate dev --name add_config
+```
+Expected: migration created under `web/prisma/migrations/` and applied; "Your database is now in sync with your schema."
+
+- [ ] **Step 3: Verify the table exists**
+
+Run:
+```bash
+cd web
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+npx prisma db execute --stdin <<'SQL'
+SELECT 1 FROM "Config" LIMIT 0;
+SQL
+echo "table OK"
+```
+Expected: no error; prints `table OK`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add web/prisma/schema.prisma web/prisma/migrations
+git commit -m "feat: add Config schema"
+```
+
+---
+
+### Task 2: Web crypto util + secret-key plumbing
+
+**Files:**
+- Create: `web/src/lib/crypto.ts`
+- Test: `web/src/lib/crypto.test.ts`
+- Modify: `.env.example`
+- Modify: `docker-compose.yml`
+
+**Interfaces:**
+- Consumes: `LYRA_SECRET_KEY` env var.
+- Produces: `encryptSecret(plaintext: string): string` and `decryptSecret(envelope: string): string` implementing the Global-Constraints crypto contract.
+
+- [ ] **Step 1: Add LYRA_SECRET_KEY to env + compose**
+
+In `.env.example`, add a line (with a documented generator):
+```
+# 32 random bytes, base64. Generate with: openssl rand -base64 32
+LYRA_SECRET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
+```
+In `docker-compose.yml`, add `LYRA_SECRET_KEY: ${LYRA_SECRET_KEY}` to the `environment:` block of BOTH the `web` and `worker` services (next to `DATABASE_URL`).
+
+- [ ] **Step 2: Write the failing test**
+
+`web/src/lib/crypto.test.ts`:
+```ts
+import { describe, it, expect, beforeAll } from "vitest";
+import { encryptSecret, decryptSecret } from "./crypto";
+
+beforeAll(() => {
+  // base64 of the 32-byte ASCII string "0123456789abcdef0123456789abcdef"
+  process.env.LYRA_SECRET_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=";
+});
+
+describe("crypto", () => {
+  it("round-trips a secret", () => {
+    const env = encryptSecret("hunter2");
+    expect(env).not.toContain("hunter2");
+    expect(decryptSecret(env)).toBe("hunter2");
+  });
+
+  it("produces a well-formed envelope", () => {
+    const env = JSON.parse(encryptSecret("x"));
+    expect(typeof env.iv).toBe("string");
+    expect(typeof env.ct).toBe("string");
+    expect(typeof env.tag).toBe("string");
+  });
+
+  it("rejects a tampered envelope", () => {
+    const env = JSON.parse(encryptSecret("secret"));
+    env.ct = Buffer.from("garbage").toString("base64");
+    expect(() => decryptSecret(JSON.stringify(env))).toThrow();
+  });
+});
+```
+
+- [ ] **Step 3: Run the test to verify it fails**
+
+Run: `cd web && npx vitest run src/lib/crypto.test.ts`
+Expected: FAIL — cannot import `./crypto`.
+
+- [ ] **Step 4: Implement the crypto util**
+
+`web/src/lib/crypto.ts`:
+```ts
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+function key(): Buffer {
+  const b64 = process.env.LYRA_SECRET_KEY;
+  if (!b64) throw new Error("LYRA_SECRET_KEY is not set");
+  const k = Buffer.from(b64, "base64");
+  if (k.length !== 32) throw new Error("LYRA_SECRET_KEY must decode to 32 bytes");
+  return k;
+}
+
+export function encryptSecret(plaintext: string): string {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key(), iv);
+  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return JSON.stringify({
+    iv: iv.toString("base64"),
+    ct: ct.toString("base64"),
+    tag: tag.toString("base64"),
+  });
+}
+
+export function decryptSecret(envelope: string): string {
+  const { iv, ct, tag } = JSON.parse(envelope) as { iv: string; ct: string; tag: string };
+  const decipher = createDecipheriv("aes-256-gcm", key(), Buffer.from(iv, "base64"));
+  decipher.setAuthTag(Buffer.from(tag, "base64"));
+  const pt = Buffer.concat([decipher.update(Buffer.from(ct, "base64")), decipher.final()]);
+  return pt.toString("utf8");
+}
+```
+
+- [ ] **Step 5: Run the test to verify it passes**
+
+Run: `cd web && npx vitest run src/lib/crypto.test.ts`
+Expected: PASS — all three tests green.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add web/src/lib/crypto.ts web/src/lib/crypto.test.ts .env.example docker-compose.yml
+git commit -m "feat: add web AES-256-GCM secret crypto and LYRA_SECRET_KEY plumbing"
+```
+
+---
+
+### Task 3: Config API (get masked / put encrypted)
+
+**Files:**
+- Create: `web/src/app/api/config/route.ts`
+- Test: `web/src/app/api/config/route.test.ts`
+
+**Interfaces:**
+- Consumes: `prisma` (`@/lib/db`), `encryptSecret` (Task 2).
+- Produces:
+  - `PUT /api/config` — body may include any of `{ qobuzEmail, qobuzPassword, slskdUrl, slskdApiKey }` (strings). Each provided field is upserted into `Config`: plain fields (`qobuz.email`→`qobuzEmail`, `slskd.url`→`slskdUrl`) stored as-is with `secret=false`; secret fields (`qobuz.password`→`qobuzPassword`, `slskd.api_key`→`slskdApiKey`) stored `encryptSecret(value)` with `secret=true`. An empty string for a field means "leave unchanged" (skip it). Responds `200 { ok: true }`.
+  - `GET /api/config` — responds `200 { qobuzEmail: string, slskdUrl: string, qobuzPasswordSet: boolean, slskdApiKeySet: boolean }` (secret values never returned; `*Set` is whether a row exists for that key).
+
+- [ ] **Step 1: Write the failing test**
+
+`web/src/app/api/config/route.test.ts`:
+```ts
+import { describe, it, expect, beforeAll } from "vitest";
+import { GET, PUT } from "./route";
+import { prisma } from "@/lib/db";
+
+beforeAll(() => {
+  process.env.LYRA_SECRET_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=";
+});
+
+function putReq(body: unknown) {
+  return new Request("http://localhost/api/config", {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("config API", () => {
+  it("stores plain fields verbatim and secret fields encrypted", async () => {
+    await PUT(putReq({ qobuzEmail: "me@example.com", qobuzPassword: "hunter2", slskdUrl: "http://slskd:5030", slskdApiKey: "abc" }));
+
+    const email = await prisma.config.findUnique({ where: { key: "qobuz.email" } });
+    const pw = await prisma.config.findUnique({ where: { key: "qobuz.password" } });
+    expect(email!.value).toBe("me@example.com");
+    expect(email!.secret).toBe(false);
+    expect(pw!.secret).toBe(true);
+    expect(pw!.value).not.toContain("hunter2"); // encrypted envelope
+  });
+
+  it("GET masks secrets and reports set-ness", async () => {
+    await PUT(putReq({ qobuzEmail: "me@example.com", qobuzPassword: "hunter2" }));
+    const res = await GET();
+    const body = await res.json();
+    expect(body.qobuzEmail).toBe("me@example.com");
+    expect(body.qobuzPasswordSet).toBe(true);
+    expect(body.slskdApiKeySet).toBe(false);
+    expect(JSON.stringify(body)).not.toContain("hunter2");
+  });
+
+  it("empty string leaves a field unchanged", async () => {
+    await PUT(putReq({ qobuzPassword: "first" }));
+    await PUT(putReq({ qobuzPassword: "" }));
+    const pw = await prisma.config.findUnique({ where: { key: "qobuz.password" } });
+    expect(pw).not.toBeNull(); // still present, not wiped
+  });
+});
+```
+
+Add to `web/src/test/setup.ts`'s `beforeEach` cleanup (it currently deletes Job/Request) a line to also clear Config:
+```ts
+  await prisma.config.deleteMany();
+```
+
+- [ ] **Step 2: Run the test to verify it fails**
+
+Run:
+```bash
+cd web
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+npx vitest run src/app/api/config/route.test.ts
+```
+Expected: FAIL — cannot import `./route`.
+
+- [ ] **Step 3: Implement the route**
+
+`web/src/app/api/config/route.ts`:
+```ts
+import { prisma } from "@/lib/db";
+import { encryptSecret } from "@/lib/crypto";
+
+// settings field -> (config key, is secret)
+const FIELDS: Record<string, { key: string; secret: boolean }> = {
+  qobuzEmail: { key: "qobuz.email", secret: false },
+  qobuzPassword: { key: "qobuz.password", secret: true },
+  slskdUrl: { key: "slskd.url", secret: false },
+  slskdApiKey: { key: "slskd.api_key", secret: true },
+};
+
+export async function PUT(request: Request) {
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return Response.json({ error: "invalid JSON" }, { status: 400 });
+  }
+
+  for (const [field, { key, secret }] of Object.entries(FIELDS)) {
+    const raw = body[field];
+    if (typeof raw !== "string" || raw === "") continue; // absent or "unchanged"
+    const value = secret ? encryptSecret(raw) : raw;
+    await prisma.config.upsert({
+      where: { key },
+      create: { key, value, secret },
+      update: { value, secret },
+    });
+  }
+
+  return Response.json({ ok: true });
+}
+
+export async function GET() {
+  const rows = await prisma.config.findMany();
+  const byKey = new Map(rows.map((r) => [r.key, r]));
+  return Response.json({
+    qobuzEmail: byKey.get("qobuz.email")?.value ?? "",
+    slskdUrl: byKey.get("slskd.url")?.value ?? "",
+    qobuzPasswordSet: byKey.has("qobuz.password"),
+    slskdApiKeySet: byKey.has("slskd.api_key"),
+  });
+}
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+Run:
+```bash
+cd web
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+npx vitest run src/app/api/config/route.test.ts
+```
+Expected: PASS — all three tests green.
+
+- [ ] **Step 5: Run the full web suite**
+
+Run: `cd web && export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra && npx vitest run`
+Expected: PASS — config + requests suites all green.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add web/src/app/api/config web/src/test/setup.ts
+git commit -m "feat: add config API with encrypted secret storage"
+```
+
+---
+
+### Task 4: Settings page
+
+**Files:**
+- Create: `web/src/app/settings/page.tsx`
+- Create: `web/src/app/settings/settings-form.tsx`
+- Modify: `web/src/app/page.tsx` (add a link to settings)
+
+**Interfaces:**
+- Consumes: `GET`/`PUT /api/config` (Task 3).
+- Produces: a `/settings` page with a client form pre-filled from `GET /api/config` (plain fields shown; secret fields show a "•••• set" placeholder when `*Set` is true and are left blank otherwise), submitting changed fields via `PUT`.
+
+- [ ] **Step 1: Write the settings form client component**
+
+`web/src/app/settings/settings-form.tsx`:
+```tsx
+"use client";
+
+import { useEffect, useState } from "react";
+
+type Loaded = { qobuzEmail: string; slskdUrl: string; qobuzPasswordSet: boolean; slskdApiKeySet: boolean };
+
+export function SettingsForm() {
+  const [qobuzEmail, setQobuzEmail] = useState("");
+  const [qobuzPassword, setQobuzPassword] = useState("");
+  const [slskdUrl, setSlskdUrl] = useState("");
+  const [slskdApiKey, setSlskdApiKey] = useState("");
+  const [pwSet, setPwSet] = useState(false);
+  const [keySet, setKeySet] = useState(false);
+  const [saved, setSaved] = useState(false);
+
+  useEffect(() => {
+    fetch("/api/config")
+      .then((r) => r.json())
+      .then((c: Loaded) => {
+        setQobuzEmail(c.qobuzEmail);
+        setSlskdUrl(c.slskdUrl);
+        setPwSet(c.qobuzPasswordSet);
+        setKeySet(c.slskdApiKeySet);
+      });
+  }, []);
+
+  async function submit(e: React.FormEvent) {
+    e.preventDefault();
+    await fetch("/api/config", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ qobuzEmail, qobuzPassword, slskdUrl, slskdApiKey }),
+    });
+    setQobuzPassword("");
+    setSlskdApiKey("");
+    setSaved(true);
+    setPwSet(pwSet || qobuzPassword !== "");
+    setKeySet(keySet || slskdApiKey !== "");
+  }
+
+  return (
+    <form onSubmit={submit}>
+      <label>Qobuz email <input aria-label="qobuz email" value={qobuzEmail} onChange={(e) => setQobuzEmail(e.target.value)} /></label>
+      <label>Qobuz password <input aria-label="qobuz password" type="password" placeholder={pwSet ? "•••• (set)" : ""} value={qobuzPassword} onChange={(e) => setQobuzPassword(e.target.value)} /></label>
+      <label>slskd URL <input aria-label="slskd url" value={slskdUrl} onChange={(e) => setSlskdUrl(e.target.value)} /></label>
+      <label>slskd API key <input aria-label="slskd api key" type="password" placeholder={keySet ? "•••• (set)" : ""} value={slskdApiKey} onChange={(e) => setSlskdApiKey(e.target.value)} /></label>
+      <button type="submit">Save</button>
+      {saved ? <span> Saved.</span> : null}
+    </form>
+  );
+}
+```
+
+- [ ] **Step 2: Write the settings page**
+
+`web/src/app/settings/page.tsx`:
+```tsx
+import { SettingsForm } from "./settings-form";
+
+export default function SettingsPage() {
+  return (
+    <main>
+      <h1>Settings</h1>
+      <SettingsForm />
+      <p><a href="/">← Back to queue</a></p>
+    </main>
+  );
+}
+```
+
+- [ ] **Step 3: Add a settings link to the home page**
+
+In `web/src/app/page.tsx`, add a link above `<Queue />` (inside `<main>`, after `<h1>Lyra</h1>`):
+```tsx
+      <p><a href="/settings">Settings</a></p>
+```
+
+- [ ] **Step 4: Verify the app builds**
+
+Run: `cd web && npm run build`
+Expected: build completes; `/settings` compiled as a route, no type errors.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add web/src/app/settings web/src/app/page.tsx
+git commit -m "feat: add settings page for credentials"
+```
+
+---
+
+### Task 5: Worker crypto util (cross-language)
+
+**Files:**
+- Create: `worker/lyra_worker/crypto.py`
+- Test: `worker/tests/test_crypto.py`
+- Modify: `worker/requirements.txt` (add `cryptography`)
+
+**Interfaces:**
+- Consumes: `LYRA_SECRET_KEY` env var.
+- Produces: `encrypt_secret(plaintext: str) -> str` and `decrypt_secret(envelope: str) -> str` using the SAME envelope format as `web/src/lib/crypto.ts`, so the worker can decrypt what the web app encrypted.
+
+- [ ] **Step 1: Add the dependency**
+
+Append to `worker/requirements.txt`:
+```
+cryptography>=42,<46
+```
+Then install into the venv: `worker/.venv/bin/pip install -r worker/requirements.txt`
+
+- [ ] **Step 2: Generate the cross-language fixture**
+
+The Python test must prove it can decrypt an envelope produced by Node using the SAME algorithm/contract as `web/src/lib/crypto.ts`. Generate one with the FIXED test key via a throwaway plain-JS script (no tsx/TS execution needed — plain Node runs `.mjs`):
+```bash
+cat > /tmp/lyra-gen-fixture.mjs <<'EOF'
+import { createCipheriv, randomBytes } from "node:crypto";
+const key = Buffer.from("MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=", "base64");
+const iv = randomBytes(12);
+const cipher = createCipheriv("aes-256-gcm", key, iv);
+const ct = Buffer.concat([cipher.update("cross-lang-secret", "utf8"), cipher.final()]);
+const tag = cipher.getAuthTag();
+console.log(JSON.stringify({ iv: iv.toString("base64"), ct: ct.toString("base64"), tag: tag.toString("base64") }));
+EOF
+node /tmp/lyra-gen-fixture.mjs
+```
+This uses the identical AES-256-GCM `{iv,ct,tag}` contract as `crypto.ts`. Copy the printed JSON envelope — paste it into the test below as `NODE_FIXTURE` (a one-time captured value; it's deterministic to decrypt). Then `rm /tmp/lyra-gen-fixture.mjs`.
+
+- [ ] **Step 3: Write the failing test**
+
+`worker/tests/test_crypto.py`:
+```python
+import pytest
+
+from lyra_worker.crypto import decrypt_secret, encrypt_secret
+
+TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="  # 32 bytes, base64
+# Produced by web/src/lib/crypto.ts encryptSecret("cross-lang-secret") with TEST_KEY (see Step 2).
+NODE_FIXTURE = "PASTE_THE_ENVELOPE_FROM_STEP_2_HERE"
+
+
+@pytest.fixture(autouse=True)
+def _key(monkeypatch):
+    monkeypatch.setenv("LYRA_SECRET_KEY", TEST_KEY)
+
+
+def test_round_trip():
+    env = encrypt_secret("hunter2")
+    assert "hunter2" not in env
+    assert decrypt_secret(env) == "hunter2"
+
+
+def test_decrypts_node_produced_envelope():
+    # Cross-language contract: the worker must decrypt what the web app encrypted.
+    assert decrypt_secret(NODE_FIXTURE) == "cross-lang-secret"
+
+
+def test_rejects_tampered_envelope():
+    import json
+    env = json.loads(encrypt_secret("secret"))
+    env["ct"] = "Z2FyYmFnZQ=="  # "garbage"
+    with pytest.raises(Exception):
+        decrypt_secret(json.dumps(env))
+```
+
+- [ ] **Step 4: Run the test to verify it fails**
+
+Run:
+```bash
+cd worker
+worker/.venv/bin/python -m pytest tests/test_crypto.py -v
+```
+Expected: FAIL — `ModuleNotFoundError: No module named 'lyra_worker.crypto'`.
+
+- [ ] **Step 5: Implement the crypto util**
+
+`worker/lyra_worker/crypto.py`:
+```python
+import base64
+import json
+import os
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+
+def _key() -> bytes:
+    b64 = os.environ.get("LYRA_SECRET_KEY")
+    if not b64:
+        raise RuntimeError("LYRA_SECRET_KEY is not set")
+    k = base64.b64decode(b64)
+    if len(k) != 32:
+        raise RuntimeError("LYRA_SECRET_KEY must decode to 32 bytes")
+    return k
+
+
+def encrypt_secret(plaintext: str) -> str:
+    iv = os.urandom(12)
+    full = AESGCM(_key()).encrypt(iv, plaintext.encode("utf-8"), None)  # ct || tag(16)
+    ct, tag = full[:-16], full[-16:]
+    return json.dumps(
+        {
+            "iv": base64.b64encode(iv).decode(),
+            "ct": base64.b64encode(ct).decode(),
+            "tag": base64.b64encode(tag).decode(),
+        }
+    )
+
+
+def decrypt_secret(envelope: str) -> str:
+    e = json.loads(envelope)
+    iv = base64.b64decode(e["iv"])
+    ct = base64.b64decode(e["ct"])
+    tag = base64.b64decode(e["tag"])
+    pt = AESGCM(_key()).decrypt(iv, ct + tag, None)  # AESGCM expects ct || tag
+    return pt.decode("utf-8")
+```
+
+- [ ] **Step 6: Run the test to verify it passes**
+
+Run:
+```bash
+cd worker
+worker/.venv/bin/python -m pytest tests/test_crypto.py -v
+```
+Expected: PASS — round-trip, the Node-fixture decrypt, and the tamper-rejection all green. (If the Node-fixture test fails, the envelope formats disagree — re-check Step 2's output against the `{iv,ct,tag}` contract.)
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add worker/lyra_worker/crypto.py worker/tests/test_crypto.py worker/requirements.txt
+git commit -m "feat: add worker AES-256-GCM crypto matching the web envelope"
+```
+
+---
+
+### Task 6: Worker config reader
+
+**Files:**
+- Create: `worker/lyra_worker/config.py`
+- Test: `worker/tests/test_config.py`
+
+**Interfaces:**
+- Consumes: the `Config` table, `decrypt_secret` (Task 5), the `conn` fixture.
+- Produces: `get_config(conn) -> dict[str, str]` — reads all `Config` rows, returning `{key: value}` where rows with `secret=true` have their `value` decrypted via `decrypt_secret`. Missing keys are simply absent.
+
+- [ ] **Step 1: Write the failing test**
+
+`worker/tests/test_config.py`:
+```python
+import pytest
+
+from lyra_worker.config import get_config
+from lyra_worker.crypto import encrypt_secret
+
+TEST_KEY = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
+
+
+@pytest.fixture(autouse=True)
+def _key(monkeypatch):
+    monkeypatch.setenv("LYRA_SECRET_KEY", TEST_KEY)
+
+
+def _put(conn, key, value, secret):
+    with conn.cursor() as cur:
+        cur.execute(
+            'INSERT INTO "Config" (key, value, secret, "updatedAt") VALUES (%s, %s, %s, now()) '
+            'ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, secret = EXCLUDED.secret',
+            (key, value, secret),
+        )
+    conn.commit()
+
+
+def test_reads_plain_and_decrypts_secret(conn):
+    _put(conn, "slskd.url", "http://slskd:5030", False)
+    _put(conn, "slskd.api_key", encrypt_secret("topsecret"), True)
+
+    cfg = get_config(conn)
+    assert cfg["slskd.url"] == "http://slskd:5030"
+    assert cfg["slskd.api_key"] == "topsecret"  # decrypted
+
+
+def test_missing_keys_absent(conn):
+    cfg = get_config(conn)
+    assert "qobuz.password" not in cfg
+```
+
+The `conn` fixture cleans Job/Request but not Config. Add Config cleanup: in `worker/tests/conftest.py`, in the `conn` fixture's pre-`yield` cleanup AND post-`yield` teardown, add `cur.execute('DELETE FROM "Config"')` alongside the existing deletes.
+
+- [ ] **Step 2: Run the test to verify it fails**
+
+Run:
+```bash
+cd worker
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+worker/.venv/bin/python -m pytest tests/test_config.py -v
+```
+Expected: FAIL — `ModuleNotFoundError: No module named 'lyra_worker.config'`.
+
+- [ ] **Step 3: Implement the config reader**
+
+`worker/lyra_worker/config.py`:
+```python
+import psycopg
+
+from lyra_worker.crypto import decrypt_secret
+
+
+def get_config(conn: psycopg.Connection) -> dict[str, str]:
+    """Return all config as {key: value}, decrypting rows marked secret."""
+    with conn.cursor() as cur:
+        cur.execute('SELECT key, value, secret FROM "Config"')
+        rows = cur.fetchall()
+    out: dict[str, str] = {}
+    for key, value, secret in rows:
+        out[key] = decrypt_secret(value) if secret else value
+    return out
+```
+
+- [ ] **Step 4: Run the test to verify it passes**
+
+Run:
+```bash
+cd worker
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+worker/.venv/bin/python -m pytest tests/test_config.py -v
+```
+Expected: PASS — both tests green.
+
+- [ ] **Step 5: Run the full worker suite**
+
+Run:
+```bash
+cd worker
+export DATABASE_URL=postgresql://lyra:lyra@localhost:5432/lyra
+worker/.venv/bin/python -m pytest -v
+```
+Expected: PASS — every suite green (config, crypto, and the existing pipeline/adapter/etc. suites), output pristine.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add worker/lyra_worker/config.py worker/tests/test_config.py worker/tests/conftest.py
+git commit -m "feat: add worker config reader with secret decryption"
+```
+
+---
+
+## Notes for the next plans (adapters)
+
+Real adapters (Plans 3b–3d) call `get_config(conn)` (or receive the resolved config) to obtain `qobuz.email`/`qobuz.password`, `slskd.url`/`slskd.api_key`, etc., and construct themselves accordingly. `registry.build_adapters()` will read config and include an adapter only when its required keys are present (using each adapter's `health()`), so an unconfigured source is simply skipped rather than failing the pipeline. `LYRA_SECRET_KEY` must be set in the environment of both services (already plumbed here) — document generating a real one with `openssl rand -base64 32` for deployment.