fix: accept legacy HF secret names for Gmail and subscription tokens

backend/app/config.py

@@ -8,7 +8,7 @@ Import `get_settings()` wherever configuration is needed.
 from functools import lru_cache
 from typing import Literal
 
-from pydantic import EmailStr, Field, field_validator
+from pydantic import AliasChoices, EmailStr, Field, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -88,10 +88,19 @@ class Settings(BaseSettings):
     SMTP_HOST: str = "smtp.gmail.com"
     SMTP_PORT: int = 465
     SMTP_USE_SSL: bool = True
-    SMTP_USERNAME: EmailStr | None = None
-    SMTP_PASSWORD: str | None = None                     # Gmail App Password (not account pw)
+    SMTP_USERNAME: EmailStr | None = Field(
+        default=None,
+        validation_alias=AliasChoices("SMTP_USERNAME", "GMAIL_USER"),
+    )
+    SMTP_PASSWORD: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("SMTP_PASSWORD", "GMAIL_APP_PASSWORD"),
+    )
     EMAIL_FROM_NAME: str = "AuthorBot"
-    EMAIL_FROM_ADDRESS: EmailStr | None = None
+    EMAIL_FROM_ADDRESS: EmailStr | None = Field(
+        default=None,
+        validation_alias=AliasChoices("EMAIL_FROM_ADDRESS", "GMAIL_USER"),
+    )
 
     # ─── Rate Limiting ────────────────────────────────────
     RATE_LIMIT_CHAT_PER_MINUTE: int = 60
@@ -110,6 +119,13 @@ class Settings(BaseSettings):
     # ─── SuperAdmin ───────────────────────────────────────
     SUPERADMIN_2FA_ISSUER: str = "AuthorBot SuperAdmin"
     SUBSCRIPTION_TOKEN_ALGORITHM: str = "HS256"
+    # Legacy HF secret name — subscription HMAC uses SECRET_KEY unless this is set.
+    SUBSCRIPTION_SECRET: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("SUBSCRIPTION_SECRET", "SUBSCRIPTION_TOKEN_SECRET"),
+    )
+    # Legacy HF secret name — TOTP secrets are stored per SuperAdmin in the DB.
+    SUPERADMIN_TOTP_SECRET: str | None = Field(default=None, exclude=True)
 
     # ─── Token Budgets (defaults, overridden per plan) ────
     PLAN_MONTHLY_TOKENS: int = 500_000
@@ -135,6 +151,13 @@ class Settings(BaseSettings):
             raise ValueError("SECRET_KEY must be at least 32 characters long")
         return v
 
+    @model_validator(mode="after")
+    def apply_hf_secret_defaults(self) -> "Settings":
+        """Fill derived settings from legacy Hugging Face secret names."""
+        if self.EMAIL_FROM_ADDRESS is None and self.SMTP_USERNAME is not None:
+            self.EMAIL_FROM_ADDRESS = self.SMTP_USERNAME
+        return self
+
 
 @lru_cache
 def get_settings() -> Settings:

backend/app/core/access/token_crypto.py

@@ -213,7 +213,7 @@ def _compute_hmac(payload_b64: bytes) -> bytes:
         URL-safe Base64 encoded signature bytes.
     """
     signature = hmac.new(
-        cfg.SECRET_KEY.encode(),
+        (cfg.SUBSCRIPTION_SECRET or cfg.SECRET_KEY).encode(),
         payload_b64,
         hashlib.sha256,
     ).digest()