better secrets admin

lapp.py

@@ -1,6 +1,3 @@
-import os
-import secrets
-from pathlib import Path
 from flask import Flask, send_from_directory, url_for
 from flask_login import LoginManager
 from models import db
@@ -11,31 +8,16 @@ from lists import lists_bp
 from items import items_bp
 from api import api_bp
 from groups import groups_bp
+from secrets_config import load_secrets
 
 login_manager = LoginManager()
 
-def load_secret(app, env_name, filename):
-    secret = os.environ.get(env_name)
-    if secret:
-        return secret
-
-    instance_path = Path(app.instance_path)
-    instance_path.mkdir(parents=True, exist_ok=True)
-    secret_path = instance_path / filename
-
-    if secret_path.exists():
-        return secret_path.read_text(encoding="utf-8").strip()
-
-    secret = secrets.token_urlsafe(48)
-    secret_path.write_text(secret, encoding="utf-8")
-    secret_path.chmod(0o600)
-    return secret
-
 def create_app():
     app = Flask(__name__, instance_relative_config=True)
-    app.config["SECRET_KEY"] = load_secret(app, "LAPP_SECRET_KEY", "secret_key")
-    app.config["APPLICATION_KEY"] = load_secret(app, "LAPP_APPLICATION_KEY", "application_key")
-    app.config["SQLALCHEMY_DATABASE_URI"] = os.environ.get("LAPP_DATABASE_URI", "sqlite:///app.db")
+    secret_values = load_secrets(app.instance_path)
+    app.config["SECRET_KEY"] = secret_values["runtime"]["secret_key"]
+    app.config["APPLICATION_KEY"] = secret_values["runtime"]["application_key"]
+    app.config["SQLALCHEMY_DATABASE_URI"] = secret_values["runtime"]["database_uri"]
 
     db.init_app(app)
     login_manager.init_app(app)