client-secret isn't used.

[cjohnston1158]

It looks like setting the client-secret config option doesn't get used. I think it's from this commit:

1909ace

[agathanatasha]

Is there a reason you are looking at that commit particularly? The client secret is set in the pod

[cjohnston1158]

Prior to that commit, secret_key was:

        secret_key = self.model.config["client-secret"] or self._stored.secret_key

So, if the client-secret config was set it would use the client-secret, else it would use a "generated" secret.. The new code:

            secret_key = self._check_secret()
...
    def _check_secret(self, event=None):
        for rel in self.model.relations["client-secret"]:
            if "client-secret" not in rel.data[self.model.app]:
                rel.data[self.model.app]["client-secret"] = _gen_pass()
            return rel.data[self.model.app]["client-secret"]
        else:
            raise CheckFailed("Waiting for Client Secret", WaitingStatus)

Looks for the secret in the relation, otherwise it generates one. At no point does it look at the config option.

[agathanatasha]

I see. There are two ways moving forward, remove the configuration or account for it in _check_secret. Do you run into situation where you need to set the client-secret configuration? What are the use cases?

[cjohnston1158]

I don't personally have a preference, I just noticed that I would set the client-secret and it wasn't honored.