fix: allow nullable jwt secret (#1646)

Author: filipecabaco

lib/realtime/api/tenant.ex

@@ -78,10 +78,11 @@ defmodule Realtime.Api.Tenant do
       :migrations_ran,
       :broadcast_adapter
     ])
-    |> validate_required([
-      :external_id,
-      :jwt_secret
-    ])
+    |> validate_required([:external_id])
+    |> check_constraint(:jwt_secret,
+      name: :jwt_secret_or_jwt_jwks_required,
+      message: "either jwt_secret or jwt_jwks must be provided"
+    )
     |> unique_constraint([:external_id])
     |> encrypt_jwt_secret()
     |> maybe_set_default(:max_bytes_per_second, :tenant_max_bytes_per_second)
@@ -102,7 +103,8 @@ defmodule Realtime.Api.Tenant do
     end
   end
 
-  def encrypt_jwt_secret(changeset) do
-    update_change(changeset, :jwt_secret, &Crypto.encrypt!/1)
-  end
+  def encrypt_jwt_secret(%Ecto.Changeset{valid?: true} = changeset),
+    do: update_change(changeset, :jwt_secret, &Crypto.encrypt!/1)
+
+  def encrypt_jwt_secret(changeset), do: changeset
 end

mix.exs

@@ -4,7 +4,7 @@ defmodule Realtime.MixProject do
   def project do
     [
       app: :realtime,
-      version: "2.68.3",
+      version: "2.68.4",
       elixir: "~> 1.18",
       elixirc_paths: elixirc_paths(Mix.env()),
       start_permanent: Mix.env() == :prod,

priv/repo/migrations/20251204170944_nullable_jwt_secrets.exs

@@ -0,0 +1,13 @@
+defmodule Realtime.Repo.Migrations.NullableJwtSecrets do
+  use Ecto.Migration
+
+  def change do
+    alter table(:tenants) do
+      modify :jwt_secret, :string, null: true
+    end
+
+    create constraint(:tenants, :jwt_secret_or_jwt_jwks_required,
+             check: "jwt_secret IS NOT NULL OR jwt_jwks IS NOT NULL"
+           )
+  end
+end