Laravel Passport and Heroku where to store encryption keys? - laravel

Question

I am trying to deploy a Laravel application, which uses Laravel Passport, with Heroku.
Everytime the app is deployed the slug is rebuilt causing the Laravel Passport encryption keys to be erased. It means everytime the app is deployed:
the storage folder permissions should be changed
new encryption keys should be generated
all existing tokens would be undecryptable
For now, the solution I ended up with is to store the OAuth private and public keys in two different Heroku config variables (a.k.a. environment variables). And I extended the PassportServiceProvider class so it looks for the encryption keys in environment variables if the environment is set to "production":
I created a new PassportServiceProvider class in app/Providers:
<?php
namespace App\Providers;
use Laravel\Passport\PassportServiceProvider as LaravelPassportServiceProvider;
use League\OAuth2\Server\AuthorizationServer;
use League\OAuth2\Server\CryptKey;
use League\OAuth2\Server\ResourceServer;
class PassportServiceProvider extends LaravelPassportServiceProvider
{
protected function registerResourceServer()
{
$publicKeyPath = config('app.env') === 'production' ? env('OAUTH_PUBLIC_KEY') : 'oauth-public.key';
$this->app->singleton(ResourceServer::class, function () use ($publicKeyPath) {
return new ResourceServer(
$this->app->make(\Laravel\Passport\Bridge\AccessTokenRepository::class),
$this->makeCryptKey($publicKeyPath)
);
});
}
public function makeAuthorizationServer()
{
$privateKeyPath = config('app.env') === 'production' ? env('OAUTH_PRIVATE_KEY') : 'oauth-private.key';
return new AuthorizationServer(
$this->app->make(\Laravel\Passport\Bridge\ClientRepository::class),
$this->app->make(\Laravel\Passport\Bridge\AccessTokenRepository::class),
$this->app->make(\Laravel\Passport\Bridge\ScopeRepository::class),
$this->makeCryptKey($privateKeyPath),
app('encrypter')->getKey()
);
}
protected function makeCryptKey($key)
{
if (config('app.env') === 'production') {
return new CryptKey(str_replace('\n', "\n", $key), null, false);
}
return new CryptKey(file://'.Passport::keyPath($key), null, false);
}
}
Append the following line to the providers array in config/app.php:
Api\Providers\PassportServiceProvider::class,
Tell Laravel to not auto-discover the Laravel Passport package. in composer.json:
"extra": {
"laravel": {
"dont-discover": [
"laravel/passport"
]
}
}
This solution is not fully functional on its own because of this issue.
But I am not convinced it is the right way to do it. I wonder if someone already faced the problem. If so how did you solve it?
Thank you in advance.