fix(projekt-matching): setup_langfuse reads admin credentials from pod script

projekt-matching/deploy/setup_langfuse.py

@@ -28,14 +28,31 @@ Prints the project keys; Step 3 (create_pod_langflow.sh) wires them into the
 Langflow container env."""
 from __future__ import annotations
 
+import re
 import sys
 
 import requests
 
 BASE = "http://127.0.0.1:8091"
-ADMIN_BEARER = {"Authorization": "Bearer admin-pm-3f61c2a89d4e"}
-LOGIN_EMAIL = "admin@example.com"
-LOGIN_PASSWORD = "langfuse-admin-pw"
+POD_SCRIPT = "/home/lwc/bin/create_pod_langflow.sh"
+
+
+def _pod_var(name: str) -> str:
+    """Read a VAR="value" assignment from the pod script (single source of
+    configuration -- avoids stale duplicated literals here if the pod
+    script rotates its credentials)."""
+    with open(POD_SCRIPT, encoding="utf-8") as f:
+        text = f.read()
+    m = re.search(rf'^{name}="([^"]+)"', text, re.M)
+    if not m:
+        sys.exit(f"{name} not found in {POD_SCRIPT}")
+    return m.group(1)
+
+
+ADMIN_BEARER = {
+    "Authorization": "Bearer " + _pod_var("LANGFUSE_ADMIN_API_KEY")}
+LOGIN_EMAIL = _pod_var("LANGFUSE_INIT_EMAIL")
+LOGIN_PASSWORD = _pod_var("LANGFUSE_INIT_PASSWORD")
 ORG_NAME = "projekt-matching-org"
 PROJECT_NAME = "projekt-matching"
 SCORE_CONFIGS = (
@@ -87,7 +104,7 @@ def try_admin_api() -> dict | None:
     return keys.json()
 
 
-def session_login() -> requests.Session:
+def session_login() -> tuple[requests.Session, dict]:
     s = requests.Session()
     csrf = s.get(f"{BASE}/api/auth/csrf", timeout=15).json()["csrfToken"]
     r = s.post(f"{BASE}/api/auth/callback/credentials", data={
@@ -118,6 +135,8 @@ def via_session_trpc() -> dict:
             for proj in org["projects"]:
                 if proj["name"] == PROJECT_NAME:
                     project_id = proj["id"]
+                    break
+            break
     if org_id is None:
         org = trpc(s, "organizations.create", {"name": ORG_NAME})
         org_id = org["id"]