Railway job-application effect dependencies
Production dependency package for isolated candidate application workers on Railway. It connects the managed effects composition to private Railway S3-compatible buckets and the candidate-scoped encrypted Postgres vault.
Railway buckets use virtual-hosted–style S3 URLs by default. The adapter requires an HTTPS endpoint, explicit bucket and region, static allowlisted environment reads, bounded object sizes, authenticated AES-GCM envelopes, and exact candidate key prefixes. Legacy path-style access is opt-in.
Objects are never exposed as public or presigned URLs to the browser executor. The worker reads the authorized document revision under FORCE RLS, downloads the exact encrypted object, validates and decrypts it transiently, and returns bytes only to Playwright upload handling.
Configure the allowlisted composition module as @lssm-tech/integration.job-application-effects-dependencies-railway. Required variables are JOB_APPLICATION_DATABASE_URL, JOB_APPLICATION_DATABASE_ROLE, JOB_APPLICATION_MATERIAL_KEY_BASE64, JOB_APPLICATION_DOCUMENT_KEY_BASE64, JOB_APPLICATION_S3_ENDPOINT, JOB_APPLICATION_S3_REGION, JOB_APPLICATION_S3_BUCKET, JOB_APPLICATION_S3_ACCESS_KEY_ID, and JOB_APPLICATION_S3_SECRET_ACCESS_KEY. JOB_APPLICATION_S3_FORCE_PATH_STYLE defaults to false; set it only for a legacy Railway bucket. JOB_APPLICATION_S3_PREFIX defaults to candidate-documents/ and is extended with the exact candidate-scope fingerprint.
Deletion additionally supports JOB_APPLICATION_INBOX_S3_PREFIX and
JOB_APPLICATION_EXPORT_S3_PREFIX, defaulting to candidate-inbox/ and
candidate-exports/. Every object reference must match the configured bucket and exact candidate-scoped prefix. S3 deletion is idempotent; already-deleted candidate vault or browser-handle secrets are also accepted as completed.
The material and document keys must be distinct deployment-owned 32-byte values encoded as canonical base64. Candidate secrets, browser connection values, workflow signatures, and verification keys are resolved from the candidate FORCE-RLS vault. Document metadata must be active, explicitly mandated by the application, allowed for the destination hostname, and bound to the exact encrypted object envelope before any S3 read is returned to Playwright.
