Store credentials as YAML with optional encryption at rest - #115
Open
P6g9YHK6 wants to merge 2 commits into
Open
Store credentials as YAML with optional encryption at rest#115P6g9YHK6 wants to merge 2 commits into
P6g9YHK6 wants to merge 2 commits into
Conversation
Auth/secrets.json becomes Auth/auth.yaml. An existing secrets.json is migrated automatically the first time it's read - written straight back out as auth.yaml, with the old file left in place untouched (as a backup, and so a downgrade isn't a hard break). Every load after that first migration hits the YAML file directly and never looks at the JSON file again. No behavior change for callers - get_cached_value/set_cached_value/ get_cached_value_or_set keep the same signatures.
Every value written to auth.yaml (OAuth tokens, FCM credentials, vault keys, ...) is encrypted with AES-256-GCM when this env var is set - any string works, it's hashed down to an AES-256 key. Unset keeps the previous plain-text behavior and prints a one-time warning saying so. Values are JSON-serialized before encrypting so this isn't limited to flat strings (fcm_credentials is a nested dict), and prefixed with a versioned marker so an encrypted value is distinguishable from a plain one - anything without the prefix is read back as-is, so values written before a key was ever set keep working with no migration step. A wrong or rotated key makes decrypt fail with InvalidTag, which is treated as a missing value rather than crashing every caller of get_cached_value. The legacy secrets.json migration also encrypts each value on the way in when a key is already set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits:
Store credentials as YAML instead of JSON
Auth/secrets.jsonbecomesAuth/auth.yaml. An existingsecrets.jsonis migrated automatically the first time it's read - written straight back out asauth.yaml, with the old file left in place untouched (as a backup, and so a downgrade isn't a hard break). Every load after that first migration hits the YAML file directly and never looks at the JSON file again.No behavior change for callers -
get_cached_value/set_cached_value/get_cached_value_or_setkeep the same signatures.Add optional encryption at rest via
SECRETS_ENCRYPTION_KEYEvery value written to
auth.yaml(OAuth tokens, FCM credentials, vault keys, ...) is encrypted with AES-256-GCM when this env var is set - any string works, it's hashed down to an AES-256 key. Unset keeps the previous plain-text behavior and prints a one-time warning saying so.Values are JSON-serialized before encrypting so this isn't limited to flat strings (
fcm_credentialsis a nested dict), and prefixed with a versioned marker so an encrypted value is distinguishable from a plain one - anything without the prefix is read back as-is, so values written before a key was ever set keep working with no migration step. A wrong or rotated key makes decrypt fail, which is treated as a missing value (None) rather than crashing every caller ofget_cached_value.The legacy
secrets.jsonmigration also encrypts each value on the way in when a key is already set.No new hard dependency beyond
pyyaml-cryptography(used for the AES-GCM encryption) was already a requirement.