Skip to content

feat: Implement client-side password encryption #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 28 commits into from
May 28, 2025
Merged

feat: Implement client-side password encryption #67

Show file tree
Hide file tree
Changes from 22 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
fa77c53
feat: Implement client-side password encryption
google-labs-jules[bot] May 23, 2025
2d25b6b
Update admin/src/components/UserSettings/ChangePassword.tsx
kubbot May 23, 2025
e6c6e67
Update backend/app/tests/core/test_security.py
kubbot May 23, 2025
d3eb32d
Update frontend/app/customers/components/PasswordForm.tsx
kubbot May 23, 2025
dae88a6
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 24, 2025
3a2677c
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 24, 2025
cbd442c
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 24, 2025
ab1a825
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 25, 2025
3a0fb2a
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 25, 2025
8016911
fix: actions error make all
cubxxw May 25, 2025
ae29a54
fix: actions error make all
cubxxw May 25, 2025
93c7077
Merge branch 'main' into feat/password-transit-encryption
cubxxw May 25, 2025
fad753b
feat: fix teset
cubxxw May 25, 2025
944b4bd
feat: fix teset
cubxxw May 25, 2025
c2783e5
feat: fix teset
cubxxw May 25, 2025
3625ecb
feat: fix teset
cubxxw May 25, 2025
a4037bb
feat: fix teset
cubxxw May 25, 2025
78b18dc
fix: actions error make all
cubxxw May 25, 2025
8b824a2
fix: actions error make all
cubxxw May 25, 2025
110c8fe
Resolved merge conflicts
cubxxw May 28, 2025
ddeec90
Resolved merge conflicts
cubxxw May 28, 2025
701bc1d
chore: update dependencies and environment configurations
cubxxw May 28, 2025
7e75f8e
refactor: streamline CORS configuration in main.py
cubxxw May 28, 2025
2962693
chore: comment out deployment steps in staging workflow
cubxxw May 28, 2025
9c4d04f
Update .github/workflows/generate-client.yml
cubxxw May 28, 2025
79c00c6
Update backend/app/core/security.py
cubxxw May 28, 2025
51ac12d
Update .env.example
cubxxw May 28, 2025
dc1e122
Enhance security logging and update OpenAPI specification
cubxxw May 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,16 +51,14 @@ ACCESS_TOKEN_EXPIRE_MINUTES=14400

# First Superuser: Email address for the initial administrator account.
[email protected]

# First Superuser Password: Password for the initial administrator account.
# Choose a strong password.
# min_length=8
FIRST_SUPERUSER_PASSWORD='telepace'

# First Superuser ID: Optional UUID for the initial administrator account.
# If not set, a random UUID will be generated.
# Example: e8ccbeed-f588-4b9a-95ca-000000000000
# FIRST_SUPERUSER_ID=
# 用于密码加密和解密的对称密钥，必须是有效的 Fernet 密钥（32 字节的 URL 安全 base64 编码，末尾必须有 = 符号）
# 生成方法: `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`
APP_SYMMETRIC_ENCRYPTION_KEY='Buhzb09HgEg-4C7oUsZqykAH_-yfXEONu9sogno3a2s='

# -- Email (SMTP) Settings --
# Configuration for sending emails (e.g., password resets, notifications).
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/generate-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ jobs:
POSTHOG_API_KEY: ""
POSTHOG_HOST: ""
VIRTUAL_ENV: .venv
APP_SYMMETRIC_ENCRYPTION_KEY: 'Buhzb09HgEg-4C7oUsZqykAH_-yfXEONu9sogno3a2s='

- name: Stage Generated Files
run: |
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/playwright.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,9 +74,6 @@ jobs:
working-directory: backend
- run: pnpm install --frozen-lockfile
working-directory: frontend
- run: uv run bash scripts/generate-client.sh
env:
VIRTUAL_ENV: backend/.venv
- name: Install Doppler CLI
uses: dopplerhq/cli-action@v3
- name: Setup Doppler and env
Expand All @@ -87,6 +84,9 @@ jobs:
echo "STACK_NAME=$STACK_NAME" >> $GITHUB_ENV
env:
DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN_STAGING }}
- run: doppler run -- uv run bash scripts/generate-client.sh
env:
VIRTUAL_ENV: backend/.venv
- run: docker compose --project-name $STACK_NAME down --remove-orphans
- run: docker compose --project-name $STACK_NAME build
- run: docker compose --project-name $STACK_NAME up -d
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ jobs:
artifacts: "dist/*"
generateReleaseNotes: true
bodyFile: "CHANGELOG.md"
token: ${{ secrets.BOT_GITHUB_TOKEN }}
token: ${{ secrets.GITHUB_TOKEN }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Grant write permissions to GITHUB_TOKEN for release creation
Switching from BOT_GITHUB_TOKEN to the built-in GITHUB_TOKEN means you must explicitly grant it contents: write rights to create a release. Without this, the release step will fail at runtime.

Apply this diff at the top of the workflow:

 name: Auto Release

+permissions:
+  contents: write  # allow GITHUB_TOKEN to create and publish releases

 on:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
token: ${{ secrets.GITHUB_TOKEN }}
name: Auto Release
permissions:
contents: write # allow GITHUB_TOKEN to create and publish releases
on:
# …rest of your triggers
🤖 Prompt for AI Agents 
In .github/workflows/release.yml at line 118, the GITHUB_TOKEN is used but lacks
explicit write permissions needed for release creation. To fix this, add a
permissions section at the top of the workflow file granting 'contents: write'
to the GITHUB_TOKEN. This ensures the token has the necessary rights to create
releases during the workflow execution.

draft: false
prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-beta') || contains(github.ref, '-alpha') }}

Expand Down
1 change: 1 addition & 0 deletions .windsurfrules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
1. The text of the reply is in Chinese, but the code is in English
Copy link
Preview

Copilot AI May 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] This rule file appears unintended for the codebase and mixes Chinese/English. Remove or relocate it to avoid confusion.

Suggested change
1. The text of the reply is in Chinese, but the code is in English
[File removed]

Copilot uses AI. Check for mistakes.

2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ backend-restart:
.PHONY: backend-install
backend-install: check-uv
@echo "===========> Installing backend dependencies"
@cd $(BACKEND_DIR) && $(UV) sync
@cd $(BACKEND_DIR) && UV_HTTP_TIMEOUT=120 $(UV) sync

## backend-test: Run backend tests with coverage
.PHONY: backend-test
Expand Down
6 changes: 5 additions & 1 deletion admin/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,6 @@
VITE_API_URL=http://localhost:8000
NODE_ENV=development
NODE_ENV=development

# This key needs to be a securely generated, preferably 32-byte (256-bit) random string,
# often represented in base64. For Fernet, it must be a URL-safe base64-encoded 32-byte key.
VITE_APP_SYMMETRIC_ENCRYPTION_KEY="your_strong_symmetric_encryption_key_here"
2 changes: 2 additions & 0 deletions admin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
"@tanstack/react-query-devtools": "^5.28.14",
"@tanstack/react-router": "1.19.1",
"axios": "1.7.4",
"crypto-js": "^4.2.0",
"form-data": "4.0.0",
"next-themes": "^0.4.4",
"react": "^18.2.0",
Expand All @@ -36,6 +37,7 @@
"@playwright/test": "^1.45.2",
"@tanstack/router-devtools": "1.19.1",
"@tanstack/router-vite-plugin": "1.19.0",
"@types/crypto-js": "^4.2.2",
"@types/node": "^20.10.5",
"@types/react": "^18.2.37",
"@types/react-dom": "^18.2.15",
Expand Down
Loading