Ty_Tech/SlabUploader
6
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

Settings: temporary UAT secret-unmask gate (SLAB_UAT_UNMASK_SECRETS)

Browse Source 
Owner-directed, LAN/HTTP dev-test only. When the env flag is set,
GET /api/v1/settings returns decrypted secret values (string) instead of
{configured: bool}; the UI prefills and shows them in clear text. Default
off -> SETTINGS-75 masking and the existing tests stay intact. Revert
before any non-UAT deployment.
This commit is contained in:
Ty Balascio
2026-09-20 07:38:38 -07:00
parent e51753b6d0
commit 34ee7eff60
2 changed files with 49 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/settings.py
+21 -7
View File
@@ -59,18 +59,32 @@ def get_settings() -> dict[str, Any]:
result: dict[str, Any] = {}
result["woo_base_url"] = os.environ.get("WOO_BASE_URL", "")
# TEMPORARY UAT override (owner-directed, LAN/HTTP only): when set, secrets are
# returned as their decrypted plaintext so they can be inspected on the dev-test
# box. Default OFF -> SETTINGS-75 masking intact. Remove before prod.
unmask = os.environ.get("SLAB_UAT_UNMASK_SECRETS") == "1"
for k in sorted(ALL_KEYS):
row = rows.get(k, {})
if k in SECRET_KEYS:
enc = row.get("value_enc")
if enc:
try:
decrypt(enc) # verify roundtrip possible
result[k] = {"configured": True}
except Exception:
result[k] = {"configured": False}
if unmask:
if enc:
try:
result[k] = decrypt(enc)
except Exception:
result[k] = ""
else:
result[k] = ""
else:
result[k] = {"configured": False}
if enc:
try:
decrypt(enc) # verify roundtrip possible
result[k] = {"configured": True}
except Exception:
result[k] = {"configured": False}
else:
result[k] = {"configured": False}
else:
if k in rows:
val = _row_to_value(row)