3 Commits

Author	SHA1	Message	Date
Ty	818874e65c	feat(m4): crop_fill setting + tape-line prototype (#99) ... Add global crop_fill percent (default 90, 1-100) as a settings key with FastAPI 4xx validation. Wires the value through to the inventory PNG encode (non-retro: stored PNGs untouched). Adds a throwaway TapePrototype.svelte behind ?tape-prototype for the #99 design sandbox. Gates: check_requirements PASS, check_coverage PASS, settings tests 8/8.	2026-09-24 12:01:18 -07:00
Ty	34ee7eff60	Settings: temporary UAT secret-unmask gate (SLAB_UAT_UNMASK_SECRETS) ... Owner-directed, LAN/HTTP dev-test only. When the env flag is set, GET /api/v1/settings returns decrypted secret values (string) instead of {configured: bool}; the UI prefills and shows them in clear text. Default off -> SETTINGS-75 masking and the existing tests stay intact. Revert before any non-UAT deployment.	2026-09-20 07:38:38 -07:00
Ty	b3380f3848	feat(settings): S1 AES-GCM crypto + Settings API/UI (masked write-only secrets) ... - backend/crypto.py: AES-GCM (cryptography.AESGCM); key=base64(SLAB_AES_KEY) must be exactly 32 bytes; value_enc=base64(nonce(12)||ct); DecryptError on tamper - backend/settings.py: get_settings (secrets->{configured:bool}, woo_base_url env read-only, flags default false), update_settings (rejects woo_base_url SETTINGS-85, encrypts secrets, partial plain writes) - backend/app.py: wire GET/PUT /api/v1/settings - frontend/src/create/settings/Settings.svelte: masked form + partial PUT - tests: crypto roundtrip/tamper, masked GET, encrypted PUT, reject woo_base_url, flags default, decrypt-fail->configured:false (TDD) Verified live: secrets round-trip configured:true with valid key; woo_base_url write rejected 400; no secret leak in GET. Gates: check_requirements + check_coverage exit 0; pytest 13 passed. Deploy+build on ubudual5060 (never Windows).	2026-09-19 15:48:42 -07:00