grokbot_ty
82219fe5ad
- AES-GCM encrypt/decrypt module (app/security/aes.py):
- get_aes_key: decode base64 AES master key to 32 bytes
- encrypt_setting: AES-256-GCM with fresh 12-byte nonce per call, returns nonce||ciphertext
- decrypt_setting: decrypts ciphertext, raises AuthenticationError on tamper/wrong key
- Settings endpoint (app/api/settings.py):
- GET /api/v1/settings: returns SettingsView with decrypted values, secrets masked
(woo_app_password never returned, only woo_credentials_configured boolean)
- PUT /api/v1/settings: encrypts all setting values AES-GCM, stores in settings table
- Rejects woo_consumer_key/woo_consumer_secret fields
- Validates woo_create_status (draft|publish)
- App factory (app/main.py): stores settings on app.state for dependency injection
- Unit tests (tests/unit/test_aes.py): 18 tests covering AES-1 (round-trip), AES-2
(missing key refusal), FUND-17 (fresh nonce, tamper rejection), FUND-19
(no plaintext fallback)
Test results: 23/23 passed (18 new AES + 5 existing health tests)
11 lines
203 B
Plaintext
11 lines
203 B
Plaintext
fastapi>=0.115,<1
|
|
uvicorn[standard]>=0.34,<1
|
|
sqlalchemy>=2.0,<3
|
|
aiosqlite>=0.20,<1
|
|
alembic>=1.14,<2
|
|
httpx>=0.28,<1
|
|
pydantic>=2.9,<3
|
|
pydantic-settings>=2.7,<3
|
|
python-dotenv>=1.0,<2
|
|
cryptography>=43.0,<45
|