Open
Conversation
…tility Add HKDF-based Fernet encryption that derives a unique key per tenant from a master key, enabling cryptographic isolation of connector secrets.
Falls back to SECRET_KEY when not set, but a dedicated key is recommended for production deployments.
The model now supports per-tenant encrypted secrets with graceful fallback to the existing credential_ref env var lookup.
…okup Connectors now receive the already-decrypted credential value from get_secret(), removing the os.environ.get() indirection at init time.
- Pipeline passes get_secret() to connectors instead of raw credential_ref - Create view encrypts secret_value from POST into the model - Templates add a password field for direct secret entry with env var fallback
Tests cover encrypt/decrypt roundtrip, empty strings, cross-tenant isolation, wrong-tenant rejection, env var fallback, and model methods.
Update CHANGELOG, README, SECURITY, deployment guide, project structure, technical reference, and ingestion docs to cover the new encrypted secret feature, FIELD_ENCRYPTION_KEY setting, and credential resolution order.
Provides a safe migration path for existing deployments: reads env var values referenced by credential_ref and encrypts them into the new encrypted_secret field. Supports dry-run, --apply, and --clear-ref modes.
- List page: full-width banner with expandable technical details (Fernet, HKDF-SHA256, tenant isolation, env var compatibility) - Create page + modal: compact inline banner above the secret field - Uses emerald green accent to convey trust/security, with subtle gradient background, shield-check icon, and smooth expand animation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds per-tenant encrypted storage for connector secrets (API keys, client secrets, tokens), so users can enter
credentials directly in the UI instead of relying on server-side environment variables.
Each tenant's secrets are encrypted with a unique Fernet key derived via HKDF-SHA256 from a master key + tenant UUID,
ensuring cryptographic isolation between organizations. Existing connectors using credential_ref (env var names)
continue to work unchanged.
Changes
Encryption layer
docuscore-connector-secret-v1: for future key rotation)
Model
Connector updates
UI
var compatibility)
Migration path for existing deployments
Documentation
Test plan
rejection, SECRET_KEY fallback, corrupted ciphertext, model set/get, env var fallback, encrypted preferred over env,
cross-tenant isolation, no-secret empty return)
apply+clear-ref, skips unset env vars, skips already-encrypted)
connector authenticates correctly
Related Issues
Closes #