Repository navigation
feat: interop enc:v1 — decifra e re-cifra o armazenamento do gateway - #6
Merged
Merged
Conversation
O gateway cifra credenciais em repouso com AES-256-GCM (enc:v1:<iv>:<ct>:<tag>). A leitura passa a decifrar com STORAGE_ENCRYPTION_KEY e a escrita re-cifra no mesmo formato; sem chave ou sem a biblioteca o comportamento anterior permanece (valor cifrado intacto, tratado como 'nao verificavel daqui'). - gateway.py: derivacao scrypt (sal = contexto estatico medido no bundle), decrypt/encrypt, integrados a get_all_connections e update_connection. Fica no modulo de dominio do gateway, como manda o contrato de identidade. - pyproject.toml: pycryptodome==3.23.0 pinada. Importada sob demanda. - ci.yml: instala o pacote antes da suite para os testes de cifra rodarem. - .env.example e wiki: documentam STORAGE_ENCRYPTION_KEY. - tests/test_enc_v1.py: vetor de interop gerado pelo Node, ciclo leitura/escrita contra SQLite real e degradacao sem a biblioteca. Substitui a versao anterior deste PR, cujo Dockerfile vinha de outro repositorio (COPY apps/...) e quebrava o build da imagem.
elielsousa-pathbit
force-pushed
the
feat/enc-v1-field-decryption
branch
from
October 20, 2026 01:08
452a1c6 to
af89324
Compare
elielsousa-pathbit
changed the title
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
elielsousa-pathbit
approved these changes
Oct 20, 2026
elielsousa-pathbit
left a comment
elielsousa-pathbit
left a comment
Contributor
There was a problem hiding this comment.
Revisado e refeito sobre o master atual (Dockerfile de outro repositorio descartado, import da pycryptodome sob demanda, testes de integracao). CI verde em 3.11-3.14, CodeQL e build Docker/testcontainers.
…ort misto de unittest)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
O que muda
O gateway cifra credenciais em repouso com AES-256-GCM (
enc:v1:<iv>:<ct>:<tag>). A leitura passa a decifrar comSTORAGE_ENCRYPTION_KEYe a escrita re-cifra no mesmo formato. Sem chave, ou sem a biblioteca, nada muda: o valor cifrado volta intacto e o painel segue dizendo 'nao verificavel daqui'.Por que o PR falhava
COPY apps/ominirtksync/..., rotulo TalqueeAI,WEB_HOST=127.0.0.1): quebrava o build da imagem. Foi descartado.omini_rtksync(renomeado paraomni_rtksyncno fix(naming): corrige grafia OminiRTkSync para OmniRTkSync #25) e odatabase.py, que virougateway.py.PYTHONPATH=srcsem instalar dependencias; umimport Cryptono topo derrubava a coleta da suite inteira.Conteudo (refeito sobre o master atual)
gateway.py: derivacao scrypt (sal = contexto estatico medido no bundle), decrypt/encrypt, ligados aget_all_connectionseupdate_connection. Fica no modulo de dominio do gateway, como manda o teste de identidade.pyproject.toml:pycryptodome==3.23.0pinada, importada sob demanda.ci.yml: instala o pacote antes da suite, para os testes de cifra rodarem de verdade..env.examplee wiki: documentamSTORAGE_ENCRYPTION_KEY.tests/test_enc_v1.py: vetor de interop gerado pelo Node, ciclo leitura/escrita contra SQLite real e degradacao sem a biblioteca.Validacao local
valida_docs.py: 0 divergencias