bvandeusen
6e91bdc82b
Secrets (smtp.password, oidc.client_secret, ldap.bind_password, ansible ssh_private_key/become_password/vault_password) were stored plaintext in app_settings. Add transparent encryption-at-rest: - steward/core/crypto.py: Fernet keyed off the app secret (/data/secret.key), enc:v1: prefix marks ciphertext; passthrough for plaintext/empty/no-key, never reveals plaintext on a wrong key. - settings.py: SECRET_KEYS registry; set_setting encrypts on write; all read paths (get_setting / get_all_settings / load_settings_sync) decrypt transparently; migrate_plaintext_secrets() converts legacy rows in place. - app.py startup: init_crypto(SECRET_KEY) + one-time legacy-secret migration before settings load. - Add cryptography dependency. UI masking is unchanged (it checks decrypted truthiness). Key-loss caveat documented: secrets are unrecoverable if the app secret key is lost. Unit tests cover round-trip, empty/plaintext passthrough, and wrong-key safety. Task #580. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
52 lines
1.0 KiB
TOML
52 lines
1.0 KiB
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "steward"
|
|
version = "0.1.0"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"quart>=0.19",
|
|
"sqlalchemy[asyncio]>=2.0",
|
|
"asyncpg>=0.29",
|
|
"alembic>=1.13",
|
|
"bcrypt>=4.1",
|
|
"python-dotenv>=1.0",
|
|
"pyyaml>=6.0",
|
|
"packaging>=24.0",
|
|
"click>=8.0",
|
|
"httpx>=0.27",
|
|
"cryptography>=42",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
ldap = [
|
|
"ldap3>=2.9",
|
|
]
|
|
snmp = [
|
|
"pysnmp-lextudio>=6.2",
|
|
]
|
|
# Batteries-included Ansible (bundles the common community collections) for the
|
|
# playbook runner. Installed into the image via Dockerfile `pip install .[ansible]`.
|
|
ansible = [
|
|
"ansible>=10,<13",
|
|
]
|
|
dev = [
|
|
"pytest>=8.0",
|
|
"pytest-asyncio>=0.23",
|
|
]
|
|
|
|
[project.scripts]
|
|
steward = "steward.cli:main"
|
|
|
|
[tool.pytest.ini_options]
|
|
asyncio_mode = "auto"
|
|
testpaths = ["tests"]
|
|
markers = [
|
|
"integration: requires a live Postgres; runs only in the integration CI lane",
|
|
]
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["steward"]
|