Stored credentials are encrypted at rest (#5927)

#5927 "Adopt the family idea secret.Box": the SMTP password and the backup
bucket's secret key were kept as plain text in the settings table, so a copy
of the database alone could read them.

- New sealing.py: AES-GCM under an HKDF-derived key, each value bound to its
  setting's name. The key is a random file, /var/inkwell/sealing.key (0600),
  made on first use. It lives on the data volume, not in the database, which
  is where the signing secret sits by default.
- set_settings seals a secret before storing it; get_setting opens it. A value
  that no longer opens (key file lost) reads as not set, so Settings asks
  for it again.
- At startup, credentials stored before this are sealed in place, so nothing
  has to be re-entered. A data folder that can't be written never stops the
  server; saving a password then answers with the reason.
- New dependency: cryptography (approved by the operator).

Also #1919 "Deprecate / remove the PWA": kept. Its service worker caches
only the offline page, so an installed copy always runs the live build. One
stale comment in sw.js is corrected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_integration.py

@@ -26,7 +26,7 @@ import pytest
 import pytest_asyncio
 from sqlalchemy import delete, func, select, text, update
 
-from inkwell import audit, mailer, ratelimit
+from inkwell import audit, mailer, ratelimit, sealing
 from inkwell.app import create_app
 from inkwell.config import Config
 from inkwell.db import dispose_engine, session_scope
@@ -40,7 +40,7 @@ from inkwell.models.note import Note
 from inkwell.models.note_attachment import NoteAttachment
 from inkwell.models.user import User
 from inkwell.notes.tags import _lift_and_reconcile_tags
-from inkwell.settings import get_setting, live, refresh_live, reset_live, set_settings
+from inkwell.settings import get_setting, live, refresh_live, reset_live, seal_stored_secrets, set_settings
 from inkwell.notes.checklist import parse_items, set_item_checked
 from inkwell.notes.helpers import derive_display_title
 from inkwell.models.note_link_preview import NoteLinkPreview
@@ -2004,11 +2004,40 @@ async def test_the_smtp_password_never_leaves_the_server(app_client, db):
     assert (await app_client.patch("/api/settings", json={"smtp_password": ""})).status_code == 200
     async with session_scope() as fresh:
         assert await get_setting(fresh, "smtp_password") == "hunter2"
+        # And the row itself holds it sealed, not as text (#5927).
+        row = await fresh.get(Setting, "smtp_password")
+        assert "hunter2" not in row.value and sealing.PREFIX in row.value
 
     assert (await app_client.patch("/api/settings", json={"smtp_security": "ssl3"})).status_code == 400
     assert (await app_client.patch("/api/settings", json={"public_url": "notes.example.test"})).status_code == 400
 
 
+async def test_a_credential_stored_before_sealing_is_sealed_and_a_lost_key_asks_again(app_client, db):
+    await _mail_off()
+    await _admin_with_invite(app_client)
+    # As an instance from before #5927 left it: the password as plain JSON.
+    async with session_scope() as fresh:
+        fresh.add(Setting(key="smtp_password", value='"hunter2"'))
+        await fresh.commit()
+    async with session_scope() as fresh:
+        assert await get_setting(fresh, "smtp_password") == "hunter2"
+        assert await seal_stored_secrets(fresh) == 1
+        await fresh.commit()
+    async with session_scope() as fresh:
+        assert "hunter2" not in (await fresh.get(Setting, "smtp_password")).value
+        assert await get_setting(fresh, "smtp_password") == "hunter2"
+        assert await seal_stored_secrets(fresh) == 0  # once only
+
+    # The key file lost and a new one made: the value no longer opens, and reads as
+    # not set, so Settings asks for it again.
+    sealing.key_path().unlink()
+    sealing.seal("anything", "other")
+    async with session_scope() as fresh:
+        assert await get_setting(fresh, "smtp_password") == ""
+    rows = {r["key"]: r for r in (await (await app_client.get("/api/settings")).get_json())["settings"]}
+    assert rows["smtp_password"]["is_set"] is False
+
+
 async def test_a_forgotten_password_is_reset_from_an_emailed_link(app_client, db, monkeypatch):
     await _mail_off()
     outbox = _outbox(monkeypatch)

tests/test_sealing.py

@@ -0,0 +1,55 @@
+import stat
+
+import pytest
+
+from inkwell import sealing
+from inkwell.config import Config
+
+
+def test_a_sealed_value_opens_for_its_own_setting_only():
+    stored = sealing.seal("hunter2", "smtp_password")
+    assert stored.startswith(sealing.PREFIX) and "hunter2" not in stored
+    assert sealing.unseal(stored, "smtp_password") == "hunter2"
+    # Copied onto another setting's row, it does not open there.
+    assert sealing.unseal(stored, "backup_s3_secret_key") is None
+
+
+def test_sealing_the_same_value_twice_gives_different_text():
+    assert sealing.seal("x", "k") != sealing.seal("x", "k")
+
+
+def test_the_key_file_is_made_once_readable_only_by_the_server():
+    sealing.seal("x", "k")
+    path = sealing.key_path()
+    assert path.parent == Config.data_root()
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    first = path.read_bytes()
+    sealing.seal("y", "k")
+    assert path.read_bytes() == first
+
+
+def test_a_value_from_before_sealing_reads_as_it_is():
+    assert sealing.unseal("hunter2", "smtp_password") == "hunter2"
+    assert sealing.unseal("v1.looks-versioned", "smtp_password") == "v1.looks-versioned"
+
+
+def test_reading_never_creates_a_key():
+    assert sealing.unseal(sealing.PREFIX + "AAAA", "k") is None
+    assert not sealing.key_path().exists()
+
+
+def test_a_replaced_key_or_a_damaged_value_reads_as_unreadable():
+    stored = sealing.seal("hunter2", "k")
+    assert sealing.unseal(stored[:-4] + "AAAA", "k") is None
+    assert sealing.unseal(sealing.PREFIX + "not base64!", "k") is None
+    sealing.key_path().unlink()
+    sealing.seal("other", "k")  # a new key
+    assert sealing.unseal(stored, "k") is None
+
+
+def test_a_data_folder_that_cannot_be_written_refuses_to_seal(tmp_path, monkeypatch):
+    blocked = tmp_path / "file-not-dir"
+    blocked.write_text("")
+    monkeypatch.setattr(Config, "DATA_DIR", str(blocked))
+    with pytest.raises(sealing.SealError):
+        sealing.seal("hunter2", "k")