olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Addressed SA-3 by encrypting the sqlite content with a .env secret

Browse Source
This commit is contained in:
olaf
2026-08-26 16:39:53 +02:00
parent 94997752b6
commit 3e61302bf6
17 changed files with 108 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VIBE/CHAT_LOG.md
+12
View File
@@ -945,6 +945,12 @@ Remove the “New primary email address” functionality and keep only selecting
### Assistant outcome
Removed the replacement-email workflow entirely. Added cleanup migration 14 for its unused table; verified alternatives remain the only addresses eligible for primary selection.
### User
Address SA-003 by supplying a dedicated protected encryption key and encrypting sensitive values before SQLite storage.
### Assistant outcome
Added Fernet encryption with required `LINKLOG_DATA_ENCRYPTION_KEY` handling for SMTP, Mastodon OAuth/client and access-token values, TOTP seeds, and recognized administrator plugin secrets. Updated Docker/Compose configuration, tests, README guidance, and the security audit. Legacy plaintext values require rotation after key configuration.
### User
When the user is logged in, the web plugin should not display “Please sign in to use LinkLog.”
@@ -969,6 +975,12 @@ In the popup show that the user has logged in.
### Assistant outcome
Added a localized authenticated-session indicator to the Firefox popup, showing the returned username and backend URL after successful session validation. It remains hidden for signed-out or invalid sessions.
### User
Address SA-003 by using a dedicated secret key supplied through a protected environment or secret file, and encrypt sensitive values before SQLite storage.
### Assistant outcome
Added Fernet encryption using the required `LINKLOG_DATA_ENCRYPTION_KEY` for newly stored SMTP passwords, Mastodon OAuth secrets and access tokens, and TOTP seeds. Protected API responses from returning Mastodon tokens, required the key in Docker, documented generation and rotation, and updated the security audit.
### User
The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
VIBE/PROMPTS.md
+2
View File
@@ -169,10 +169,12 @@
152. Make sure an email can only be selected when it has been validated.
153. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
155. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.
166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
158. When the user is logged in the webplugin should not display "Please sign in to use LinkLog."
156. When the user is signed in the plugin should not display "Please sign in to use LinkLog." and the link to the settings
159. The plugin still does not behave as expected. It still shows that the user should sign in.
160. In the popup show that the user has logged in.
166. Address SA-003 by using a dedicated secret key supplied through a protected environment/secret file, encrypt sensitive values before SQLite storage
161. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
162. The authenticated session text and sign-in block are still shown together.