fix: mark client side variable as server side to add security for sensitive env keys

[pranalidhanavade]

What

• fix: mark client side variable as server side to add sercurity for sensitive env keys

---

Important

Enhance security by marking sensitive environment keys as server-side and refactor password encryption logic.

• Security Enhancements:
  • Marked CRYPTO_PRIVATE_KEY as server-side only in passwordActions.ts and Auth.ts to prevent exposure of sensitive keys.
  • Updated decryptValue() in SchemaListUtils.ts to use server-side CRYPTO_PRIVATE_KEY.
• Password Encryption:
  • Moved password encryption logic to encryptPasswordActionForSignIn and encryptPasswordAction in passwordActions.ts.
  • Replaced passwordEncryption with encryptPasswordAction in SessionManager.tsx.
  • Replaced passwordEncryption with passwordEncryptionForSignIn in user-auth-form.tsx.
• Miscellaneous:
  • Changed link from /billing to /pricing in Billing.tsx.

^{This description was created by for dce3d5e. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Caution

Changes requested ❌

Reviewed everything up to dce3d5e in 2 minutes and 16 seconds. Click for details.

• Reviewed 191 lines of code in 7 files
• Skipped 0 files when reviewing.
• Skipped posting 3 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. src/app/api/Auth.ts:234

• Draft comment:
  There are two encryption functions (async and sync) with similar logic. Consider consolidating them to avoid duplication and potential maintenance issues.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 20% vs. threshold = 50% The functions appear to be doing different things - one is a wrapper around an external action that handles sign-in specific encryption with additional params, while the other is a simple password encryption utility. Without seeing the implementation of encryptPasswordActionForSignIn, I can't confirm they use similar logic. The similarity in names doesn't necessarily mean duplicated functionality. I could be wrong about them being different - maybe encryptPasswordActionForSignIn does use the same CryptoJS logic under the hood. The async vs sync difference could be artificial. Even if the underlying encryption is similar, the functions serve different purposes in the codebase based on their signatures and usage patterns. Consolidating them could make the code less clear. The comment should be deleted as there isn't strong evidence that these functions represent problematic duplication - they appear to serve distinct purposes despite similar names.

2. src/features/verification/components/SchemaListUtils.ts:88

• Draft comment:
  Ensure that decryptValue is only executed in a secure (server-side) context as it uses CRYPTO_PRIVATE_KEY. Exposing this key in client bundles can be a security risk.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 20% vs. threshold = 50% The comment raises a valid security concern, but it starts with "Ensure that..." which violates our rules. Additionally, the code change itself is actually fixing the security issue by moving from a public to private env var. The comment seems to be more of a general warning rather than addressing a specific issue that needs to be fixed. Without seeing where this function is used, we can't definitively say there's a problem. The comment could be identifying a real security risk if this function is used client-side. The code change alone doesn't guarantee proper usage. While the security concern is valid in general, the comment doesn't point to specific evidence of misuse, and the code change itself is actually improving security. Delete the comment because it starts with "Ensure that..." and doesn't point to specific evidence of misuse. The code change itself is actually improving security by removing NEXT_PUBLIC_.

3. src/features/profile/components/Billing.tsx:27

• Draft comment:
  Link for the 'PRO' plan has been updated to '/pricing'. Confirm that this change aligns with the intended design.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

Workflow ID: wflow_HBGxF2HX1eLpifj6

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}