feat(security): seal legacy plaintext Resend API keys, fail closed on bad keys#51
Open
jusso-dev wants to merge 1 commit into
Open
feat(security): seal legacy plaintext Resend API keys, fail closed on bad keys#51jusso-dev wants to merge 1 commit into
jusso-dev wants to merge 1 commit into
Conversation
… bad keys (closes #28) The settings save path already wraps `resendApiKeyEncrypted` with the AES-GCM `sealTotpSecret` helper, but rows imported before that change — and DB dumps from tenants who have never re-saved settings — still contain plaintext `re_...` keys. `decryptIfSet` in `lib/email/campaign-sender.ts` papered over this by falling back to returning the raw plaintext when the auth-tag check failed. That meant an attacker with DB access (but no `BETTER_AUTH_SECRET`) could still recover working Resend keys, and a wrong key silently appeared to succeed instead of failing closed. This change: - Adds `lib/auth/secret-backfill.ts` with `backfillSealedResendKeys`, which finds any rows matching the plaintext shape and seals them in place. Idempotent — already-sealed rows are skipped because they no longer match the plaintext regex. - Wires the backfill into `instrumentation.ts` next to the existing SSO cache warmer. Failures are logged but non-fatal. - Removes the plaintext fallback from `decryptIfSet`: any value that fails AES-GCM unsealing now throws, so a wrong key fails closed. - Fixes the README screenshot capture script to seal its dummy key before insert. DB dumps now show ciphertext for `resend_api_key_encrypted` on every tenant once instrumentation has run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #28.
Audit finding.
organisations.resendApiKeyEncryptedis wrapped with the existing AES-GCMsealTotpSecrethelper on the settings save path (app/actions/settings.ts:191), and on next admin save it lazily seals legacy plaintext rows. But two gaps remained:re_…keys in the DB.decryptIfSetinlib/email/campaign-sender.tshad a fallback: when AES-GCM unsealing threw, it returned the raw value if it looked like a Resend key. That defeats the point of at-rest encryption (an attacker with DB access but noBETTER_AUTH_SECRETstill gets a working key) and meant a wrong key silently appeared to succeed.Changes.
lib/auth/secret-backfill.ts: newbackfillSealedResendKeysfinds any rows matching the plaintext shape and seals them in place. Idempotent — already-sealed rows no longer match the plaintext regex.instrumentation.ts: runs the backfill on boot next to the existing SSO cache warmer. Failures are logged but non-fatal.lib/email/campaign-sender.ts:decryptIfSetdrops the plaintext fallback. Any value that fails AES-GCM unsealing now throws — wrong key fails closed.scripts/capture-readme-screenshots.ts: seals its dummyre_readme_capture_fake_keybefore insert so the screenshot tenant matches the new invariant.Test plan
BETTER_AUTH_SECRET: launching a campaign throws (theunable to authenticate dataGCM error) instead of returning a stale plaintext.getTransportForOrganisationreturns the decrypted key as before.https://claude.ai/code/session_01PiiqDRQJdW1sBLvEmZ3GBC
Generated by Claude Code