lulululu-debug opened a new pull request, #211: URL: https://github.com/apache/casbin-gateway/pull/211
### Summary Channel API keys were stored as plaintext in the database (an explicit TODO on the ApiKey field). Add optional at-rest encryption controlled by a new "apiKeyEncryptionKey" setting in app.conf. util/crypto.go provides AES-256-GCM primitives: the secret is hashed to a 32-byte key, each value gets a random nonce, and ciphertext is base64 with an "enc:v1:" marker. Encryption is opt-in and backward compatible — an empty key or value passes through, already-encrypted values are idempotent, and legacy plaintext (no marker) is returned unchanged so existing rows keep working and upgrade to ciphertext when the key is next re-entered. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
