open-webui/backend
ethan-l-geotab 8cf75e5c18 feat: encrypt user valve values at rest using Fernet
User valves (per-user API keys/config for tools and functions) were
stored as plaintext JSON in the database. This adds Fernet symmetric
encryption at the model layer so valve data is encrypted at rest.

- Uses WEBUI_SECRET_KEY for encryption (no extra env var needed)
- Add valve_encryption.py with encrypt/decrypt helpers using Fernet
- Wire encrypt/decrypt in tools and functions model get/update methods
- Add migration 019 to encrypt existing plaintext valve data
- Backward compatible: decrypt_user_valves handles legacy plaintext dicts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:30:29 -04:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
open_webui feat: encrypt user valve values at rest using Fernet 2026-04-14 10:30:29 -04:00
.dockerignore fix: litellm config issue 2024-02-24 22:35:11 -08:00
.gitignore refac 2024-09-06 04:59:20 +02:00
dev.sh refac 2026-03-24 19:43:30 -05:00
requirements-min.txt refac: async db 2026-04-12 14:22:11 -05:00
requirements.txt chore: bump dep 2026-04-13 13:49:28 -05:00
start.sh refac 2026-03-24 19:43:30 -05:00
start_windows.bat refac 2026-03-24 19:43:30 -05:00