open-webui/backend/open_webui/internal
ethan-l-geotab 8cf75e5c18 feat: encrypt user valve values at rest using Fernet
User valves (per-user API keys/config for tools and functions) were
stored as plaintext JSON in the database. This adds Fernet symmetric
encryption at the model layer so valve data is encrypted at rest.

- Uses WEBUI_SECRET_KEY for encryption (no extra env var needed)
- Add valve_encryption.py with encrypt/decrypt helpers using Fernet
- Wire encrypt/decrypt in tools and functions model get/update methods
- Add migration 019 to encrypt existing plaintext valve data
- Backward compatible: decrypt_user_valves handles legacy plaintext dicts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-14 10:30:29 -04:00
..
migrations feat: encrypt user valve values at rest using Fernet 2026-04-14 10:30:29 -04:00
db.py refac 2026-04-12 19:41:02 -05:00
wrappers.py refac 2026-03-17 17:58:01 -05:00