jubnl bba50f038b fix: encrypt OIDC client secret at rest using AES-256-GCM ...

The oidc_client_secret was written to app_settings as plaintext,
unlike Maps and OpenWeather API keys which are protected with
apiKeyCrypto. An attacker with read access to the SQLite file
(e.g. via a backup download) could obtain the secret and
impersonate the application with the identity provider.

- Encrypt on write in PUT /api/admin/oidc via maybe_encrypt_api_key
- Decrypt on read in GET /api/admin/oidc and in getOidcConfig()
  (oidc.ts) before passing the secret to the OIDC client library
- Add a startup migration that encrypts any existing plaintext value
  already present in the database

2026-04-01 07:56:29 +02:00

..

public

Merge branch 'perf-test' of https://github.com/jubnl/TREK into dev

2026-03-31 23:10:02 +02:00

src

fix: encrypt OIDC client secret at rest using AES-256-GCM

2026-04-01 07:56:29 +02:00

.env.example

docs: document all env vars and remove SMTP/webhook from docker config

2026-03-31 22:24:07 +03:00

package-lock.json

Merge branch 'pr-125'

2026-03-30 23:10:34 +02:00

package.json

Merge branch 'pr-125'

2026-03-30 23:10:34 +02:00

reset-admin.js

Stabilize core: better-sqlite3, versioned migrations, graceful shutdown

2026-03-22 17:52:24 +01:00

tsconfig.json

some fixes

2026-03-30 06:59:24 +02:00