mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
d8122ae9c1
A stored secret that failed to decrypt was used as if it were plaintext. unseal_headers handed the Fernet token back, so every run whose context carried auth sent `Authorization: gAAAAAB...` to the target and reported success. EncryptedJSON returned None, so a scan context's auth silently vanished and the run went out unauthenticated. load_proxy_endpoints returned an empty list, so a scan configured to go through a proxy went direct instead. Rotating SECRET_KEY was enough to trigger all three. decrypt_stored() now separates the two cases a lenient decrypt conflated. A value that carries no Fernet token was written before sealing shipped (2026-09-06) and is returned as it is. A value that carries one and will not open raises SecretDecryptionError, naming the header, the column or the proxy and what to do about it. A stage turns that into a failed activity with the message on it; the api answers 503 through a handler beside the existing DBAPIError one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X5roHYDYzSPRNaTkn8hSkJ