apunkt/dograh
1
0
Fork 0
mirror of https://github.com/dograh-hq/dograh.git synced 2026-07-25 12:01:04 +02:00
Code Issues Projects Releases Packages Wiki Activity

Fix short masked key preservation

Browse source
This commit is contained in:
Abhishek Kumar 2026-06-30 12:59:43 +05:30
parent 01d4d07638
commit 6a6d1d7755
6 changed files with 257 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
api/services/configuration/ai_model_configuration.py
View file

@ -28,6 +28,7 @@ from api.schemas.ai_model_configuration import (
)
from api.services.configuration.masking import (
SERVICE_SECRET_FIELDS,
_secret_values_differ,
contains_masked_key,
mask_key,
resolve_masked_api_keys,
@ -244,11 +245,13 @@ def merge_ai_model_configuration_v2_secrets(
existing_dograh = existing_dict.get("dograh") or {}
incoming_key = incoming_dograh.get("api_key")
existing_key = existing_dograh.get("api_key")
if incoming_key and existing_key and contains_masked_key(incoming_key):
incoming_dograh["api_key"] = resolve_masked_api_keys(
if incoming_key and existing_key:
resolved_key = resolve_masked_api_keys(
incoming_key,
existing_key,
)
if _secret_values_differ(incoming_key, resolved_key):
incoming_dograh["api_key"] = resolved_key
if incoming_dict.get("mode") == "byok" and existing_dict.get("mode") == "byok":
_merge_byok_secret_fields(incoming_dict.get("byok"), existing_dict.get("byok"))
@ -381,11 +384,13 @@ def _merge_service_secret_fields(incoming: dict, existing: dict):
existing_secret = existing[secret_field]
if incoming_secret is None:
incoming[secret_field] = existing_secret
elif contains_masked_key(incoming_secret):
incoming[secret_field] = resolve_masked_api_keys(
else:
resolved_secret = resolve_masked_api_keys(
incoming_secret,
existing_secret,
)
if _secret_values_differ(incoming_secret, resolved_secret):
incoming[secret_field] = resolved_secret
def _raise_if_masked_secret(value):

6
api/services/configuration/masking.py
View file

@ -80,6 +80,12 @@ def is_mask_of(masked: str, real_key: str) -> bool:
return mask_key(real_key) == masked
def _secret_values_differ(left: str | list[str], right: str | list[str]) -> bool:
left_values = left if isinstance(left, list) else [left]
right_values = right if isinstance(right, list) else [right]
return left_values != right_values
def resolve_masked_api_keys(
incoming: str | list[str], existing: str | list[str]
) -> str | list[str]:

13
api/services/configuration/merge.py
View file

@ -11,7 +11,7 @@ from api.schemas.ai_model_configuration import EffectiveAIModelConfiguration
from api.services.configuration.masking import (
MODEL_OVERRIDE_FIELDS,
SERVICE_SECRET_FIELDS,
contains_masked_key,
_secret_values_differ,
resolve_masked_api_keys,
)
@ -50,14 +50,15 @@ def _merge_service_secret_fields(
incoming_secret = incoming_cfg.get(secret_field)
existing_secret = existing_cfg[secret_field]
if incoming_secret is not None:
if contains_masked_key(incoming_secret):
resolved_secret = resolve_masked_api_keys(
incoming_secret,
existing_secret,
)
if _secret_values_differ(incoming_secret, resolved_secret):
incoming_cfg[secret_field] = (
existing_secret
if masked_value_preserves_full_secret
else resolve_masked_api_keys(
incoming_secret,
existing_secret,
)
else resolved_secret
)
elif preserve_missing:
incoming_cfg[secret_field] = existing_secret