Skip to content

Commit 214aa56

Browse files
madhav165crivetimihai
madhav165
and
crivetimihai
authored
Upgrade Encryption: Argon2id KDF & Per-Record Salts (#1373)
* Removes redundant base64 Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Replace PBKDF2HMAC with Argon2Id encryption Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Use Argon2id for key generation in fernet encryption Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Add docstring Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Make sso_service use fernet_encryption utl Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * wip migration script Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Fix import in alembic script Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Linting fixes Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Move encryption from util to service Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Add missing docstrings Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * flake8 fixes Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Handle str inputs for encryption_secret Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Update alembic down revision number Signed-off-by: Madhav Kandukuri <madhav165@gmail.com> * Fix bandit --------- Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>
1 parent 0a63867 commit 214aa56

File tree

15 files changed

+830
-296
lines changed

15 files changed

+830
-296
lines changed

‎Containerfile.lite‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
7676

7777
ARG PYTHON_VERSION
7878
ARG ROOTFS_PATH
79-
ARG TARGETPLATFORM
79+
ARG TARGETPLATFORM=linux/amd64
8080
ARG GRPC_PYTHON_BUILD_SYSTEM_OPENSSL='False'
8181

8282
# ----------------------------------------------------------------------------

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2658,7 +2658,7 @@ docker-dev:
26582658
@$(MAKE) container-build CONTAINER_RUNTIME=docker CONTAINER_FILE=Containerfile
26592659

26602660
docker:
2661-
@$(MAKE) container-build CONTAINER_RUNTIME=docker CONTAINER_FILE=Containerfile
2661+
@$(MAKE) container-build CONTAINER_RUNTIME=docker CONTAINER_FILE=Containerfile.lite
26622662

26632663
docker-prod:
26642664
@DOCKER_CONTENT_TRUST=1 $(MAKE) container-build CONTAINER_RUNTIME=docker CONTAINER_FILE=Containerfile.lite

‎mcpgateway/admin.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@
9595
)
9696
from mcpgateway.services.a2a_service import A2AAgentError, A2AAgentNameConflictError, A2AAgentNotFoundError, A2AAgentService
9797
from mcpgateway.services.catalog_service import catalog_service
98+
from mcpgateway.services.encryption_service import get_encryption_service
9899
from mcpgateway.services.export_service import ExportError, ExportService
99100
from mcpgateway.services.gateway_service import GatewayConnectionError, GatewayNameConflictError, GatewayNotFoundError, GatewayService, GatewayUrlConflictError
100101
from mcpgateway.services.import_service import ConflictStrategy
@@ -113,7 +114,6 @@
113114
from mcpgateway.utils.create_jwt_token import create_jwt_token, get_jwt_token
114115
from mcpgateway.utils.error_formatter import ErrorFormatter
115116
from mcpgateway.utils.metadata_capture import MetadataCapture
116-
from mcpgateway.utils.oauth_encryption import get_oauth_encryption
117117
from mcpgateway.utils.pagination import generate_pagination_links
118118
from mcpgateway.utils.passthrough_headers import PassthroughHeadersError
119119
from mcpgateway.utils.retry_manager import ResilientHttpClient
@@ -6194,7 +6194,7 @@ async def admin_add_gateway(request: Request, db: Session = Depends(get_db), use
61946194
oauth_config = json.loads(oauth_config_json)
61956195
# Encrypt the client secret if present
61966196
if oauth_config and "client_secret" in oauth_config:
6197-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
6197+
encryption = get_encryption_service(settings.auth_encryption_secret)
61986198
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_config["client_secret"])
61996199
except (json.JSONDecodeError, ValueError) as e:
62006200
LOGGER.error(f"Failed to parse OAuth config: {e}")
@@ -6231,7 +6231,7 @@ async def admin_add_gateway(request: Request, db: Session = Depends(get_db), use
62316231
oauth_config["client_id"] = oauth_client_id
62326232
if oauth_client_secret:
62336233
# Encrypt the client secret
6234-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
6234+
encryption = get_encryption_service(settings.auth_encryption_secret)
62356235
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_client_secret)
62366236

62376237
# Add username and password for password grant type
@@ -6503,7 +6503,7 @@ async def admin_edit_gateway(
65036503
oauth_config = json.loads(oauth_config_json)
65046504
# Encrypt the client secret if present and not empty
65056505
if oauth_config and "client_secret" in oauth_config and oauth_config["client_secret"]:
6506-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
6506+
encryption = get_encryption_service(settings.auth_encryption_secret)
65076507
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_config["client_secret"])
65086508
except (json.JSONDecodeError, ValueError) as e:
65096509
LOGGER.error(f"Failed to parse OAuth config: {e}")
@@ -6540,7 +6540,7 @@ async def admin_edit_gateway(
65406540
oauth_config["client_id"] = oauth_client_id
65416541
if oauth_client_secret:
65426542
# Encrypt the client secret
6543-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
6543+
encryption = get_encryption_service(settings.auth_encryption_secret)
65446544
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_client_secret)
65456545

65466546
# Add username and password for password grant type
@@ -9571,7 +9571,7 @@ async def admin_add_a2a_agent(
95719571
oauth_config = json.loads(oauth_config_json)
95729572
# Encrypt the client secret if present
95739573
if oauth_config and "client_secret" in oauth_config:
9574-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
9574+
encryption = get_encryption_service(settings.auth_encryption_secret)
95759575
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_config["client_secret"])
95769576
except (json.JSONDecodeError, ValueError) as e:
95779577
LOGGER.error(f"Failed to parse OAuth config: {e}")
@@ -9608,7 +9608,7 @@ async def admin_add_a2a_agent(
96089608
oauth_config["client_id"] = oauth_client_id
96099609
if oauth_client_secret:
96109610
# Encrypt the client secret
9611-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
9611+
encryption = get_encryption_service(settings.auth_encryption_secret)
96129612
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_client_secret)
96139613

96149614
# Add username and password for password grant type
@@ -9890,7 +9890,7 @@ async def admin_edit_a2a_agent(
98909890
oauth_config = json.loads(oauth_config_json)
98919891
# Encrypt the client secret if present and not empty
98929892
if oauth_config and "client_secret" in oauth_config and oauth_config["client_secret"]:
9893-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
9893+
encryption = get_encryption_service(settings.auth_encryption_secret)
98949894
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_config["client_secret"])
98959895
except (json.JSONDecodeError, ValueError) as e:
98969896
LOGGER.error(f"Failed to parse OAuth config: {e}")
@@ -9927,7 +9927,7 @@ async def admin_edit_a2a_agent(
99279927
oauth_config["client_id"] = oauth_client_id
99289928
if oauth_client_secret:
99299929
# Encrypt the client secret
9930-
encryption = get_oauth_encryption(settings.auth_encryption_secret)
9930+
encryption = get_encryption_service(settings.auth_encryption_secret)
99319931
oauth_config["client_secret"] = encryption.encrypt_secret(oauth_client_secret)
99329932

99339933
# Add username and password for password grant type

0 commit comments

Comments
 (0)