mirror of
https://github.com/lingble/chatwoot.git
synced 2025-12-25 23:27:15 +00:00
38f16ba677
## Changelog
- Added conditional Active Record encryption to every external
credential we store (SMTP/IMAP passwords, Twilio tokens,
Slack/OpenAI hook tokens, Facebook/Instagram tokens, LINE/Telegram keys,
Twitter secrets) so new writes are encrypted
whenever Chatwoot.encryption_configured? is true; legacy installs still
receive plaintext until their secrets are
updated.
- Tuned encryption settings in config/application.rb to allow legacy
reads (support_unencrypted_data) and to extend
deterministic queries so lookups continue to match plaintext rows during
the rollout; added TODOs to retire the
fallback once encryption becomes mandatory.
- Introduced an MFA-pipeline test suite
(spec/models/external_credentials_encryption_spec.rb) plus shared
examples to
verify each attribute encrypts at rest and that plaintext records
re-encrypt on update, with a dedicated Telegram case.
The existing MFA GitHub workflow now runs these tests using the
preconfigured encryption keys.
fixes:
https://linear.app/chatwoot/issue/CW-5453/encrypt-sensitive-credentials-stored-in-plain-text-in-database
## Testing Instructions
1. Instance without encryption keys
- Unset ACTIVE_RECORD_ENCRYPTION_* vars (or run in an environment where
they’re absent).
- Create at least one credentialed channel (e.g., Email SMTP).
- Confirm workflows still function (send/receive mail or a similar
sanity check).
- In the DB you should still see plaintext values—this confirms the
guard prevents encryption when keys are missing.
2. Instance with encryption keys
- Configure the three encryption env vars and restart.
- Pick a couple of representative integrations (e.g., Email SMTP +
Twilio SMS).
- Legacy channel check:
- Use existing records created before enabling keys. Trigger their
workflow (send an email / SMS, or hit the
webhook) to ensure they still authenticate.
- Inspect the raw column—value remains plaintext until changed.
- Update legacy channel:
- Edit one legacy channel’s credential (e.g., change SMTP password).
- Verify the operation still works and the stored value is now encrypted
(raw column differs, accessor returns
original).
- New channel creation:
- Create a new channel of the same type; confirm functionality and that
the stored credential is encrypted from
the start.
---------
Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
81 lines
2.8 KiB
Ruby
81 lines
2.8 KiB
Ruby
# == Schema Information
|
|
#
|
|
# Table name: channel_email
|
|
#
|
|
# id :bigint not null, primary key
|
|
# email :string not null
|
|
# forward_to_email :string not null
|
|
# imap_address :string default("")
|
|
# imap_enable_ssl :boolean default(TRUE)
|
|
# imap_enabled :boolean default(FALSE)
|
|
# imap_login :string default("")
|
|
# imap_password :string default("")
|
|
# imap_port :integer default(0)
|
|
# provider :string
|
|
# provider_config :jsonb
|
|
# smtp_address :string default("")
|
|
# smtp_authentication :string default("login")
|
|
# smtp_domain :string default("")
|
|
# smtp_enable_ssl_tls :boolean default(FALSE)
|
|
# smtp_enable_starttls_auto :boolean default(TRUE)
|
|
# smtp_enabled :boolean default(FALSE)
|
|
# smtp_login :string default("")
|
|
# smtp_openssl_verify_mode :string default("none")
|
|
# smtp_password :string default("")
|
|
# smtp_port :integer default(0)
|
|
# verified_for_sending :boolean default(FALSE), not null
|
|
# created_at :datetime not null
|
|
# updated_at :datetime not null
|
|
# account_id :integer not null
|
|
#
|
|
# Indexes
|
|
#
|
|
# index_channel_email_on_email (email) UNIQUE
|
|
# index_channel_email_on_forward_to_email (forward_to_email) UNIQUE
|
|
#
|
|
|
|
class Channel::Email < ApplicationRecord
|
|
include Channelable
|
|
include Reauthorizable
|
|
|
|
AUTHORIZATION_ERROR_THRESHOLD = 10
|
|
|
|
# TODO: Remove guard once encryption keys become mandatory (target 3-4 releases out).
|
|
if Chatwoot.encryption_configured?
|
|
encrypts :imap_password
|
|
encrypts :smtp_password
|
|
end
|
|
|
|
self.table_name = 'channel_email'
|
|
EDITABLE_ATTRS = [:email, :imap_enabled, :imap_login, :imap_password, :imap_address, :imap_port, :imap_enable_ssl,
|
|
:smtp_enabled, :smtp_login, :smtp_password, :smtp_address, :smtp_port, :smtp_domain, :smtp_enable_starttls_auto,
|
|
:smtp_enable_ssl_tls, :smtp_openssl_verify_mode, :smtp_authentication, :provider, :verified_for_sending].freeze
|
|
|
|
validates :email, uniqueness: true
|
|
validates :forward_to_email, uniqueness: true
|
|
|
|
before_validation :ensure_forward_to_email, on: :create
|
|
|
|
def name
|
|
'Email'
|
|
end
|
|
|
|
def microsoft?
|
|
provider == 'microsoft'
|
|
end
|
|
|
|
def google?
|
|
provider == 'google'
|
|
end
|
|
|
|
def legacy_google?
|
|
imap_enabled && imap_address == 'imap.gmail.com'
|
|
end
|
|
|
|
private
|
|
|
|
def ensure_forward_to_email
|
|
self.forward_to_email ||= "#{SecureRandom.hex}@#{account.inbound_email_domain}"
|
|
end
|
|
end
|