Changeset 3802562 for aiwend/trunk/src/Secrets/ConnectionRepository.php

Timestamp:

11/14/2026 10:49:34 PM (less than one hour ago)

Author:

erfanteymouri

Message:

Aiwend 0.10.0 (Aiwend – AI Chatbot): English-only public beta, updated listing and seven screenshots, revised banners and Stable Tag 0.10.0

File:

• aiwend/trunk/src/Secrets/ConnectionRepository.php (modified) (9 diffs)

aiwend/trunk/src/Secrets/ConnectionRepository.php

@@ -15 +15 @@
 final class ConnectionRepository
 {
-    public function __construct(
-        private Connection $db,
-        private Vault $vault,
-        private Redactor $redactor,
-        private Clock $clock,
-    ) {
-    }
-
-    public function create(int $siteId, string $provider, string $label, string $secret): int
-    {
+    private Connection $db;
+    private Vault $vault;
+    private Redactor $redactor;
+    private Clock $clock;
+    public function __construct(Connection $db, Vault $vault, Redactor $redactor, Clock $clock)
+    {
+        $this->db = $db;
+        $this->vault = $vault;
+        $this->redactor = $redactor;
+        $this->clock = $clock;
+    }
+    /**
+     * @param mixed $secret a SecretString (production callers) or a string (tests, legacy callers); it is carried as a SecretString from here on
+     */
+    public function create(
+        int $siteId,
+        string $provider,
+        string $label,
+        #[\SensitiveParameter]
+        $secret
+    ): int {
         $this->assertProvider($provider);
-        $secret = trim($secret);
-        if ($secret === '' || strlen($secret) > 4096) {
+        $secret = self::trimmed($secret);
+        $length = $secret->length();
+        if ($length < 1 || $length > 4096) {
             throw new \InvalidArgumentException('Credential must be between 1 and 4096 characters.');
         }
@@ -61 +73 @@
     }
 
-    public function replaceSecret(int $siteId, int $id, string $secret): void
-    {
+    /**
+     * @param mixed $secret a SecretString (production callers) or a string (tests, legacy callers)
+     */
+    public function replaceSecret(
+        int $siteId,
+        int $id,
+        #[\SensitiveParameter]
+        $secret
+    ): void {
         $row = $this->requireRow($siteId, $id);
-        if (\Aiwend\Provider\Providers::looksLikeAnotherProvider((string) $row['provider'], trim($secret))) {
+        $secret = self::trimmed($secret);
+        if (\Aiwend\Provider\Providers::looksLikeAnotherProvider((string) $row['provider'], $secret)) {
             throw new \InvalidArgumentException('key_wrong_provider');
         }
-        $this->storeSecret($siteId, $id, trim($secret));
+        $this->storeSecret($siteId, $id, $secret);
         $this->db->execute('UPDATE {connections} SET status = ? WHERE id = ? AND site_id = ?', ['unverified', $id, $siteId]);
     }
@@ -126 +146 @@
 
     /** Server-side only. The returned value is registered with the redactor. */
-    public function secretForDispatch(int $siteId, int $id): string
+    public function secretForDispatch(int $siteId, int $id): SecretString
     {
         $row = $this->requireRow($siteId, $id);
@@ -132 +152 @@
             throw new \RuntimeException('Connection is disabled.');
         }
-        $secret = $this->vault->decrypt((string) $row['ciphertext'], $this->context($siteId, $id));
+        $secret = new SecretString($this->vault->decrypt((string) $row['ciphertext'], $this->context($siteId, $id)));
         $this->redactor->remember($secret);
         return $secret;
@@ -161 +181 @@
                 }
                 $context = $this->context($siteId, $id);
-                $plain = $this->vault->decrypt($old, $context);
+                $plain = new SecretString($this->vault->decrypt($old, $context));
                 $new = $this->vault->encrypt($plain, $context);
-                if ($this->vault->needsRotation($new) || !hash_equals($plain, $this->vault->decrypt($new, $context))) {
+                if ($this->vault->needsRotation($new) || !hash_equals($plain->reveal(), $this->vault->decrypt($new, $context))) {
                     throw new \RuntimeException('Re-encrypted credential did not verify.');
                 }
@@ -171 +191 @@
                 );
                 $changed === 1 ? $rotated++ : $failed++;
-            } catch (\RuntimeException | \SodiumException) {
+            } catch (\RuntimeException | \SodiumException $exception) {
                 $failed++;
             }
@@ -188 +208 @@
             try {
                 $pending += $this->vault->needsRotation((string) $row['ciphertext']) ? 1 : 0;
-            } catch (\RuntimeException) {
+            } catch (\RuntimeException $exception) {
                 $pending++;
             }
@@ -202 +222 @@
             try {
                 $pending += $this->vault->needsRotation((string) $row['ciphertext']) ? 1 : 0;
-            } catch (\RuntimeException) {
+            } catch (\RuntimeException $exception) {
                 $pending++;
             }
@@ -209 +229 @@
     }
 
-    private function storeSecret(int $siteId, int $id, string $secret): void
-    {
-        if ($secret === '' || strlen($secret) > 4096) {
+    /** Surrounding whitespace is not part of a credential. */
+    private static function trimmed(
+        #[\SensitiveParameter]
+        $secret
+    ): SecretString {
+        $secret = SecretString::from($secret);
+        $plain = $secret->reveal();
+        return $plain === trim($plain) ? $secret : new SecretString(trim($plain));
+    }
+
+    private function storeSecret(int $siteId, int $id, SecretString $secret): void
+    {
+        $length = $secret->length();
+        if ($length < 1 || $length > 4096) {
             throw new \InvalidArgumentException('Credential must be between 1 and 4096 characters.');
         }