From fc700f2d8288391cced8fa46d0c70e8a26adf33f Mon Sep 17 00:00:00 2001 From: "Troll (Hermes Agent)" Date: Mon, 3 Aug 2026 22:47:57 +0000 Subject: [PATCH] fix: tolerate plaintext Hermes API key in booth_settings.json The regenerate button stores encrypted keys, but legacy/manual writes may save plaintext. get_hermes_api_key now falls back to returning the raw value if Fernet decryption fails. --- app.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/app.py b/app.py index 4fb4d42..711a95b 100644 --- a/app.py +++ b/app.py @@ -211,6 +211,20 @@ def decrypt_value(ciphertext): return '' +def decrypt_value_legacy(ciphertext): + """Decrypt or return plaintext. Tolerates unencrypted legacy values.""" + if not ciphertext: + return '' + plaintext = decrypt_value(ciphertext) + if plaintext: + return plaintext + # If decryption failed, the value might already be plaintext. + # A Fernet token is base64 and ends with '='; a plain API key does not. + if not ciphertext.endswith('='): + return ciphertext + return '' + + def settings_file_path(): """Return the path to the persistent runtime settings JSON file.""" return Path(current_app.config['DATABASE']).parent / current_app.config['SETTINGS_FILE'] @@ -275,7 +289,7 @@ def get_hermes_api_key(): regenerated from /admin/settings without redeploying. """ cfg = load_booth_settings() - return decrypt_value(cfg.get('hermes_api_key', '')) or current_app.config.get('HERMES_API_KEY', '') + return decrypt_value_legacy(cfg.get('hermes_api_key', '')) or current_app.config.get('HERMES_API_KEY', '') def set_hermes_api_key(key):