* fix: make TOKEN_HASH_SECRET required and add check on server start
* fix: make EXPRESS_SESSION_SECRET required and add check on server start
* fix: make jwt variables required and validate on server start
* fix: formatting
* fix: cypress tests
* fix: remove env file for cypress and refactor
* revert: changes to workflow and env examples
* update: how missing/weak default secrets are handled
* update: how auth secrets are setup and read
* fix: update env examples for docker
* fix: weak defaults list
* fix: weak defaults list
---------
Co-authored-by: yau-wd <[email protected]>
Co-authored-by: yau-wd <[email protected]>
* feat(database.util.ts): add function to check if column exists in table
* feat(migrations): add permission column to apikey table
* chore(services/apikey): remove auto-create default API key
* chore: remove auto-create default API key
* fix(migrations): rename permission to permissions in apikey table
* feat(services/apikey): add permissions to create and update
* feat(views/apikey): add permissions to create and update
* feat(api): use API key permissions instead of role permissions
* feat(permissions): filter by user.permissions except for ROLE type
* feat(services/apikey): filter keys by user permissions in getAllApiKeys
* feat(services/apikey): limit API key permissions to user permissions during creation/update
* fix(database.util.ts): replace non-null assertion with explicit error handling
* feat(services/apikey): log errors for malformed API key permissions
* refactor(services/apikey): extract permission validation
* feat(permission): enhance permission filtering based on user features and platform type
* chore(migrations): lower API key permission value
* Update packages/ui/src/views/apikey/APIKeyDialog.jsx
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update packages/ui/src/views/apikey/APIKeyDialog.jsx
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* refactor: remove deprecated APIKEY_PATH and APIKEY migration
* refactor(apikey): remove functionality related to import apikey
* feat(permission): filter out workspace and admin categories for non-ROLE
* feat(services/apikey): validate API key permissions during create and update
* chore(migrations): clean up role permissions values
* fix(migrations): handle corrupted permissions gracefully
* fix(server/src/index.ts): add error handling for API key permissions parsing
* fix(APIKeyDialog.jsx): handle corrupted permissions when editing API key
* fix(views/apikey/index.jsx): handle corrupted permissions in API key list
* fix(services/apikey): validate permissions JSON in API key operations
* Potential fix for code scanning alert no. 83: Clear-text logging of sensitive information
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* feat(migrations): change ApiKey.permissions column from TEXT to JSON
* Update packages/server/src/services/apikey/index.ts
Co-authored-by: Jocelyn Lin <[email protected]>
* feat(PricingDialog.jsx): handle downgrade with excessive apikey permissions
* feat(controllers\apikey): enforce permissions validation
* chore(services/apikey): remove redundant null checks
* fix(services/dataset): throw error when dataset not found before fetching rows
---------
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Jocelyn Lin <[email protected]>
* Sanitize sensitive fields in request header and body in logger
* fix: log request headers, body, and query only when debug logs are enabled
* fix: add missing env to examples
* fix: crash due to missing env vars
feat: enhance security validation for MCP configurations
- Added environment variable checks for CUSTOM_MCP_SECURITY_CHECK, CUSTOM_MCP_PROTOCOL, and HTTP_DENY_LIST across various Docker and application files.
- Implemented validation functions in MCP core to prevent command injection and ensure safe environment variable usage
* support google cloud storage
* update example and docs for supporting google cloud storage
* recover the indent of pnpm-lock-yaml
* populate the logs to google logging
* normalize gcs storage paths
---------
Co-authored-by: Ilango <[email protected]>
Co-authored-by: Henry <[email protected]>
* adding support for prometheus and grafana
* open telemetry
* lint fixes
* missing counter and telemetry standardization
---------
Co-authored-by: Henry <[email protected]>
* * Added global-agent as central Global HTTP/HTTPS proxy configurable using environment variable
** https://www.npmjs.com/package/global-agent
* Server-Bootstrap on index.js
** import 'global-agent/bootstrap'
* added dep in package.json
** global-agent: "^3.0.0
* * Added global-agent as central Global HTTP/HTTPS proxy configurable using environment variable
** Added env variables
* update env example
* update env and lock file
* update env and lock file
---------
Co-authored-by: Henry <[email protected]>
* Feature: Option to add apikeys to the DB instead of api.json.
* add api storage type env variable
* code cleanup and simplification.
* md table fixes
---------
Co-authored-by: Henry <[email protected]>
* fix: Change the CMD flowise command to be the same as in the documentation.
* Remove unnecessary npx command from dockerfile
* Command was changed by the entrypoint in Docker Composer
---------
Co-authored-by: Erasmo De Souza Pinheiro <[email protected]>
DATABASE_SSL_KEY_BASE64 takes priority over DATABASE_SSL env var
If neither are provided, no ssl value will be used.
This allows for the usage of PGSSLMODE
