Skip to content

docs(changelog): record PR #267 (JWT secret hardening + DB user store) #268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fig-ai-agent merged 1 commit into from
Sep 14, 2026
Merged

docs(changelog): record PR #267 (JWT secret hardening + DB user store) #268

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,18 @@ Open problems and known blockers are tracked separately in

## [2026-09-14]

### Changed
- **PR #267** — hardened JWT secret validation and moved users onto a database.
`app/security.py` now rejects a signing key shorter than 32 characters and
refuses a set of known placeholder values (`changeme`, `secret`, `jwt-secret`,
…), so a misconfigured deployment fails loudly instead of signing tokens with
a guessable key; the local fallback generates a full-strength key written to a
git-ignored file. Added `app/user_store.py`, a SQLAlchemy-backed user table that
imports legacy JSON users on first init, keeping the existing
`{username, hashed_password, allowed_skills}` shape so the API surface and
per-user skill gating are unchanged. `DATABASE_URL` selects Postgres, otherwise
SQLite. Verified: 43 tests pass in a clean venv.

### Fixed
- **PR #262** — chore(lint): dropped the unused `import sys` from
`knowledge/scripts/diff_policy.py`, the only unreferenced import left in the file.
Expand Down
Loading