From 0f61a065573dacfb6abdc1d552e639d90a1ffaaa Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Fri, 6 Mar 2026 11:06:18 +0800 Subject: [PATCH] feat(docs): clarify API key visibility for group configurations Add detailed section explaining that plaintext API keys for group configurations are never exposed through the application API, even to super admins. This clarifies the security design where group configs are intended for inheritance only, not manual viewing, while maintaining internal decryption for inheritance functionality. --- docs/gns3-copilot/llm-model-configs-api.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/gns3-copilot/llm-model-configs-api.md b/docs/gns3-copilot/llm-model-configs-api.md index bad1d76bb..7449e00f3 100644 --- a/docs/gns3-copilot/llm-model-configs-api.md +++ b/docs/gns3-copilot/llm-model-configs-api.md @@ -668,6 +668,21 @@ The API implements strict API key visibility controls to protect sensitive crede - Group configs return the **encrypted value** as stored in the database (no automatic decryption) - Super admins have database access and can retrieve & decrypt any API key - this is intentional and reflects their system-level privileges +**⚠️ Key Point: No Plaintext Group API Keys via API** +> **Nobody (including super admins) can see plaintext API keys for group configurations through the application API.** +> +> - Group configs always return the **encrypted** API key value (e.g., `gAAAAABl1a2b3c4d5e6f7...`) +> - There is **no API endpoint** that decrypts and returns group config API keys as plaintext +> - Even super admins with `Group.Audit` privilege receive encrypted values via the API +> - This is an application-layer restriction that applies to all users +> +> **Design Rationale**: Group configs are intended to be **inherited** automatically, not viewed/copied manually. The encrypted values protect API keys while still allowing the inheritance mechanism to function (the system decrypts them internally when needed). +> +> **Access Paths**: +> - ✅ **Inheritance**: Users inherit group configs → Agent uses them with internal decryption +> - ✅ **Database Direct Access**: Super admins can query DB and decrypt using the encryption key +> - ❌ **API Viewing**: No endpoint returns plaintext group config API keys + **Example:** ```json // User viewing their own configs