NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-08-30 22:10:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(docs): clarify API key visibility rules and encryption details

Browse Source 
Update the LLM model configs API documentation to provide clearer explanations of API key visibility controls and encryption behavior. The changes include:

- Enhanced visibility table with more specific scenarios and encryption states
- Added detailed rules explaining when API keys are visible as plaintext, hidden (null), or shown encrypted
- Clarified super admin capabilities and database-level access
- Updated JSON examples to reflect actual encrypted values and null placeholders
- Added important notes about Fernet encryption, on-the-fly decryption, and group config behavior

These updates provide better transparency about security measures and help users understand what to expect when viewing different types of configurations.
This commit is contained in:
YueGuobin 2026-03-06 10:05:17 +08:00
parent 4941dc13d8
commit 903e48aecc
1 changed files with 32 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
docs/gns3-copilot/llm-model-configs-api.md
View File

@ -650,14 +650,23 @@ The API implements strict API key visibility controls to protect sensitive crede
| Scenario | User Configs | Group Configs |
|----------|-------------|---------------|
| User viewing own configs | **Visible** | **Hidden** |
| Admin viewing other users' configs | **Hidden** | **Hidden** |
| Viewing group configs directly | N/A | **Visible** |
| User viewing own configs | **Visible (Plaintext)** | N/A |
| User viewing inherited group configs | N/A | **Hidden (null)** |
| Admin viewing other users' configs | **Hidden (null)** | N/A |
| Viewing group configs directly (with `Group.Audit`) | N/A | **Visible (Encrypted)** |
**Rules:**
1. **Users viewing their own configs**: Can see API keys in their own configurations, but NOT in inherited group configurations
2. **Admins viewing other users' configs**: Cannot see API keys in any user configurations (user privacy)
3. **Viewing group configs**: Users with `Group.Audit` privilege can see API keys in group configurations
1. **Users viewing their own configs**: Can see **decrypted (plaintext)** API keys in their own configurations
2. **Users viewing inherited group configs**: API keys are **hidden** (set to `null`) in the inherited configs
3. **Admins viewing other users' configs**: Cannot see API keys in any user configurations (set to `null`) - user privacy protection
4. **Viewing group configs directly**: Users with `Group.Audit` privilege can see **encrypted** API keys in group configurations (not decrypted)
5. **Super admins**: While application-layer restrictions apply, super admins can access the database directly and decrypt any API key using the encryption key. This is by design as super admins have system-level access.
**Important Notes:**
- API keys are stored in the database in **encrypted** format using Fernet symmetric encryption
- User configs are **decrypted on-the-fly** when retrieved by the owner
- Group configs return the **encrypted value** as stored in the database (no automatic decryption)
- Super admins have database access and can retrieve & decrypt any API key - this is intentional and reflects their system-level privileges
**Example:**
```json
@ -669,7 +678,7 @@ The API implements strict API key visibility controls to protect sensitive crede
"name": "GPT-4",
"source": "user",
"config": {
"api_key": "sk-xxx" // Visible (own config)
"api_key": "sk-ant-xxxxx" // Decrypted (own config)
}
},
{
@ -677,7 +686,7 @@ The API implements strict API key visibility controls to protect sensitive crede
"name": "Claude-3",
"source": "group",
"config": {
"api_key": null // Hidden (inherited from group)
"api_key": null // Hidden (inherited from group)
}
}
]
@ -691,7 +700,21 @@ The API implements strict API key visibility controls to protect sensitive crede
"name": "GPT-4",
"source": "user",
"config": {
"api_key": null // Hidden (another user's config)
"api_key": null // Hidden (another user's config)
}
}
]
}
// User with Group.Audit viewing group configs directly
{
"configs": [
{
"config_id": "uuid-3",
"name": "Gemini Pro",
"source": "group",
"config": {
"api_key": "gAAAAABl1a2b3c4d5e6f7..." // Encrypted (as stored in DB)
}
}
]