mirror of
https://github.com/MindWorkAI/AI-Studio.git
synced 2026-11-04 18:47:21 +00:00
Authenticated encryption for enterprise secrets (#1078)
This commit is contained in:
Thorsten Sommer authored and 
GitHub committed
1 parent
031874cebf
commit
274d718314
26 files changed
+740
-89
No files matched your search
@@ -154,12 +154,15 @@ CONFIG["LLM_PROVIDERS"] = {}
|
||||
--
|
||||
-- -- Optional: Encrypted API key for cloud providers or secured on-premise models.
|
||||
-- -- The API key must be encrypted using the enterprise encryption secret.
|
||||
-- -- Format: "ENC:v1:<base64-encoded encrypted data>"
|
||||
-- -- Format: "ENC:v2:<base64-encoded encrypted data>", which AI Studio v26.10.1 or newer reads,
|
||||
-- -- or "ENC:v1:<base64-encoded encrypted data>", which every version of AI Studio reads. Both
|
||||
-- -- formats use the same secret. DataApp.EnterpriseEncryptionExportFormat below decides which
|
||||
-- -- one your exports write.
|
||||
-- -- The encryption secret must be configured via:
|
||||
-- -- Windows Registry: HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT\config_encryption_secret
|
||||
-- -- Environment variable: MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET
|
||||
-- -- You can export an encrypted API key from an existing provider using the export button in the settings.
|
||||
-- -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
|
||||
-- -- ["APIKey"] = "ENC:v2:<base64-encoded encrypted data>",
|
||||
--
|
||||
-- -- Optional: let each user set their own API key for this otherwise locked provider,
|
||||
-- -- instead of (or in addition to not) embedding one centrally. Host, model, instance
|
||||
@@ -193,7 +196,7 @@ CONFIG["TRANSCRIPTION_PROVIDERS"] = {}
|
||||
-- -- ["IconPath"] = "assets/project-icon.svg",
|
||||
--
|
||||
-- -- Optional: Encrypted API key (see LLM_PROVIDERS example for details)
|
||||
-- -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
|
||||
-- -- ["APIKey"] = "ENC:v2:<base64-encoded encrypted data>",
|
||||
--
|
||||
-- -- Optional: let each user set their own API key for this otherwise locked transcription
|
||||
-- -- provider (see LLM_PROVIDERS example for details). Mutually exclusive with "APIKey"
|
||||
@@ -230,7 +233,7 @@ CONFIG["EMBEDDING_PROVIDERS"] = {}
|
||||
-- -- ["IconPath"] = "assets/project-icon.svg",
|
||||
--
|
||||
-- -- Optional: Encrypted API key (see LLM_PROVIDERS example for details)
|
||||
-- -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
|
||||
-- -- ["APIKey"] = "ENC:v2:<base64-encoded encrypted data>",
|
||||
--
|
||||
-- -- Optional: tokenizer path for this provider relative to the plugin directory.
|
||||
-- -- ["TokenizerPath"] = "",
|
||||
@@ -269,7 +272,7 @@ CONFIG["DATA_SOURCES"] = {}
|
||||
-- ["Hostname"] = "<https address of the ERI server>",
|
||||
-- ["Port"] = 443,
|
||||
-- ["AuthMethod"] = "TOKEN",
|
||||
-- ["Token"] = "ENC:v1:<base64-encoded encrypted token>",
|
||||
-- ["Token"] = "ENC:v2:<base64-encoded encrypted token>",
|
||||
-- ["SecurityPolicy"] = "SELF_HOSTED",
|
||||
-- ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
|
||||
-- ["MaxMatches"] = 10,
|
||||
@@ -285,7 +288,7 @@ CONFIG["DATA_SOURCES"] = {}
|
||||
-- ["AuthMethod"] = "USERNAME_PASSWORD",
|
||||
-- ["UsernamePasswordMode"] = "SHARED_USERNAME_AND_PASSWORD",
|
||||
-- ["Username"] = "<shared username>",
|
||||
-- ["Password"] = "ENC:v1:<base64-encoded encrypted password>",
|
||||
-- ["Password"] = "ENC:v2:<base64-encoded encrypted password>",
|
||||
-- ["SecurityPolicy"] = "SELF_HOSTED",
|
||||
-- ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
|
||||
-- ["MaxMatches"] = 10,
|
||||
@@ -300,7 +303,7 @@ CONFIG["DATA_SOURCES"] = {}
|
||||
-- ["Port"] = 443,
|
||||
-- ["AuthMethod"] = "USERNAME_PASSWORD",
|
||||
-- ["UsernamePasswordMode"] = "OS_USERNAME_SHARED_PASSWORD",
|
||||
-- ["Password"] = "ENC:v1:<base64-encoded encrypted password>",
|
||||
-- ["Password"] = "ENC:v2:<base64-encoded encrypted password>",
|
||||
-- ["SecurityPolicy"] = "SELF_HOSTED",
|
||||
-- ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
|
||||
-- ["MaxMatches"] = 10,
|
||||
@@ -482,6 +485,22 @@ CONFIG["SETTINGS"] = {}
|
||||
-- Configure whether administration settings are visible in the UI:
|
||||
-- CONFIG["SETTINGS"]["DataApp.ShowAdminSettings"] = true
|
||||
|
||||
-- Configure the format in which exports encrypt API keys, tokens, and passwords with the
|
||||
-- enterprise encryption secret. Both formats use the same secret.
|
||||
-- Allowed values are: V1, V2
|
||||
-- V2 is protected: AI Studio refuses every value which was encrypted with another secret. It
|
||||
-- needs AI Studio v26.10.1 or newer on every computer which reads it. V1 is read by every
|
||||
-- version of AI Studio, and AI Studio keeps reading it for good. New installations start with
|
||||
-- V2, installations which existed before v26.10.1 keep V1. Keep V1 until every computer in
|
||||
-- your organization runs v26.10.1 or newer, then switch to V2.
|
||||
-- CONFIG["SETTINGS"]["DataApp.EnterpriseEncryptionExportFormat"] = "V1"
|
||||
--
|
||||
-- Allow users to change the export format locally.
|
||||
-- Allowed values are: true, false
|
||||
-- When set to true, the configured format becomes the organization default,
|
||||
-- but users can still choose another format in the enterprise administration settings.
|
||||
-- CONFIG["SETTINGS"]["DataApp.EnterpriseEncryptionExportFormat.AllowUserOverride"] = true
|
||||
|
||||
-- Configure whether AI answers which users copy or export end with a notice that they were
|
||||
-- generated using artificial intelligence (AI). The notice is written in the language of the app.
|
||||
-- It also ends the files of the batch processing. Code blocks, single files or tables taken from
|
||||
@@ -896,10 +915,10 @@ CONFIG["SETTINGS"] = {}
|
||||
-- DefaultToolSettings - pre-fills the setting; a value the user saves afterwards wins.
|
||||
--
|
||||
-- A tool field marked as secret, such as an API key, can be rolled out as well — but only
|
||||
-- encrypted with the enterprise encryption secret, in the same "ENC:v1:<base64>" form the
|
||||
-- providers above use, and only through LockedToolSettings. A locked secret leaves whatever
|
||||
-- the user entered untouched, so their own key returns when you stop deploying yours. A
|
||||
-- plaintext secret is refused with a warning in the log rather than used.
|
||||
-- encrypted with the enterprise encryption secret, in the same "ENC:v2:<base64>" or
|
||||
-- "ENC:v1:<base64>" form the providers above use, and only through LockedToolSettings. A locked
|
||||
-- secret leaves whatever the user entered untouched, so their own key returns when you stop
|
||||
-- deploying yours. A plaintext secret is refused with a warning in the log rather than used.
|
||||
--
|
||||
-- Field names of the Web Search tool. At least one of its search services has to be configured
|
||||
-- before the tool can be used; which one you pick is up to you, since all three can be rolled
|
||||
@@ -979,7 +998,7 @@ CONFIG["SETTINGS"] = {}
|
||||
-- ["web_search.searxng.baseUrl"] = "https://searxng.example.org/",
|
||||
-- ["web_search.defaultLanguage"] = "de-DE",
|
||||
-- ["web_search.backendStrategy"] = "FAILOVER",
|
||||
-- ["web_search.tavily.apiKey"] = "ENC:v1:<base64-encoded encrypted data>",
|
||||
-- ["web_search.tavily.apiKey"] = "ENC:v2:<base64-encoded encrypted data>",
|
||||
-- ["read_web_page.freeAddressChoice"] = "OFF",
|
||||
-- ["read_web_page.allowedPrivateHosts"] = "example.org, *.example.org",
|
||||
-- ["search_confluence.baseUrl"] = "https://wiki.example.org/confluence/"
|
||||
|
||||
+12
@@ -5154,6 +5154,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T436881267"]
|
||||
-- AI Studio cannot install updates into this installation. Contact the person or organization that installed it for new versions.
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T476576809"] = "AI Studio kann in dieser Installation keine Updates installieren. Wenden Sie sich für neue Versionen an die Person oder Organisation, die die Installation vorgenommen hat."
|
||||
|
||||
-- Applies when you export providers, data sources, or tool settings with their API keys, tokens, or passwords. The protected format makes AI Studio refuse every value which was encrypted with another secret, but versions before v26.10.1 cannot read it. Keep the compatible format until every computer in your organization runs v26.10.1 or newer. Both formats use the same encryption secret.
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T602260056"] = "Gilt, wenn Sie Anbieter, Datenquellen oder Werkzeugeinstellungen zusammen mit den zugehörigen API-Schlüsseln, Token oder Passwörtern exportieren. Im geschützten Format lehnt AI Studio alle Werte ab, die mit einem anderen Geheimnis verschlüsselt wurden. Versionen vor v26.10.1 können dieses Format jedoch nicht lesen. Verwenden Sie weiterhin das kompatible Format, bis auf allen Rechnern Ihrer Organisation v26.10.1 oder eine neuere Version installiert ist. Beide Formate verwenden dasselbe Geheimnis für die Verschlüsselung."
|
||||
|
||||
-- Navigation bar behavior
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T602293588"] = "Verhalten der Navigationsleiste"
|
||||
|
||||
@@ -5187,6 +5190,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T922066419"]
|
||||
-- Administration settings are not visible
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T929143445"] = "Die Optionen für die Administration sind nicht sichtbar."
|
||||
|
||||
-- Format for encrypted secrets in exports
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T938676916"] = "Format für verschlüsselte Geheimnisse in Exporten"
|
||||
|
||||
-- Show provider's confidence level?
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELCONFIDENCE::T1052533048"] = "Vertrauensniveau des Anbieters anzeigen?"
|
||||
|
||||
@@ -11553,6 +11559,9 @@ UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3137986690
|
||||
-- Delete disappearing chats older than 180 days
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3491430707"] = "Selbstlöschende Chats: lösche Chats die älter als 180 Tage sind"
|
||||
|
||||
-- Compatible with all versions of AI Studio
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3559426588"] = "Kompatibel mit allen Versionen von AI Studio"
|
||||
|
||||
-- Install updates automatically
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3569059463"] = "Updates automatisch installieren"
|
||||
|
||||
@@ -11565,6 +11574,9 @@ UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3612390107
|
||||
-- Toggle the sidebar: show the workspaces next to the chat when desired
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3711207137"] = "Seitenleiste umschalten: Arbeitsbereiche bei Bedarf neben dem Chat anzeigen"
|
||||
|
||||
-- Protected against wrong encryption secrets, needs AI Studio v26.10.1 or newer
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3831574746"] = "Geschützt vor falschen Geheimnissen für die Verschlüsselung, erfordert AI Studio v26.10.1 oder neuer"
|
||||
|
||||
-- Updates disabled by your organization
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T4048970098"] = "Updates wurden von Ihrer Organisation deaktiviert"
|
||||
|
||||
|
||||
+12
@@ -5154,6 +5154,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T436881267"]
|
||||
-- AI Studio cannot install updates into this installation. Contact the person or organization that installed it for new versions.
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T476576809"] = "AI Studio cannot install updates into this installation. Contact the person or organization that installed it for new versions."
|
||||
|
||||
-- Applies when you export providers, data sources, or tool settings with their API keys, tokens, or passwords. The protected format makes AI Studio refuse every value which was encrypted with another secret, but versions before v26.10.1 cannot read it. Keep the compatible format until every computer in your organization runs v26.10.1 or newer. Both formats use the same encryption secret.
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T602260056"] = "Applies when you export providers, data sources, or tool settings with their API keys, tokens, or passwords. The protected format makes AI Studio refuse every value which was encrypted with another secret, but versions before v26.10.1 cannot read it. Keep the compatible format until every computer in your organization runs v26.10.1 or newer. Both formats use the same encryption secret."
|
||||
|
||||
-- Navigation bar behavior
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T602293588"] = "Navigation bar behavior"
|
||||
|
||||
@@ -5187,6 +5190,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T922066419"]
|
||||
-- Administration settings are not visible
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T929143445"] = "Administration settings are not visible"
|
||||
|
||||
-- Format for encrypted secrets in exports
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T938676916"] = "Format for encrypted secrets in exports"
|
||||
|
||||
-- Show provider's confidence level?
|
||||
UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELCONFIDENCE::T1052533048"] = "Show provider's confidence level?"
|
||||
|
||||
@@ -11553,6 +11559,9 @@ UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3137986690
|
||||
-- Delete disappearing chats older than 180 days
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3491430707"] = "Disappearing chats: delete chats older than 180 days"
|
||||
|
||||
-- Compatible with all versions of AI Studio
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3559426588"] = "Compatible with all versions of AI Studio"
|
||||
|
||||
-- Install updates automatically
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3569059463"] = "Install updates automatically"
|
||||
|
||||
@@ -11565,6 +11574,9 @@ UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3612390107
|
||||
-- Toggle the sidebar: show the workspaces next to the chat when desired
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3711207137"] = "Toggle the sidebar: show the workspaces on demand next to the chat"
|
||||
|
||||
-- Protected against wrong encryption secrets, needs AI Studio v26.10.1 or newer
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T3831574746"] = "Protected against wrong encryption secrets, needs AI Studio v26.10.1 or newer"
|
||||
|
||||
-- Updates disabled by your organization
|
||||
UI_TEXT_CONTENT["AISTUDIO::SETTINGS::CONFIGURATIONSELECTDATAFACTORY::T4048970098"] = "Updates disabled by your organization"
|
||||
|
||||
|
||||
Reference in new issue
Block a user