fix: secure token persistence

[jroth1111]

Supersedes #664 (closed). This rebase restores management API behavior while keeping secure auth persistence.\n\nKey fixes:\n- Management auth endpoints now read/decrypt secure auth JSON so fields like proxy_url/prefix are preserved.\n- Auth file uploads are re-written via securefile to enforce encryption when enabled.\n- Log files created with 0600 permissions.\n\nPlease review this PR instead of #664.

[gemini-code-assist]

Summary of Changes

Hello @jroth1111, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security and robustness of authentication token persistence and logging within the system. It addresses a previous issue where Management API behavior was compromised by secure auth persistence, restoring full functionality while maintaining enhanced security. The core of these changes involves the introduction of a dedicated "securefile" package for handling encrypted authentication files, ensuring data at rest is protected. Furthermore, logging practices are hardened by masking sensitive information in request logs and applying stricter file permissions to critical directories, reducing the risk of credential exposure.

Highlights

• Enhanced Secure Auth Persistence: Management API endpoints now correctly read and decrypt secure authentication JSON, ensuring fields like "proxy_url" and "prefix" are preserved.
• Auth File Encryption Enforcement: All authentication file uploads are now processed through the new "securefile" package, enforcing encryption when enabled.
• Stricter File Permissions: Log files and directories are created with more restrictive "0600" and "0700" permissions, respectively, to enhance security.
• Sensitive Data Masking in Logs: Request bodies in logs are now automatically scanned and sensitive JSON fields are masked to prevent accidental exposure of credentials.
• Git Repository Warnings: The application now warns users if the configured "auth-dir" resides within a Git repository, advising against committing token files or suggesting private repositories for git-backed storage.
• New "securefile" Package: A new "internal/securefile" package has been introduced, providing robust utilities for atomic file operations, advisory locking, and AES-256-GCM encryption/decryption of authentication JSON data.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request significantly enhances the security of token persistence. Key improvements include the introduction of encryption-at-rest for authentication files using AES-GCM, atomic and concurrent-safe file writing via a new securefile package, and more restrictive file permissions for logs. Additionally, sensitive data is now masked in request logs to prevent accidental exposure of credentials. These are excellent security hardening measures. The implementation is robust, covering different token stores and providing platform-specific file locking.

[jroth1111]

Context: this PR supersedes the earlier #664 (closed after feedback). See that thread for history; this one includes the fixes called out there.

[luispater]

You should add a configurable toggle in the configuration file to enable or disable this feature.

Additionally, when the toggle is modified, an encryption or decryption operation must be performed on all items.

And a clear notification should be provided if neither CLIPROXY_AUTH_ENCRYPTION_KEY nor CLI_PROXY_API_AUTH_ENCRYPTION_KEY is configured by the user.

[jroth1111]

No additional changes pending; PR is ready for review when you have time. @luispater

[luispater]

You should add a configurable toggle in the configuration file to enable or disable this feature.

Additionally, when the toggle is modified, an encryption or decryption operation must be performed on all items.

And a clear notification should be provided if neither CLIPROXY_AUTH_ENCRYPTION_KEY nor CLI_PROXY_API_AUTH_ENCRYPTION_KEY is configured by the user.

[jroth1111]

Implemented auth-encryption toggle + migration: added auth-encryption.enabled (plus allow-plaintext-fallback) in config + config.example.yaml, apply settings at startup/reload, and run a full auth-dir migration when the toggle flips. Added clear warning when no CLIPROXY_AUTH_ENCRYPTION_KEY / CLI_PROXY_API_AUTH_ENCRYPTION_KEY is configured. Startup migrations persist to remote stores when available. Tests: go test ./.... @luispater

[jroth1111]

Follow-up ping: auth-encryption toggle + full migration on toggle + missing-key warning are in. Tests: ? github.com/router-for-me/CLIProxyAPI/v6/cmd/server [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/examples/custom-provider [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/examples/translator [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/access [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/access/config_access [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/api 0.960s
? github.com/router-for-me/CLIProxyAPI/v6/internal/api/handlers/management [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/api/middleware [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/api/modules [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/api/modules/amp 1.758s
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/codex [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/empty [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/iflow [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/qwen [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/auth/vertex [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/browser [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/buildinfo [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/cache (cached)
? github.com/router-for-me/CLIProxyAPI/v6/internal/cmd [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/config [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/constant [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/interfaces [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/logging (cached)
? github.com/router-for-me/CLIProxyAPI/v6/internal/managementasset [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/misc [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/registry [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/runtime/executor [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/runtime/geminicli [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/store [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/translator/antigravity/claude 2.207s
ok github.com/router-for-me/CLIProxyAPI/v6/internal/translator/antigravity/gemini 3.139s
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/antigravity/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/antigravity/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/claude/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/claude/gemini-cli [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/claude/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/claude/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/codex/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/codex/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/codex/gemini-cli [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/codex/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/codex/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/common [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/gemini-cli [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini-cli/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini-cli/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini-cli/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/gemini-cli/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/openai/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/openai/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/openai/gemini-cli [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/openai/openai/chat-completions [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/openai/openai/responses [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/translator/translator [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/internal/usage [no test files]
FAIL github.com/router-for-me/CLIProxyAPI/v6/internal/util [build failed]
ok github.com/router-for-me/CLIProxyAPI/v6/internal/watcher 5.084s
ok github.com/router-for-me/CLIProxyAPI/v6/internal/watcher/diff 4.701s
ok github.com/router-for-me/CLIProxyAPI/v6/internal/watcher/synthesizer 5.505s
? github.com/router-for-me/CLIProxyAPI/v6/internal/wsrelay [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/access [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/api [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/api/handlers [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/api/handlers/claude [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/api/handlers/gemini [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/api/handlers/openai [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/auth [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth 6.086s
? github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/executor [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/pipeline [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/usage [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/config [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/logging [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/translator [no test files]
? github.com/router-for-me/CLIProxyAPI/v6/sdk/translator/builtin [no test files]
ok github.com/router-for-me/CLIProxyAPI/v6/test 6.759s
FAIL. Ready for re-review. @luispater

[jroth1111]

@luispater auth-encryption toggle + migration + missing-key warning are in (per your request). CI green. Ready for re-review.

[jroth1111]

Addressed the requested auth-encryption toggle and migration flow: enabled config section in config.example.yaml, resolved secret once with clearer warnings (including when disabled but encrypted files exist), and skip migration when no key is configured. Branch is synced with main. Please re-review.

[jroth1111]

@luispater auth-encryption toggle + migration-on-toggle + missing-key warning are in; branch synced with main. Ready for re-review.