Repository navigation
feat(security): encrypt the files Lens keeps at rest - #89
Merged
Merged
Conversation
Uploads, email attachments, captured web pages, IIIF imports and supplementary files are stored encrypted with their namespace's key when encryption.files is on. Players still seek (only the chunks a range touches are decrypted), downloads decrypt as they stream, and tools get a plain working copy that is swept once unused. New archives start with it on; lens encrypt converts an archive that already has files. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ
…rypted downloads with ranges Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ
… copies being taken Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ
…-a0ft5t # Conflicts: # CHANGELOG.md # fastapi_backend/app/domain/settings.py
…nd never hand out a swept one Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ
…-a0ft5t # Conflicts: # CHANGELOG.md # fastapi_backend/app/domain/settings.py
6 of 8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: uploads, email attachments, captured web pages and IIIF imports sat on disk as plain files.
After: with
encryption.fileson, each of those files is stored encrypted with its namespace's key from #77. Players still stream and seek, and downloads arrive exactly as uploaded. New archives turn this on at their first start. An archive that already has files keeps its setting untillens encrypt(orlens encrypt --off) converts it. Files in scanned folders are never rewritten. The Fedora copy (#88) still receives each file as it was, not Lens's encrypted form.How:
keyring.protect()runs at each place a file is stored: uploads, supplementary files, attachment resources, web captures and IIIF imports. It runs after the fingerprint and probe, so fingerprints and sizes stay those of the plain file and duplicates are still recognised.streaming.file_responseand the newstored_filedecrypt only the chunks a byte range touches. A locked vault answers 423 and a damaged file says so.data_dir/tmp/work, keeping its own name, throughingest.audio_path. A job, or one recording of a CLI batch, holds a shared flock on each copy until it ends. Sweeps remove only copies they can lock exclusively, once those copies have gone unused forencryption.work_minutes.setup.mark_freshturns encryption on only for an empty archive.Planned next, as noted in docs/encryption.md: derived files (frames, renditions, reports, exports), the storage-source cache, re-keying on namespace moves, a web toggle that also converts existing files, and passkey vaults for the namespaces you choose.
Motivation and Context
This is the second step of encryption at rest, which Adeel asked for.
Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly.## UnreleasedinCHANGELOG.md.Because every test app starts as a fresh archive, the whole suite now runs with encryption on. Full local backend suite after merging main: 449 passed, 5 skipped. The one failure is the known LibreOffice environment failure (
test_office_and_text_files_become_documents). Ruff and mypy are clean on the app. Four self-review rounds ran, and their findings are fixed in the later commits.🤖 Generated with Claude Code
https://claude.ai/code/session_01R1moYBoaoY4cZFbhBWqzEJ