ZacharyZcR cfebb690b0 SECURITY FIX: Restore import/export functionality with KEK-DEK architecture ...

Fix critical missing functionality identified in security audit:

## New Features Implemented:
✅ User-level data export (encrypted/plaintext formats)
✅ User-level data import with dry-run validation
✅ Export preview endpoint for size estimation
✅ OIDC configuration encryption for sensitive data
✅ Production environment security checks on startup

## API Endpoints Restored:
- POST /database/export - User data export with password protection
- POST /database/import - User data import with validation
- POST /database/export/preview - Export validation and stats

## Security Improvements:
- OIDC client_secret now encrypted when admin data unlocked
- Production startup checks for required environment variables
- Comprehensive import/export documentation and examples
- Proper error handling and cleanup for uploaded files

## Data Migration Support:
- Cross-instance user data migration
- Selective import (skip credentials/file manager data)
- ID collision handling with automatic regeneration
- Full validation of import data structure

Resolves the critical "503 Service Unavailable" status on import/export
endpoints that was blocking user data migration capabilities.

Maintains KEK-DEK user-level encryption while enabling data portability.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-09-22 00:13:56 +08:00

6.1 KiB

Raw Blame History

View Raw