rick/rosterchirp-dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.9.2 switched to correct version of encrypted database

Browse Source
This commit is contained in:
Ricky Stretch
2026-03-13 15:30:57 -04:00
parent e02cf69745
commit 5301d8a525
7 changed files with 23 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.env.example
View File

@@ -7,7 +7,7 @@ TZ=UTC
# Copy this file to .env and customize # Copy this file to .env and customize
# Image version to run (set by build.sh, or use 'latest') # Image version to run (set by build.sh, or use 'latest')
JAMA_VERSION=0.9.1 JAMA_VERSION=0.9.2
# Default admin credentials (used on FIRST RUN only) # Default admin credentials (used on FIRST RUN only)
ADMIN_NAME=Admin User ADMIN_NAME=Admin User

2
Dockerfile
View File

@@ -26,7 +26,7 @@ LABEL org.opencontainers.image.title="jama" \
ENV JAMA_VERSION=${VERSION} ENV JAMA_VERSION=${VERSION}
RUN apk add --no-cache sqlite sqlcipher python3 make g++ openssl-dev RUN apk add --no-cache sqlite python3 make g++ openssl-dev
WORKDIR /app WORKDIR /app

4
backend/package.json
View File

@@ -1,6 +1,6 @@
{ {
"name": "jama-backend", "name": "jama-backend",
"version": "0.9.1", "version": "0.9.2",
"description": "TeamChat backend server", "description": "TeamChat backend server",
"main": "src/index.js", "main": "src/index.js",
"scripts": { "scripts": {
@@ -19,7 +19,7 @@
"sharp": "^0.33.2", "sharp": "^0.33.2",
"socket.io": "^4.6.1", "socket.io": "^4.6.1",
"web-push": "^3.6.7", "web-push": "^3.6.7",
"better-sqlite3-sqlcipher": "^9.4.3" "better-sqlite3-multiple-ciphers": "^12.6.2"
}, },
"devDependencies": { "devDependencies": {
"nodemon": "^3.0.2" "nodemon": "^3.0.2"

18
backend/scripts/encrypt-db.js
View File

@@ -74,7 +74,7 @@ if (header.toString('ascii') !== MAGIC) {
let Database; let Database;
try { try {
Database = require('better-sqlite3-sqlcipher'); Database = require('better-sqlite3-multiple-ciphers');
} catch (e) { } catch (e) {
console.error('ERROR: better-sqlite3-sqlcipher is not installed.'); console.error('ERROR: better-sqlite3-sqlcipher is not installed.');
console.error('Run: npm install better-sqlite3-sqlcipher'); console.error('Run: npm install better-sqlite3-sqlcipher');
@@ -95,20 +95,20 @@ try {
console.log('Step 1/4 Opening plain database...'); console.log('Step 1/4 Opening plain database...');
const plain = new Database(DB_PATH); const plain = new Database(DB_PATH);
// Create the encrypted copy using SQLCipher ATTACH + sqlcipher_export // Create encrypted copy using sqlcipher_export via ATTACH
console.log('Step 2/4 Encrypting to temporary file...'); console.log('Step 2/4 Encrypting to temporary file...');
const safeKey = DB_KEY.replace(/'/g, "''"); const safeKey = DB_KEY.replace(/'/g, "''");
plain.exec(` plain.exec(`ATTACH DATABASE '${encPath}' AS encrypted KEY '${safeKey}'`);
ATTACH DATABASE '${encPath}' AS encrypted KEY '${safeKey}'; plain.exec(`SELECT sqlcipher_export('encrypted')`);
SELECT sqlcipher_export('encrypted'); plain.exec(`DETACH DATABASE encrypted`);
DETACH DATABASE encrypted;
`);
plain.close(); plain.close();
// Verify the encrypted file opens correctly // Verify the encrypted file opens correctly with cipher settings
console.log('Step 3/4 Verifying encrypted database...'); console.log('Step 3/4 Verifying encrypted database...');
const enc = new Database(encPath); const enc = new Database(encPath);
enc.pragma(`key = '${safeKey}'`); enc.pragma(`cipher='sqlcipher'`);
enc.pragma(`legacy=4`);
enc.pragma(`key='${safeKey}'`);
const count = enc.prepare("SELECT COUNT(*) as n FROM sqlite_master").get(); const count = enc.prepare("SELECT COUNT(*) as n FROM sqlite_master").get();
enc.close(); enc.close();
console.log(` OK — ${count.n} objects found in encrypted DB`); console.log(` OK — ${count.n} objects found in encrypted DB`);

12
backend/src/models/db.js
View File

@@ -1,4 +1,4 @@
const Database = require('better-sqlite3-sqlcipher'); const Database = require('better-sqlite3-multiple-ciphers');
const path = require('path'); const path = require('path');
const fs = require('fs'); const fs = require('fs');
const bcrypt = require('bcryptjs'); const bcrypt = require('bcryptjs');
@@ -18,9 +18,13 @@ function getDb() {
} }
db = new Database(DB_PATH); db = new Database(DB_PATH);
if (DB_KEY) { if (DB_KEY) {
// Apply encryption key — must be the very first pragma before any other DB access // Use SQLCipher4 AES-256-CBC — compatible with standard sqlcipher CLI and DB Browser
db.pragma(`key = '${DB_KEY.replace(/'/g, "''")}'`); // Must be applied before any other DB access
console.log('[DB] Encryption key applied'); const safeKey = DB_KEY.replace(/'/g, "''");
db.pragma(`cipher='sqlcipher'`);
db.pragma(`legacy=4`);
db.pragma(`key='${safeKey}'`);
console.log('[DB] Encryption key applied (SQLCipher4)');
} else { } else {
console.warn('[DB] WARNING: DB_KEY not set — database is unencrypted'); console.warn('[DB] WARNING: DB_KEY not set — database is unencrypted');
} }

2
build.sh
View File

@@ -13,7 +13,7 @@
# ───────────────────────────────────────────────────────────── # ─────────────────────────────────────────────────────────────
set -euo pipefail set -euo pipefail
VERSION="${1:-0.9.1}" VERSION="${1:-0.9.2}"
ACTION="${2:-}" ACTION="${2:-}"
REGISTRY="${REGISTRY:-}" REGISTRY="${REGISTRY:-}"
IMAGE_NAME="jama" IMAGE_NAME="jama"

2
frontend/package.json
View File

@@ -1,6 +1,6 @@
{ {
"name": "jama-frontend", "name": "jama-frontend",
"version": "0.9.1", "version": "0.9.2",
"private": true, "private": true,
"scripts": { "scripts": {
"dev": "vite", "dev": "vite",