Update

backend/src/index.ts

@@ -8,6 +8,7 @@ import type pg from "pg";
 import { migrate } from "./migrations.js";
 import { pool, query, withTransaction } from "./db.js";
 import { clearAuthSession, createAuthSession, currentUser, hashPassword, requireAdmin, requireAuth, requireUser, verifyPassword } from "./auth.js";
+import { decryptSecret, encryptSecret } from "./secrets.js";
 import {
   databaseExportTables as backupTables,
   exportDatabaseSql,
@@ -399,10 +400,13 @@ type ZammadSyncResult = {
 
 async function getAppSetting(key: string) {
   const result = await query<{ value: string }>("SELECT value FROM app_settings WHERE key = $1;", [key]);
-  return result.rows[0]?.value ?? null;
+  const value = result.rows[0]?.value ?? null;
+  return key === zammadApiKeySettingKey ? decryptSecret(value) : value;
 }
 
 async function setAppSetting(key: string, value: string) {
+  const storedValue = key === zammadApiKeySettingKey ? encryptSecret(value) : value;
+
   await query(
     `
       INSERT INTO app_settings (key, value, updated_at)
@@ -410,7 +414,7 @@ async function setAppSetting(key: string, value: string) {
       ON CONFLICT (key)
       DO UPDATE SET value = EXCLUDED.value, updated_at = now();
     `,
-    [key, value]
+    [key, storedValue]
   );
 }
 
@@ -520,7 +524,7 @@ async function getZammadCredentialsForUser(userId: string) {
     throw badRequest("Zammad URL muss zuerst im Adminbereich gespeichert werden");
   }
 
-  const apiToken = userResult.rows[0]?.zammad_api_token ?? null;
+  const apiToken = decryptSecret(userResult.rows[0]?.zammad_api_token);
 
   if (!apiToken) {
     throw badRequest("Zammad-Token muss zuerst im Profil hinterlegt werden");
@@ -4074,7 +4078,15 @@ app.patch("/api/auth/me", async (req, res) => {
         WHERE id = $4
         RETURNING id, username, display_name, role, active, zammad_user_id::text AS zammad_user_id, (zammad_api_token IS NOT NULL) AS has_zammad_api_token;
       `,
-      [username, displayName, newPassword ? await hashPassword(newPassword) : null, user.id, updatesZammadToken, zammadApiToken, zammadUserId]
+      [
+        username,
+        displayName,
+        newPassword ? await hashPassword(newPassword) : null,
+        user.id,
+        updatesZammadToken,
+        zammadApiToken ? encryptSecret(zammadApiToken) : null,
+        zammadUserId
+      ]
     );
 
     if (result.rowCount === 0) {