[PR #327] [MERGED] feat: Allow setting path where keys are stored + only store private key #873

New Issue

OVERLORD · 2025-10-09T16:58:50+03:00

OVERLORD commented

2025-10-09 16:58:50 +03:00

📋 Pull Request Information

Original PR: https://github.com/pocket-id/pocket-id/pull/327
Author: @ItalyPaleAle
Created: 3/13/2025
Status: ✅ Merged
Merged: 3/13/2025
Merged by: @stonith404

Base: main ← Head: keys-path

📝 Commits (3)

1e2d6c1 feat: Allow setting path where keys are stored + only store private key
01754a8 Address review feedback
2022629 Merge branch 'main' into keys-path

📊 Changes

3 files changed (+63 additions, -78 deletions)

View changed files

📝 backend/internal/common/env_config.go (+13 -9)
📝 backend/internal/service/jwt_service.go (+49 -67)
📝 backend/internal/service/test_service.go (+1 -2)

📄 Description

Currently, it's possible to configure paths used by pocket-id to store the SQLite DB, uploads, and the GeoDB data. However, keys were stored in the hardcoded path data/keys.

This PR introduces the env var KEYS_PATH which allows overriding where keys are stored. Its default value is data/keys.

Additionally, as I was implementing this, I realized that pocket-id was writing to disk both the private and public keys, and loading them independently. This was both unnecessary, since the public key can always be derived from the private one, and potentially a bit dangerous, as users could modify the public key on disk and pocket-id was not checking to make sure the two keys were related to each other.

PS: Also included a performance optimization where the ID of the key is pre-computed once and saved in the object, rather than re-computed every time, since the computation is expensive and the value is static

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/pocket-id/pocket-id/pull/327 **Author:** [@ItalyPaleAle](https://github.com/ItalyPaleAle) **Created:** 3/13/2025 **Status:** ✅ Merged **Merged:** 3/13/2025 **Merged by:** [@stonith404](https://github.com/stonith404) **Base:** `main` ← **Head:** `keys-path` --- ### 📝 Commits (3) - [`1e2d6c1`](https://github.com/pocket-id/pocket-id/commit/1e2d6c169eef2e5cb44566ee95bdc2909b2dbef4) feat: Allow setting path where keys are stored + only store private key - [`01754a8`](https://github.com/pocket-id/pocket-id/commit/01754a8b72ce851b9675c90bf738a3842ebc7d32) Address review feedback - [`2022629`](https://github.com/pocket-id/pocket-id/commit/2022629f7738d7c23afe14b0fc7fb4aad7467cfd) Merge branch 'main' into keys-path ### 📊 Changes **3 files changed** (+63 additions, -78 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/common/env_config.go` (+13 -9) 📝 `backend/internal/service/jwt_service.go` (+49 -67) 📝 `backend/internal/service/test_service.go` (+1 -2) </details> ### 📄 Description Currently, it's possible to configure paths used by pocket-id to store the SQLite DB, uploads, and the GeoDB data. However, keys were stored in the hardcoded path `data/keys`. This PR introduces the env var `KEYS_PATH` which allows overriding where keys are stored. Its default value is `data/keys`. Additionally, as I was implementing this, I realized that pocket-id was writing to disk both the private and public keys, and loading them independently. This was both unnecessary, since the public key can always be derived from the private one, and potentially a bit dangerous, as users could modify the public key on disk and pocket-id was not checking to make sure the two keys were related to each other. PS: Also included a performance optimization where the ID of the key is pre-computed once and saved in the object, rather than re-computed every time, since the computation is expensive and the value is static --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2025-10-09 16:58:50 +03:00

OVERLORD closed this issue

2025-10-09 16:58:52 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id-pocket-id-2#873