Update README.md, and various related changes #845

Marc-Andrieu · 2025-09-21T17:00:22Z

See the commits for a (rather) clear-cut view of the changes

gitguardian · 2025-09-21T17:00:27Z

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
21468011	Triggered	RSA Private Key	`ba94061`	config.template.yaml	View secret
21445366	Triggered	Generic Password	`88d9e6d`	config.template.yaml	View secret
7298668	Triggered	Generic High Entropy Secret	`ba94061`	config.template.yaml	View secret
21445367	Triggered	Company Email Password	`88d9e6d`	config.template.yaml	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

codecov · 2025-09-21T17:06:57Z

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.84%. Comparing base (d7de4da) to head (731e58f).

Files with missing lines	Patch %	Lines
app/utils/state.py	33.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #845      +/-   ##
==========================================
+ Coverage   85.79%   85.84%   +0.04%     
==========================================
  Files         189      189              
  Lines       14597    14590       -7     
==========================================
+ Hits        12524    12525       +1     
+ Misses       2073     2065       -8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

gitguardian · 2025-10-10T06:30:40Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

app/core/utils/log.py

armanddidierjean · 2025-10-09T07:16:17Z

config.template.yaml

+#       - <UUID value 2 of a GroupType>
+# ```
+# Group UUIDs should be values of the GroupType enum from `app.core.groups.groupe_type.GroupType`
+FACTORIES_DEMO_USERS:


I'm not sure we should have default values for this field. There may be a risk that someone forget to remove them, and thus deploy an api with to exposed accounts.

config.template.yaml

armanddidierjean · 2025-10-09T07:18:33Z

config.template.yaml

+# If you want to generate a 2048-bit long PEM certificate and save it in a file, the following command may be used:
+# openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem


Is this the doc for RSA_PRIVATE_PEM_STRING?

armanddidierjean · 2025-10-13T16:27:00Z

README.md

+
+## 2. Install dependencies
+
+### About Jellyfish and Rust


I'm not sure this is needed for macOS

README.md

armanddidierjean · 2025-10-13T16:29:25Z

README.md

+It is a binary.
+This means:
+
+- SQLite is lightweight
+- It is directly understood by your machine, no special configuration is needed.


I'm not sure this will be understandable for the majority of people

armanddidierjean · 2025-10-13T16:31:40Z

README.md


-## Create the first user
+1. `ACCESS_TOKEN_SECRET_KEY`: **Uncomment it**.
+   You can generate your own if you want, or just change a couple characters, or leave it as it is.


You should never use a publicy exposed signature secret. This readme may be used by someone who want to configure a public facing production Hyperion.

Event for a development configuration, in some situations it could be a bad idea to use a default secret.

README.md

config.template.yaml

armanddidierjean · 2025-10-18T22:33:29Z

tests/config.test.yaml

+# If you want to generate a 2048-bit long PEM certificate and save it in a file, the following command may be used:
+# openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem


You should put the last two lines after:

# RSA_PRIVATE_PEM_STRING should be a string containing the PEM certificate of a private RSA key. It will be used to sign id_tokens for Openid connect authentication # The example below was generated using a 2048-bit RSA key generator

armanddidierjean · 2025-10-18T22:33:57Z

.env.template

-POSTGRES_HOST="hyperion-db"
 POSTGRES_USER=""
 POSTGRES_PASSWORD=""
+POSTGRES_HOST=""


Suggested change

POSTGRES_HOST=""

# Should be set to the name of the postgres container

POSTGRES_HOST=""

armanddidierjean · 2025-10-18T22:34:09Z

config.template.yaml

+# If you want to generate a 2048-bit long PEM certificate and save it in a file, the following command may be used:
+# openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem


armanddidierjean · 2025-10-19T11:04:16Z

config.template.yaml

+
 # ACCESS_TOKEN_SECRET_KEY should contain a random string with enough entropy (at least 32 bytes long) to securely sign all access_tokens for OAuth and Openid connect
-ACCESS_TOKEN_SECRET_KEY: ""
+ACCESS_TOKEN_SECRET_KEY: #YWZOHliiI53lJMJc5BI_WbGbA4GF2T7Wbt1airIhOXEa3c021c4-1c55-4182-b141-7778bcc8fac4


I'm not sure how this value was generated, but I wonder if someone could have concatenated a random sequence with an uuid. I suggest using a value that is really a random sequence, as one could argue that uuid may not be suitable to use as secret.

… Clients full sections in config.yaml;

## Description ### Summary  Bug: his unexpected comment explains why new users don't have their avatar imported through our SSO to the Matrix server. Feature: it seems the MAS (Matrix Authentication Service) now supports the `picture` claim of the OIDC scope, so we add it [back]. Source: https://github.com/element-hq/matrix-authentication-service/blob/1bd1b00524a62e365cf06b3745d298a53df69c90/crates/jose/src/claims.rs#L525 ## Type of Change We present it as a feature but it's actually a bug fix... - [x] 🐛 Bug fix (non-breaking change which fixes an issue) - [x] ✨ New feature (non-breaking change which adds functionality) - [ ] 🔨 Refactor (non-breaking change that neither fixes a bug nor adds a feature) - [ ] 🔧 Infra CI/CD (changes to configs of workflows) - [ ] 💥 BREAKING CHANGE (fix or feature that require a new minimal version of the front-end) ## Impact & Scope - [ ] Core functionality changes - [ ] Single module changes - [ ] Multiple modules changes - [ ] Database migrations required - [x] Other: 3rd party service integration ## Testing - [ ] Added/modified tests that pass the CI - [ ] Tested in a pre-prod - [ ] Tested this locally - [x] Will be tested in prod directly... ## Documentation - [ ] Updated docs accordingly (docs.myecl.fr) :  - [ ] Code includes docstrings - [x] No documentation needed

# Conflicts: # .github/workflows/publish.yml # .github/workflows/publishbase.yml # Dockerfile # Dockerfile.base # pyproject.toml # requirements.txt

Marc-Andrieu self-assigned this Sep 21, 2025

Marc-Andrieu force-pushed the update/readme branch from b87be9a to ebe1caf Compare September 21, 2025 17:07

Marc-Andrieu added 5 commits October 5, 2025 23:45

Python 3.11 to 3.12

3414173

About requirements

945a7ce

About the db

39c61d0

While I'm touching the .gitignore

94b25fd

Unrelated: about pyproject.toml

fd8f8ac

Marc-Andrieu force-pushed the update/readme branch 3 times, most recently from e40d0e6 to 9f44cbb Compare October 7, 2025 21:15

Marc-Andrieu force-pushed the update/readme branch from 093dd51 to 7f245f1 Compare October 13, 2025 12:35

armanddidierjean requested changes Oct 13, 2025

View reviewed changes

Luhmos requested changes Oct 14, 2025

View reviewed changes

config.template.yaml Outdated Show resolved Hide resolved

Marc-Andrieu mentioned this pull request Oct 14, 2025

Remove requests and support async logging #876

Open

16 tasks

armanddidierjean requested changes Oct 18, 2025

View reviewed changes

armanddidierjean reviewed Oct 19, 2025

View reviewed changes

Marc-Andrieu added 3 commits October 19, 2025 13:30

About the .env

48a1527

About config.yaml

9c7996c

About launching Hyperion and creating your own admin user

682043b

Marc-Andrieu added 13 commits October 19, 2025 13:30

Details feats on config.yaml

5515ac8

Feat: fastapi's arg "app/main.py" is useless

1b5699a

Feat: psycopg[binary] as a common requirement

aa1bc8f

Feat: n° on great steps

d10e22c

Fix: REDIS_HOST false-ish values to disable it

4fe4ffe

Test: expandable parts

b5579b9

Minor completions

c514e9c

YAML inline comments; mv CORS_ORIGINS up to auth section

262bc4c

Test: use a .gitguardian.yaml

a343478

use FACTORIES_DEMO_USERS; rework README with that; Factories and Auth…

5904cba

… Clients full sections in config.yaml;

Fix(HA): no error logs in dev when it's alright

04f935a

rm useless gitguardian.yml, leave example credentials in clear

75f4b87

Fix: test config

e3e4063

Marc-Andrieu force-pushed the update/readme branch from d1ba7d7 to 023a5f6 Compare October 19, 2025 11:38

Marc-Andrieu and others added 15 commits October 19, 2025 15:39

Fix test YAML config

be1433b

Failing tests: try previous psycopg minor

c2217f7

Fix: rm factories from tests

8814f13

hopelessness

25e52ef

Fixes for test workflows and db

948a8ef

Minor fixes

ce00e05

Minor fixes

4bb9133

small rewording

fa25af8

Put back requests and synchronous Matrix logging

3874df6

Fix ruff: TCH was renamed TC in 0.8

4c486c5

Fix mypy too

2bbfe2c

Numerous fixes due to the comments

f819dfb

Rename to requirements.txt

894b65b

Merge branch 'main' into update/readme

731e58f

# Conflicts: # .github/workflows/publish.yml # .github/workflows/publishbase.yml # Dockerfile # Dockerfile.base # pyproject.toml # requirements.txt

Marc-Andrieu force-pushed the update/readme branch from bb58263 to 731e58f Compare October 19, 2025 13:51

		# If you want to generate a 2048-bit long PEM certificate and save it in a file, the following command may be used:
		# openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

	POSTGRES_HOST=""
	# Should be set to the name of the postgres container
	POSTGRES_HOST=""

Update README.md, and various related changes #845

Are you sure you want to change the base?

Update README.md, and various related changes #845

Uh oh!

Conversation

Marc-Andrieu commented Sep 21, 2025

Uh oh!

gitguardian bot commented Sep 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Uh oh!

codecov bot commented Sep 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

gitguardian bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gitguardian bot commented Sep 21, 2025 •

edited

Loading

codecov bot commented Sep 21, 2025 •

edited

Loading

gitguardian bot commented Oct 10, 2025 •

edited

Loading