pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-19 13:42:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(cli): add auth export command for decrypted provider credentials (#6683)

Browse Source
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-19 02:33:46 -03:00
parent 515dffd599
commit 100a27f2b2
7 changed files with 545 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/reference/CLI-TOOLS.md
View File

@@ -655,6 +655,23 @@ omniroute reset-encrypted-columns # Show warning + dry-run for encrypted c
omniroute reset-encrypted-columns --force # Actually null out encrypted credentials in SQLite
```
### Credential Export (⚠ handle with care)
```bash
omniroute auth export # Show warning + confirmation gate — no DB access
omniroute auth export --force # Export ALL connections' DECRYPTED credentials to stdout as JSON
omniroute auth export --force --id <id> # Export only the matching connection
omniroute auth export --force --format env # Emit OMNIROUTE_<PROVIDER>_<FIELD>=<value> lines
omniroute auth export --force --out creds.json # Write to a file (created with 0600 permissions)
```
`auth export` is **local-only** (direct SQLite read, no HTTP route) and intentionally prints/writes
**plaintext** `apiKey`/`accessToken`/`refreshToken`/`idToken` values — that is the feature, not a
bug. Nothing is read from the database, and nothing is decrypted, without `--force`. A stderr
warning banner always prints before any plaintext is emitted. Requires `STORAGE_ENCRYPTION_KEY` to
be set. A field that fails to decrypt (stale key, corrupt ciphertext) is reported as
`<field>DecryptFailed: true` instead of aborting the whole export or leaking the underlying error.
### Other subcommands
These assume a running OmniRoute server, unless noted otherwise: