fix(platform): Fix marketplace leaking secrets

autogpt_platform/backend/backend/data/graph.py

@@ -3,7 +3,7 @@
 import uuid
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Literal
+from typing import Any, Dict, Literal
 
 import prisma.types
 from prisma.models import AgentGraph, AgentGraphExecution, AgentNode, AgentNodeLink
@@ -330,7 +330,7 @@ def get_input_schema(self) -> list[InputSchemaItem]:
         return input_schema
 
     @staticmethod
-    def from_db(graph: AgentGraph):
+    def from_db(graph: AgentGraph, hide_secrets: bool = False):
         nodes = [
             *(graph.AgentNodes or []),
             *(
@@ -341,7 +341,7 @@ def from_db(graph: AgentGraph):
         ]
         return Graph(
             **GraphMeta.from_db(graph).model_dump(),
-            nodes=[Node.from_db(node) for node in nodes],
+            nodes=[Graph._process_node(node, hide_secrets) for node in nodes],
             links=list(
                 {
                     Link.from_db(link)
@@ -355,6 +355,26 @@ def from_db(graph: AgentGraph):
             },
         )
 
+    @staticmethod
+    def _process_node(node: AgentNode, hide_secrets: bool) -> Node:
+        node_dict = node.model_dump()
+        if hide_secrets and "constantInput" in node_dict:
+            constant_input = json.loads(node_dict["constantInput"])
+            Graph._hide_secrets_in_input(constant_input)
+            node_dict["constantInput"] = json.dumps(constant_input)
+        return Node.from_db(AgentNode(**node_dict))
+
+    @staticmethod
+    def _hide_secrets_in_input(input_data: Dict[str, Any]):
+        sensitive_keys = ["api_key", "password", "token", "secret"]
+        for key, value in input_data.items():
+            if isinstance(value, dict):
+                Graph._hide_secrets_in_input(value)
+            elif isinstance(value, str) and any(
+                sensitive_key in key.lower() for sensitive_key in sensitive_keys
+            ):
+                input_data[key] = "*******"
+
 
 AGENT_NODE_INCLUDE: prisma.types.AgentNodeInclude = {
     "Input": True,
@@ -431,6 +451,7 @@ async def get_graph(
     version: int | None = None,
     template: bool = False,
     user_id: str | None = None,
+    hide_secrets: bool = False,
 ) -> Graph | None:
     """
     Retrieves a graph from the DB.
@@ -456,7 +477,7 @@ async def get_graph(
         include=AGENT_GRAPH_INCLUDE,
         order={"version": "desc"},
     )
-    return Graph.from_db(graph) if graph else None
+    return Graph.from_db(graph, hide_secrets) if graph else None
 
 
 async def set_graph_active_version(graph_id: str, version: int, user_id: str) -> None:

autogpt_platform/backend/backend/server/rest_api.py

@@ -357,8 +357,11 @@ async def get_graph(
         graph_id: str,
         user_id: Annotated[str, Depends(get_user_id)],
         version: int | None = None,
+        hide_secrets: bool = False,
     ) -> graph_db.Graph:
-        graph = await graph_db.get_graph(graph_id, version, user_id=user_id)
+        graph = await graph_db.get_graph(
+            graph_id, version, user_id=user_id, hide_secrets=hide_secrets
+        )
         if not graph:
             raise HTTPException(status_code=404, detail=f"Graph #{graph_id} not found.")
         return graph

autogpt_platform/frontend/src/app/marketplace/submit/page.tsx

@@ -129,7 +129,7 @@ const SubmitPage: React.FC = () => {
     const fetchAgentGraph = async () => {
       if (selectedAgentId) {
         const api = new AutoGPTServerAPI();
-        const graph = await api.getGraph(selectedAgentId);
+        const graph = await api.getGraph(selectedAgentId, undefined, true);
         setSelectedAgentGraph(graph);
         setValue("name", graph.name);
         setValue("description", graph.description);

autogpt_platform/frontend/src/lib/autogpt-server-api/baseClient.ts

@@ -70,8 +70,16 @@ export default class BaseAutoGPTServerAPI {
     return this._get("/templates");
   }
 
-  getGraph(id: string, version?: number): Promise<Graph> {
-    const query = version !== undefined ? `?version=${version}` : "";
+  getGraph(
+    id: string,
+    version?: number,
+    hide_secrets?: boolean,
+  ): Promise<Graph> {
+    let query = version !== undefined ? `?version=${version}` : "";
+    if (hide_secrets !== undefined) {
+      query += query ? "&" : "?";
+      query += `hide_secrets=${hide_secrets}`;
+    }
     return this._get(`/graphs/${id}` + query);
   }