Skip to content

fix: increase secret value column from VARCHAR(255) to TEXT#6180

Open
DragonBot00 wants to merge 2 commits intokeephq:mainfrom
DragonBot00:fix/secrets-varchar-to-text
Open

fix: increase secret value column from VARCHAR(255) to TEXT#6180
DragonBot00 wants to merge 2 commits intokeephq:mainfrom
DragonBot00:fix/secrets-varchar-to-text

Conversation

@DragonBot00
Copy link
Copy Markdown

Fix: Increase secret.value column from VARCHAR(255) to TEXT

Problem

Fixes #5353

When SECRET_MANAGER_TYPE=db, the secret.value column in the Secret SQLModel was defined as value: str, which SQLModel maps to VARCHAR(255) by default. This causes any secret value exceeding 255 characters (such as OAuth access tokens, refresh tokens, or JWT tokens) to be silently truncated at the database level.

Root Cause

In keep/api/models/db/secret.py, the value field lacked an explicit SQLAlchemy column type:

# Before (defaults to VARCHAR(255))
value: str

Solution

Explicitly set the column type to sa.Text (unlimited length):

# After (TEXT - no length limit)
value: str = Field(sa_column=sa.Column(sa.Text, nullable=False))

Changes

  1. keep/api/models/db/secret.py — Changed value field to use sa.Text instead of the implicit VARCHAR(255).
  2. keep/api/models/db/migrations/versions/2026-04-01-07-55_a1b2c3d4e5f6.py — Added Alembic migration to ALTER TABLE secret ALTER COLUMN value TYPE TEXT on existing deployments.

Testing

  • New deployments: The Secret table will be created with a TEXT column for value.
  • Existing deployments: Running alembic upgrade head will apply the migration and widen the column with no data loss.

Impact

  • No breaking changes — TEXT columns are fully backward-compatible with VARCHAR.
  • Fixes silent truncation of OAuth tokens and any other secrets > 255 chars.

When SECRET_MANAGER_TYPE=db, the secret.value column was defined as
VARCHAR(255) via SQLModel's default str mapping, causing OAuth tokens
and other secrets longer than 255 characters to be silently truncated.

Changed to sa.Text (unlimited length) to fix the truncation issue.

Fixes keephq#5353
Alembic migration to ALTER the secret table's value column from
VARCHAR(255) to TEXT, fixing truncation of long OAuth tokens.

Fixes keephq#5353
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 1, 2026

@DragonBot00 is attempting to deploy a commit to the KeepHQ Team on Vercel.

A member of the Team first needs to authorize it.

@DragonBot00
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@dosubot dosubot bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M This PR changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[🐛 Bug]: Secrets truncated in DB mode cause provider OAuth JSON parse errors

1 participant