Secrets manager

[jtpio]

Problem

Currently API keys are stored via the settings system, which ends up in the browser storage in the case of JupyterLite and on the server for JupyterLab.

This is not great, because it can easily be retrieved, and is also stored in plain text.

Proposed Solution

Have a proper way to store API keys and secrets.

The default implementation could just store them in memory for the duration of the session.

Ultimately this should be pluggable, so folks can provide different implementations for example if they want to store and retrieve secrets from a remote location.

Additional context

Likely to be done after:

• Add a dedicated settings panel #35

If something similar ends up in Jupyter AI, replace the plugin providing that functionality:

• [v3-future] Enhance and generalize secret/key management? jupyterlab/jupyter-ai#1237
• https://github.com/frankzickert/jupyterlab-credentialstore

[jtpio]

There is also the question of whether secrets should be managed with a different panel than the one that will be provided by #35.

While it makes sense to have a generic secrets manager UI, in the context of @jupyterlite/ai and Jupyter AI, being able to set the API keys next to other model parameters makes sense too.

[brichet]

Cross reference to #53 which make use of a secrets manager in the settings.

Currently API keys are stored via the settings system, which ends up in the browser storage in the case of JupyterLite and on the server for JupyterLab.

In the current state, secrets are still saved in the settings, because the AIProvider update the current provider using the settings:

ai/src/index.ts

Lines 164 to 167 in 2c7dc9e

	providerRegistry.setProvider(
	providerSettings.provider as string,
	providerSettings
	);

Maybe we could:

• hide the values of the secrets in the settings
• pass the secrets manager to the AIProvider object
• let him retrieve the secrets when setting the provider

[brichet]

I just discovered jupyterlab/jupyterlab#17327.
We could make use of it to provide our own SettingsConnector, which could keep the passwords in memory and prevent saving them to the server.
Then, when fetching the settings, the in-memory passwords could be added to the response.

[jtpio]

Yes this PR is quite recent but should be available in the latest JupyterLab 4.4.0b1 now. Since we are already using pre-release packages we could try to do the update.