ct3685 · Sep 9, 2025 · Sep 8, 2025 · Sep 8, 2025 · Sep 9, 2025 · Sep 9, 2025
diff --git a/README.md b/README.md
@@ -339,29 +339,68 @@ For detailed testing documentation, see:
 
 ## 📖 Documentation
 
-[TheAnswer Docs](https://docs.theanswer.ai/)
+[AnswerAgent Docs](https://answeragent.ai/docs)
 
 ## 🌐 Self Host
 
-Deploy TheAnswer self-hosted in your existing infrastructure. We support various [deployments](https://docs.theanswer.ai/configuration/deployment)
+Deploy AnswerAgent self-hosted in your existing infrastructure. We support various [deployments](https://answeragent.ai/docs/developers/deployment)
+
+-   [AWS](https://answeragent.ai/docs/developers/deployment/aws)
+-   [Azure](https://answeragent.ai/docs/developers/deployment/azure)
+-   [GCP](https://answeragent.ai/docs/developers/deployment/gcp)
+-   [Render](https://answeragent.ai/docs/developers/deployment/render)
+
+## 🔐 AWS Secrets Manager Integration
+
+For AWS deployments, AnswerAgent supports using AWS Secrets Manager to securely store the Flowise encryption key instead of environment variables.
+
+### Quick Setup
+
+1. **Create the encryption key secret:**
+
+    ```bash
+    aws secretsmanager create-secret \
+      --name FlowiseEncryptionKey \
+      --secret-string 'your-secure-encryption-key-here'
+    ```
+
+2. **Update an existing secret:**
+
+    ```bash
+    aws secretsmanager put-secret-value \
+      --secret-id FlowiseEncryptionKey \
+      --secret-string 'your-new-encryption-key-here'
+    ```
+
+3. **Add to your environment variables:**
+    ```bash
+    # Flowise Encryption Key Override - AWS Secrets Manager
+    SECRETKEY_STORAGE_TYPE="aws"
+    SECRETKEY_AWS_REGION="us-east-1"
+    SECRETKEY_AWS_NAME="FlowiseEncryptionKey"
+    ```
+
+### Benefits
+
+-   **Enhanced Security**: Keys are encrypted at rest and in transit
+-   **Key Rotation**: Easy rotation without application restarts
+-   **Audit Trail**: Full access logging and monitoring
+-   **IAM Integration**: Fine-grained access control
+
+For detailed AWS deployment instructions, see [AWS Deployment Guide](https://answeragent.ai/docs/developers/deployment/aws).
 
--   [AWS](https://docs.theanswer.ai/configuration/deployment/aws)
--   [Azure](https://docs.theanswer.ai/configuration/deployment/azure)
--   [Digital Ocean](https://docs.theanswer.ai/configuration/deployment/digital-ocean)
--   [GCP](https://docs.theanswer.ai/configuration/deployment/gcp)
--   [Alibaba Cloud](https://computenest.console.aliyun.com/service/instance/create/default?type=user&ServiceName=Flowise社区版)
 -   <details>
       <summary>Others</summary>
 
-    -   [Railway](https://docs.theanswer.ai/configuration/deployment/railway)
+    -   [Railway](https://answeragent.ai/docs/developers/deployment/railway)
 
         [![Deploy on Railway](https://railway.app/button.svg)](https://railway.app/template/pn4G8S?referralCode=WVNPD9)
 
-    -   [Render](https://docs.theanswer.ai/configuration/deployment/render)
+    -   [Render](https://answeragent.ai/docs/developers/deployment/render)
 
-        [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://docs.theanswer.ai/configuration/deployment/render)
+        [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://answeragent.ai/docs/developers/deployment/render)
 
-    -   [HuggingFace Spaces](https://docs.theanswer.ai/deployment/hugging-face)
+    -   [HuggingFace Spaces](https://answeragent.ai/docs/deployment/hugging-face)
 
         <a href="https://huggingface.co/spaces/TheAnswer/TheAnswer"><img src="https://huggingface.co/datasets/huggingface/badges/raw/main/open-in-hf-spaces-sm.svg" alt="HuggingFace Spaces"></a>
 

diff --git a/apps/web/next.config.js b/apps/web/next.config.js
@@ -87,6 +87,14 @@ let nextConfig = withBundleAnalyzer({
             }
         ]
     },
+    env: {
+        // Use explicit AUTH0_BASE_URL from environment, fallback to VERCEL_BRANCH_URL if on Vercel
+        AUTH0_BASE_URL:
+            process.env.AUTH0_BASE_URL ?? (process.env.VERCEL_BRANCH_URL ? `https://${process.env.VERCEL_BRANCH_URL}` : undefined),
+        FLAGSMITH_ENVIRONMENT_ID: process.env.FLAGSMITH_ENVIRONMENT_ID,
+        AUTH0_SECRET: process.env.AUTH0_SECRET,
+        CHATFLOW_DOMAIN_OVERRIDE: process.env.CHATFLOW_DOMAIN_OVERRIDE
+    },
     webpack: (config, { isServer }) => {
         config.externals = [...config.externals, 'db', 'puppeteer', 'handlebars']
         config.plugins = [

diff --git a/apps/web/package.json b/apps/web/package.json
@@ -51,7 +51,7 @@
         "ioredis": "^5.7.0",
         "jose": "^5.10.0",
         "js-cookie": "^3.0.5",
-        "next": "^14.2.31",
+        "next": "^14.2.32",
         "next-auth": "^4.24.11",
         "openai": "4.96.0",
         "react": "18.2.0",

diff --git a/packages-answers/ui/package.json b/packages-answers/ui/package.json
@@ -56,7 +56,7 @@
         "jose": "^5.10.0",
         "js-cookie": "^3.0.5",
         "jszip": "^3.10.1",
-        "next": "^14.2.31",
+        "next": "^14.2.32",
         "next-auth": "^4.24.11",
         "react": "18.2.0",
         "react-dom": "18.2.0",

diff --git a/packages/docs/docs/developers/deployment/README.md b/packages/docs/docs/developers/deployment/README.md
@@ -17,6 +17,17 @@ The following cloud providers offer robust platforms for deploying AnswerAgentAI
 
 Each of these platforms provides unique features and capabilities. Choose the one that best aligns with your organization's requirements, existing infrastructure, and technical expertise.
 
+## Security Enhancements
+
+### AWS Secrets Manager Integration
+
+For AWS deployments, we recommend using AWS Secrets Manager to securely store sensitive configuration data like encryption keys:
+
+-   **Enhanced Security**: Keys are encrypted at rest and in transit
+-   **Key Rotation**: Easy rotation without application restarts
+-   **Audit Trail**: Full access logging and monitoring
+-   **IAM Integration**: Fine-grained access control
+
 For detailed deployment instructions for each platform, please refer to the respective links above.
 
 ## Local Machine

diff --git a/packages/docs/docs/developers/deployment/aws.md b/packages/docs/docs/developers/deployment/aws.md
@@ -45,7 +45,47 @@ Ensure your AWS CLI is configured with the correct credentials:
 aws configure
 ```
 
-### 3. Clone the AnswerAgentAI Repository
+Verify your AWS credentials are working:
+
+```bash
+aws sts get-caller-identity
+```
+
+### 3. Set Up AWS Secrets Manager for Flowise Encryption Key
+
+TheAnswer uses AWS Secrets Manager to securely store the Flowise encryption key. This provides better security and key rotation capabilities compared to storing the key in environment variables.
+
+#### Create the Flowise Encryption Key Secret
+
+If the secret doesn't exist, create it:
+
+```bash
+aws secretsmanager create-secret \
+  --name FlowiseEncryptionKey \
+  --secret-string 'your-secure-encryption-key-here'
+```
+
+**Note:** Replace `'your-secure-encryption-key-here'` with a strong, randomly generated encryption key (at least 32 characters).
+
+#### Update an Existing Secret
+
+If the secret already exists, update it:
+
+```bash
+aws secretsmanager put-secret-value \
+  --secret-id FlowiseEncryptionKey \
+  --secret-string 'your-new-encryption-key-here'
+```
+
+#### Verify the Secret
+
+You can verify the secret was created/updated successfully:
+
+```bash
+aws secretsmanager describe-secret --secret-id FlowiseEncryptionKey
+```
+
+### 4. Clone the AnswerAgentAI Repository
 
 Clone the AnswerAgentAI repository to your local machine:
 
@@ -64,7 +104,7 @@ Ensure yo uhave setup a hosted zone in AWS.
 copilot app init --domain <your-domain>
 ```
 
-Replace `<your-domain>` with your desired domain name, e.g., `myapp.flowise.theanswer.ai`.
+Replace `<your-domain>` with your desired domain name, e.g., `myapp.theanswer.ai`.
 
 ### 5. Create a New Environment
 
@@ -89,6 +129,11 @@ DISABLE_FLOWISE_TELEMETRY=true
 IFRAME_ORIGINS=https://example.com
 MY_APP_VITE_AUTH_DOMAIN=your-auth-domain
 MY_APP_VITE_AUTH_CLIENT_ID=your-auth-client-id
+
+# Flowise Encryption Key Override - AWS Secrets Manager
+SECRETKEY_STORAGE_TYPE="aws"
+SECRETKEY_AWS_REGION="us-east-1"
+SECRETKEY_AWS_NAME="FlowiseEncryptionKey"
 ...
 ```
 
@@ -148,6 +193,36 @@ copilot svc status --env <env-name>
 2. Check if the correct ports are exposed in your Dockerfile and Copilot configuration.
 3. Ensure your domain's DNS settings are correctly configured to point to the AWS-provided URL.
 
+### Issue: AWS Secrets Manager Access Problems
+
+If you encounter issues with AWS Secrets Manager:
+
+1. **Verify AWS credentials and permissions:**
+
+    ```bash
+    aws sts get-caller-identity
+    ```
+
+2. **Check if the secret exists:**
+
+    ```bash
+    aws secretsmanager describe-secret --secret-id FlowiseEncryptionKey
+    ```
+
+3. **Verify IAM permissions:** Ensure your AWS user/role has the following permissions:
+
+    - `secretsmanager:GetSecretValue`
+    - `secretsmanager:DescribeSecret`
+    - `secretsmanager:CreateSecret` (for initial setup)
+    - `secretsmanager:PutSecretValue` (for updates)
+
+4. **Check region consistency:** Ensure the `SECRETKEY_AWS_REGION` in your environment variables matches the region where the secret is stored.
+
+5. **Test secret retrieval:**
+    ```bash
+    aws secretsmanager get-secret-value --secret-id FlowiseEncryptionKey
+    ```
+
 Remember to regularly update your AnswerAgentAI application and redeploy using Copilot to ensure you have the latest features and security updates.
 
 <!-- TODO: Add a screenshot of the successful deployment -->
diff --git a/packages/docs/docs/developers/environment-variables.md b/packages/docs/docs/developers/environment-variables.md
@@ -81,6 +81,9 @@ There are three different .env files you can set environment variables for Answe
 | S3_ENDPOINT_URL               | Custom S3 endpoint URL (commented out)                   | Server                      |
 | APIKEY_STORAGE_TYPE           | API key storage type (json or db) (commented out)        | Server                      |
 | SHOW_COMMUNITY_NODES          | Show community nodes when set to true (commented out)    | Server                      |
+| SECRETKEY_STORAGE_TYPE        | Secret key storage type (file, aws)                      | Root, Server                |
+| SECRETKEY_AWS_REGION          | AWS region for Secrets Manager (when using aws storage)  | Root, Server                |
+| SECRETKEY_AWS_NAME            | AWS Secrets Manager secret name (when using aws storage) | Root, Server                |
 
 This table provides a comprehensive overview of all the environment variables used across the different files in your project. The "File Location" column indicates which file(s) each variable is found in (Root, Server, UI, or AnswerAgentAI).
 
@@ -163,6 +166,22 @@ AAI-branded nodes use environment variables with the `AAI_DEFAULT_` prefix to pr
 
 3. **Default Credentials**: These are intended for development and testing. In production, consider using more secure credential management systems.
 
+4. **AWS Secrets Manager Integration**: For enhanced security in AWS deployments, use AWS Secrets Manager to store the Flowise encryption key:
+
+    ```bash
+    # Configure AWS Secrets Manager for encryption key storage
+    SECRETKEY_STORAGE_TYPE="aws"
+    SECRETKEY_AWS_REGION="us-east-1"
+    SECRETKEY_AWS_NAME="FlowiseEncryptionKey"
+    ```
+
+    **Benefits:**
+
+    - Keys are encrypted at rest and in transit
+    - Automatic key rotation capabilities
+    - Full audit trail and access logging
+    - IAM-based access control
+
 ### Usage Examples
 
 #### Development Environment

diff --git a/packages/server/src/controllers/chatflows/index.ts b/packages/server/src/controllers/chatflows/index.ts
@@ -113,7 +113,8 @@ const getChatflowById = async (req: Request, res: Response, next: NextFunction)
         if (typeof req.params === 'undefined' || !req.params.id) {
             throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: chatflowsRouter.getChatflowById - id not provided!`)
         }
-        const apiResponse = await chatflowsService.getChatflowById(req.params.id, req.user)
+        // Get fresh metadata from database (not S3 draft)
+        const apiResponse = await chatflowsService.getChatflowById(req.params.id, req.user, false)
 
         // Check if the chatflow is public (Marketplace) for unauthenticated users
         if (!req.user && (!apiResponse.visibility || !apiResponse.visibility.includes('Marketplace') || !apiResponse.isPublic)) {
@@ -189,7 +190,9 @@ const updateChatflow = async (req: Request, res: Response, next: NextFunction) =
         if (typeof req.params === 'undefined' || !req.params.id) {
             throw new InternalFlowiseError(StatusCodes.PRECONDITION_FAILED, `Error: chatflowsRouter.updateChatflow - id not provided!`)
         }
-        const chatflow = await chatflowsService.getChatflowById(req.params.id, req.user!)
+
+        // Get fresh metadata from database for updates (not S3 draft)
+        const chatflow = await chatflowsService.getChatflowById(req.params.id, req.user!, false)
         if (!chatflow) {
             return res.status(404).send(`Chatflow ${req.params.id} not found`)
         }

diff --git a/packages/server/src/services/chatflows/index.ts b/packages/server/src/services/chatflows/index.ts
@@ -352,6 +352,15 @@ const getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown): Promise
     }
 }
 
+/**
+ * Get chatflow by ID with flexible data source
+ * @param chatflowId - The chatflow ID to retrieve
+ * @param user - User context for permissions and ownership checks
+ * @param useDraft - Data source selection:
+ *   - true: Include S3 draft versions (for editor UI, flowData editing)
+ *   - false: Database only (for updates, reads, fresh metadata)
+ * @returns Promise<ChatFlow> - The chatflow object
+ */
 const getChatflowById = async (chatflowId: string, user?: IUser, useDraft = true): Promise<any> => {
     try {
         const appServer = getRunningExpressApp()

diff --git a/packages/ui/package.json b/packages/ui/package.json
@@ -46,7 +46,7 @@
         "html-react-parser": "^3.0.16",
         "lodash": "^4.17.21",
         "moment": "^2.30.1",
-        "next": "^14.2.31",
+        "next": "^14.2.32",
         "notistack": "^2.0.8",
         "prop-types": "^15.8.1",
         "react": "18.2.0",
@@ -109,7 +109,7 @@
         "rimraf": "^5.0.10",
         "sass": "^1.89.2",
         "typescript": "~5.5.4",
-        "vite": "^6.3.6",
+        "vite": "^7.0.0",
         "vite-plugin-pwa": "^0.17.5",
         "vite-plugin-react-js-support": "^1.0.7"
     }