Feat/key vault#8
Open
CPrutean wants to merge 31 commits into
Open
Conversation
Encrypts vault secrets at rest. Resolves the key from VAULT_ENCRYPTION_KEY, falling back to an auto-generated, persisted db/vault.key in development.
api_key secrets are no longer revealed in-browser. GET /api/vault/[id]/key returns the decrypted key only to admins or users holding a per-entry grant (canReadVaultKey). The reveal endpoint now rejects api_key entries.
POST/DELETE /api/admin/vault/[id]/access let admins grant or revoke a user's access to an api_key entry. Only applies to api_key entries.
- Hide api_key secrets in the table; show the fetch endpoint instead - Add a Manage access dialog to grant/revoke users per api_key entry - Hide the copy-behavior field for api_key entries in the editor - Truncate long entry names (click to expand) and wrap long secrets
The easy-to-copy vs restricted distinction wasn't needed. Login secrets are now always revealable and copyable; drop the easy_copy column, its schema, validation, API handling, the editor field, and the table's Copy column.
…sers Add Cache-Control: no-store so decrypted secrets aren't written to browser or shared caches, and reject deactivated accounts (which keep a valid cookie and aren't covered by the middleware matcher for /api/vault/*).
Login secrets now require a per-entry grant to reveal, the same model as api_key entries - the global Vault-access toggle only controls page visibility. Generalize canReadVaultKey -> canReadVaultEntry, drop the api_key-only restriction on the access route, and show Manage access on every row.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Created the API key vault
Why
Sharing API keys at trickfire has been a really bad practice, this alleviates that.
Type of change
feat/)fix/)chore/)docs/)refactor/)Checklist
pnpm lintpassespnpm format:checkpassesschema.tswas changed - migration generated (pnpm db:generate) and committed alongside the schema