style(dashboard): move version footer out of card

crates/secrets-mcp/src/tools.rs

@@ -168,8 +168,9 @@ use secrets_core::service::{
     export::{ExportParams, export as svc_export},
     get_secret::{get_all_secrets_by_id, get_secret_field_by_id},
     history::run as svc_history,
+    relations::{add_parent_relation, get_relations_for_entries, remove_parent_relation},
     rollback::run as svc_rollback,
-    search::{SearchParams, resolve_entry_by_id, run as svc_search},
+    search::{SearchParams, resolve_entry, resolve_entry_by_id, run as svc_search},
     update::{UpdateParams, run as svc_update},
 };
 
@@ -373,6 +374,8 @@ struct FindInput {
         description = "Fuzzy search across name, folder, type, notes, tags, and metadata values"
     )]
     query: Option<String>,
+    #[schemars(description = "Fuzzy search across metadata values only (keys excluded)")]
+    metadata_query: Option<String>,
     #[schemars(description = "Exact folder filter (e.g. 'refining', 'ricnsmart')")]
     folder: Option<String>,
     #[schemars(
@@ -401,6 +404,8 @@ struct FindInput {
 struct SearchInput {
     #[schemars(description = "Fuzzy search across name, folder, type, notes, tags, metadata")]
     query: Option<String>,
+    #[schemars(description = "Fuzzy search across metadata values only (keys excluded)")]
+    metadata_query: Option<String>,
     #[schemars(description = "Folder filter (e.g. 'refining', 'personal', 'family')")]
     folder: Option<String>,
     #[schemars(
@@ -486,6 +491,9 @@ struct AddInput {
     )]
     #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
     link_secret_names: Option<Vec<String>>,
+    #[schemars(description = "UUIDs of parent entries to link to this entry")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
+    parent_ids: Option<Vec<String>>,
     #[schemars(description = "Encryption key as a 64-char hex string. \
         If provided, takes priority over the X-Encryption-Key HTTP header. \
         Use this when the MCP client cannot reliably forward custom headers.")]
@@ -551,6 +559,12 @@ struct UpdateInput {
     )]
     #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
     unlink_secret_names: Option<Vec<String>>,
+    #[schemars(description = "UUIDs of parent entries to link")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
+    add_parent_ids: Option<Vec<String>>,
+    #[schemars(description = "UUIDs of parent entries to unlink")]
+    #[serde(default, deserialize_with = "deser::option_vec_string_from_string")]
+    remove_parent_ids: Option<Vec<String>>,
     #[schemars(description = "Encryption key as a 64-char hex string. \
         If provided, takes priority over the X-Encryption-Key HTTP header. \
         Use this when the MCP client cannot reliably forward custom headers.")]
@@ -596,16 +610,8 @@ struct HistoryInput {
 
 #[derive(Debug, Deserialize, JsonSchema)]
 struct RollbackInput {
-    #[schemars(description = "Name of the entry")]
-    name: String,
-    #[schemars(
-        description = "Folder for disambiguation when multiple entries share the same name (optional)"
-    )]
-    folder: Option<String>,
-    #[schemars(
-        description = "Entry UUID (from secrets_find). If provided, name/folder are ignored."
-    )]
-    id: Option<String>,
+    #[schemars(description = "Entry UUID (from secrets_find) for an existing, non-deleted entry")]
+    id: String,
     #[schemars(description = "Target version number. Omit to restore the most recent snapshot.")]
     #[serde(default, deserialize_with = "deser::option_i64_from_string")]
     to_version: Option<i64>,
@@ -725,6 +731,10 @@ fn parse_uuid(s: &str) -> Result<Uuid, rmcp::ErrorData> {
         .map_err(|_| rmcp::ErrorData::invalid_request(format!("Invalid UUID: '{}'", s), None))
 }
 
+fn parse_uuid_list(values: &[String]) -> Result<Vec<Uuid>, rmcp::ErrorData> {
+    values.iter().map(|value| parse_uuid(value)).collect()
+}
+
 // ── Tool implementations ──────────────────────────────────────────────────────
 
 #[tool_router]
@@ -752,6 +762,7 @@ impl SecretsService {
             name = input.name.as_deref(),
             name_query = input.name_query.as_deref(),
             query = input.query.as_deref(),
+            metadata_query = input.metadata_query.as_deref(),
             "tool call start",
         );
         let tags = input.tags.unwrap_or_default();
@@ -764,6 +775,7 @@ impl SecretsService {
                 name_query: input.name_query.as_deref(),
                 tags: &tags,
                 query: input.query.as_deref(),
+                metadata_query: input.metadata_query.as_deref(),
                 sort: "name",
                 limit: input.limit.unwrap_or(20),
                 offset: input.offset.unwrap_or(0),
@@ -780,6 +792,7 @@ impl SecretsService {
             name_query: input.name_query.as_deref(),
             tags: &tags,
             query: input.query.as_deref(),
+            metadata_query: input.metadata_query.as_deref(),
             sort: "name",
             limit: 0,
             offset: 0,
@@ -792,11 +805,23 @@ impl SecretsService {
                 |e| tracing::warn!(tool = "secrets_find", error = %e, "count_entries failed"),
             )
             .unwrap_or(0);
+        let relation_map = get_relations_for_entries(
+            &self.pool,
+            &result
+                .entries
+                .iter()
+                .map(|entry| entry.id)
+                .collect::<Vec<_>>(),
+            Some(user_id),
+        )
+        .await
+        .map_err(|e| mcp_err_internal_logged("secrets_find", Some(user_id), e))?;
 
         let entries: Vec<serde_json::Value> = result
             .entries
             .iter()
             .map(|e| {
+                let relations = relation_map.get(&e.id).cloned().unwrap_or_default();
                 let schema: Vec<serde_json::Value> = result
                     .secret_schemas
                     .get(&e.id)
@@ -819,6 +844,8 @@ impl SecretsService {
                     "type": e.entry_type,
                     "tags": e.tags,
                     "metadata": e.metadata,
+                    "parents": relations.parents,
+                    "children": relations.children,
                     "secret_fields": schema,
                     "updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
                 })
@@ -867,6 +894,7 @@ impl SecretsService {
             name = input.name.as_deref(),
             name_query = input.name_query.as_deref(),
             query = input.query.as_deref(),
+            metadata_query = input.metadata_query.as_deref(),
             "tool call start",
         );
         let tags = input.tags.unwrap_or_default();
@@ -879,6 +907,7 @@ impl SecretsService {
                 name_query: input.name_query.as_deref(),
                 tags: &tags,
                 query: input.query.as_deref(),
+                metadata_query: input.metadata_query.as_deref(),
                 sort: input.sort.as_deref().unwrap_or("name"),
                 limit: input.limit.unwrap_or(20),
                 offset: input.offset.unwrap_or(0),
@@ -887,12 +916,24 @@ impl SecretsService {
         )
         .await
         .map_err(|e| mcp_err_internal_logged("secrets_search", Some(user_id), e))?;
+        let relation_map = get_relations_for_entries(
+            &self.pool,
+            &result
+                .entries
+                .iter()
+                .map(|entry| entry.id)
+                .collect::<Vec<_>>(),
+            Some(user_id),
+        )
+        .await
+        .map_err(|e| mcp_err_internal_logged("secrets_search", Some(user_id), e))?;
 
         let summary = input.summary.unwrap_or(false);
         let entries: Vec<serde_json::Value> = result
             .entries
             .iter()
             .map(|e| {
+                let relations = relation_map.get(&e.id).cloned().unwrap_or_default();
                 if summary {
                     serde_json::json!({
                         "name": e.name,
@@ -900,6 +941,8 @@ impl SecretsService {
                         "type": e.entry_type,
                         "tags": e.tags,
                         "notes": e.notes,
+                        "parents": relations.parents,
+                        "children": relations.children,
                         "updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
                     })
                 } else {
@@ -926,6 +969,8 @@ impl SecretsService {
                         "notes": e.notes,
                         "tags": e.tags,
                         "metadata": e.metadata,
+                        "parents": relations.parents,
+                        "children": relations.children,
                         "secret_fields": schema,
                         "version": e.version,
                         "updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
@@ -1066,6 +1111,7 @@ impl SecretsService {
             .filter_map(|(k, v)| v.as_str().map(|s| (k, s.to_string())))
             .collect();
         let link_secret_names = input.link_secret_names.unwrap_or_default();
+        let parent_ids = parse_uuid_list(&input.parent_ids.unwrap_or_default())?;
         let folder = input.folder.as_deref().unwrap_or("");
         let entry_type = input.entry_type.as_deref().unwrap_or("");
         let notes = input.notes.as_deref().unwrap_or("");
@@ -1089,6 +1135,15 @@ impl SecretsService {
         .await
         .map_err(|e| mcp_err_from_anyhow("secrets_add", Some(user_id), e))?;
 
+        let created_entry = resolve_entry(&self.pool, &input.name, Some(folder), Some(user_id))
+            .await
+            .map_err(|e| mcp_err_internal_logged("secrets_add", Some(user_id), e))?;
+        for parent_id in parent_ids {
+            add_parent_relation(&self.pool, parent_id, created_entry.id, Some(user_id))
+                .await
+                .map_err(|e| mcp_err_from_anyhow("secrets_add", Some(user_id), e))?;
+        }
+
         tracing::info!(
             tool = "secrets_add",
             ?user_id,
@@ -1176,6 +1231,8 @@ impl SecretsService {
         let remove_secrets = input.remove_secrets.unwrap_or_default();
         let link_secret_names = input.link_secret_names.unwrap_or_default();
         let unlink_secret_names = input.unlink_secret_names.unwrap_or_default();
+        let add_parent_ids = parse_uuid_list(&input.add_parent_ids.unwrap_or_default())?;
+        let remove_parent_ids = parse_uuid_list(&input.remove_parent_ids.unwrap_or_default())?;
 
         let result = svc_update(
             &self.pool,
@@ -1199,6 +1256,30 @@ impl SecretsService {
         .await
         .map_err(|e| mcp_err_from_anyhow("secrets_update", Some(user_id), e))?;
 
+        let entry_id = if let Some(id_str) = input.id.as_deref() {
+            parse_uuid(id_str)?
+        } else {
+            resolve_entry(
+                &self.pool,
+                &resolved_name,
+                resolved_folder.as_deref(),
+                Some(user_id),
+            )
+            .await
+            .map_err(|e| mcp_err_internal_logged("secrets_update", Some(user_id), e))?
+            .id
+        };
+        for parent_id in add_parent_ids {
+            add_parent_relation(&self.pool, parent_id, entry_id, Some(user_id))
+                .await
+                .map_err(|e| mcp_err_from_anyhow("secrets_update", Some(user_id), e))?;
+        }
+        for parent_id in remove_parent_ids {
+            remove_parent_relation(&self.pool, parent_id, entry_id, Some(user_id))
+                .await
+                .map_err(|e| mcp_err_from_anyhow("secrets_update", Some(user_id), e))?;
+        }
+
         tracing::info!(
             tool = "secrets_update",
             ?user_id,
@@ -1354,32 +1435,15 @@ impl SecretsService {
         tracing::info!(
             tool = "secrets_rollback",
             ?user_id,
-            name = %input.name,
-            id = ?input.id,
+            id = %input.id,
             to_version = input.to_version,
             "tool call start",
         );
+        let entry_id = parse_uuid(&input.id)?;
 
-        let (resolved_name, resolved_folder): (String, Option<String>) =
-            if let Some(ref id_str) = input.id {
-                let eid = parse_uuid(id_str)?;
-                let entry = resolve_entry_by_id(&self.pool, eid, Some(user_id))
-                    .await
-                    .map_err(|e| mcp_err_internal_logged("secrets_rollback", Some(user_id), e))?;
-                (entry.name, Some(entry.folder))
-            } else {
-                (input.name.clone(), input.folder.clone())
-            };
-
-        let result = svc_rollback(
-            &self.pool,
-            &resolved_name,
-            resolved_folder.as_deref(),
-            input.to_version,
-            Some(user_id),
-        )
-        .await
-        .map_err(|e| mcp_err_internal_logged("secrets_rollback", Some(user_id), e))?;
+        let result = svc_rollback(&self.pool, entry_id, input.to_version, Some(user_id))
+            .await
+            .map_err(|e| mcp_err_internal_logged("secrets_rollback", Some(user_id), e))?;
 
         tracing::info!(
             tool = "secrets_rollback",