refactor: workspace secrets-core + secrets-mcp MCP SaaS

- Split library (db/crypto/service) and MCP/Web/OAuth binary
- Add deploy examples and CI/docs updates

Made-with: Cursor

crates/secrets-core/src/service/export.rs

@@ -0,0 +1,139 @@
+use anyhow::Result;
+use serde_json::Value;
+use sqlx::PgPool;
+use std::collections::{BTreeMap, HashMap};
+use uuid::Uuid;
+
+use crate::crypto;
+use crate::models::{ExportData, ExportEntry, ExportFormat};
+use crate::service::search::{fetch_entries, fetch_secrets_for_entries};
+
+pub struct ExportParams<'a> {
+    pub namespace: Option<&'a str>,
+    pub kind: Option<&'a str>,
+    pub name: Option<&'a str>,
+    pub tags: &'a [String],
+    pub query: Option<&'a str>,
+    pub no_secrets: bool,
+    pub user_id: Option<Uuid>,
+}
+
+pub async fn export(
+    pool: &PgPool,
+    params: ExportParams<'_>,
+    master_key: Option<&[u8; 32]>,
+) -> Result<ExportData> {
+    let entries = fetch_entries(
+        pool,
+        params.namespace,
+        params.kind,
+        params.name,
+        params.tags,
+        params.query,
+        params.user_id,
+    )
+    .await?;
+
+    let entry_ids: Vec<Uuid> = entries.iter().map(|e| e.id).collect();
+    let secrets_map: HashMap<Uuid, Vec<_>> = if !params.no_secrets && !entry_ids.is_empty() {
+        fetch_secrets_for_entries(pool, &entry_ids).await?
+    } else {
+        HashMap::new()
+    };
+
+    let mut export_entries: Vec<ExportEntry> = Vec::with_capacity(entries.len());
+    for entry in &entries {
+        let secrets = if params.no_secrets {
+            None
+        } else {
+            let fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
+            if fields.is_empty() {
+                Some(BTreeMap::new())
+            } else {
+                let mk = master_key
+                    .ok_or_else(|| anyhow::anyhow!("master key required to decrypt secrets"))?;
+                let mut map = BTreeMap::new();
+                for f in fields {
+                    let decrypted = crypto::decrypt_json(mk, &f.encrypted)?;
+                    map.insert(f.field_name.clone(), decrypted);
+                }
+                Some(map)
+            }
+        };
+
+        export_entries.push(ExportEntry {
+            namespace: entry.namespace.clone(),
+            kind: entry.kind.clone(),
+            name: entry.name.clone(),
+            tags: entry.tags.clone(),
+            metadata: entry.metadata.clone(),
+            secrets,
+        });
+    }
+
+    Ok(ExportData {
+        version: 1,
+        exported_at: chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+        entries: export_entries,
+    })
+}
+
+pub async fn export_to_file(
+    pool: &PgPool,
+    params: ExportParams<'_>,
+    master_key: Option<&[u8; 32]>,
+    file_path: &str,
+    format_override: Option<&str>,
+) -> Result<usize> {
+    let format = if let Some(f) = format_override {
+        f.parse::<ExportFormat>()?
+    } else {
+        ExportFormat::from_extension(file_path).unwrap_or(ExportFormat::Json)
+    };
+
+    let data = export(pool, params, master_key).await?;
+    let count = data.entries.len();
+    let serialized = format.serialize(&data)?;
+    std::fs::write(file_path, &serialized)?;
+    Ok(count)
+}
+
+pub async fn export_to_string(
+    pool: &PgPool,
+    params: ExportParams<'_>,
+    master_key: Option<&[u8; 32]>,
+    format: &str,
+) -> Result<String> {
+    let fmt = format.parse::<ExportFormat>()?;
+    let data = export(pool, params, master_key).await?;
+    fmt.serialize(&data)
+}
+
+// ── Build helpers for re-encoding values as CLI-style entries ─────────────────
+
+pub fn build_meta_entries(metadata: &Value) -> Vec<String> {
+    let mut entries = Vec::new();
+    if let Some(obj) = metadata.as_object() {
+        for (k, v) in obj {
+            entries.push(value_to_kv_entry(k, v));
+        }
+    }
+    entries
+}
+
+pub fn build_secret_entries(secrets: Option<&BTreeMap<String, Value>>) -> Vec<String> {
+    let mut entries = Vec::new();
+    if let Some(map) = secrets {
+        for (k, v) in map {
+            entries.push(value_to_kv_entry(k, v));
+        }
+    }
+    entries
+}
+
+pub fn value_to_kv_entry(key: &str, value: &Value) -> String {
+    match value {
+        Value::String(s) => format!("{}={}", key, s),
+        other => format!("{}:={}", key, other),
+    }
+}