refactor: workspace secrets-core + secrets-mcp MCP SaaS
- Split library (db/crypto/service) and MCP/Web/OAuth binary - Add deploy examples and CI/docs updates Made-with: Cursor
This commit is contained in:
voson
@@ -1,12 +1,15 @@
|
|||||||
name: Secrets CLI - Build & Release
|
# MCP 分支：仅构建/发布 secrets-mcp（CLI 在 main 分支维护）
|
||||||
|
name: Secrets MCP — Build & Release
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches: [main]
|
branches: [main, feat/mcp]
|
||||||
paths:
|
paths:
|
||||||
- 'src/**'
|
- 'crates/**'
|
||||||
- 'Cargo.toml'
|
- 'Cargo.toml'
|
||||||
- 'Cargo.lock'
|
- 'Cargo.lock'
|
||||||
|
# systemd / 部署模板变更也应跑构建（产物无变时可快速跳过 check）
|
||||||
|
- 'deploy/**'
|
||||||
|
|
||||||
concurrency:
|
concurrency:
|
||||||
group: ${{ github.workflow }}-${{ github.ref }}
|
group: ${{ github.workflow }}-${{ github.ref }}
|
||||||
@@ -16,8 +19,7 @@ permissions:
|
|||||||
contents: write
|
contents: write
|
||||||
|
|
||||||
env:
|
env:
|
||||||
BINARY_NAME: secrets
|
MCP_BINARY: secrets-mcp
|
||||||
SECRETS_UPGRADE_URL: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/latest
|
|
||||||
CARGO_INCREMENTAL: 0
|
CARGO_INCREMENTAL: 0
|
||||||
CARGO_NET_RETRY: 10
|
CARGO_NET_RETRY: 10
|
||||||
CARGO_TERM_COLOR: always
|
CARGO_TERM_COLOR: always
|
||||||
@@ -40,9 +42,9 @@ jobs:
|
|||||||
- name: 解析版本
|
- name: 解析版本
|
||||||
id: ver
|
id: ver
|
||||||
run: |
|
run: |
|
||||||
version=$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
|
version=$(grep -m1 '^version' crates/secrets-mcp/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
|
||||||
tag="secrets-${version}"
|
tag="secrets-mcp-${version}"
|
||||||
previous_tag=$(git tag --list 'secrets-*' --sort=-v:refname | awk -v tag="$tag" '$0 != tag { print; exit }')
|
previous_tag=$(git tag --list 'secrets-mcp-*' --sort=-v:refname | awk -v tag="$tag" '$0 != tag { print; exit }')
|
||||||
|
|
||||||
echo "version=${version}" >> "$GITHUB_OUTPUT"
|
echo "version=${version}" >> "$GITHUB_OUTPUT"
|
||||||
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
|
echo "tag=${tag}" >> "$GITHUB_OUTPUT"
|
||||||
@@ -60,7 +62,7 @@ jobs:
|
|||||||
if: steps.ver.outputs.tag_exists == 'true'
|
if: steps.ver.outputs.tag_exists == 'true'
|
||||||
run: |
|
run: |
|
||||||
echo "错误: 版本 ${{ steps.ver.outputs.tag }} 已存在，禁止重复发版。"
|
echo "错误: 版本 ${{ steps.ver.outputs.tag }} 已存在，禁止重复发版。"
|
||||||
echo "请先 bump Cargo.toml 中的 version，并执行 cargo build 同步 Cargo.lock。"
|
echo "请先 bump crates/secrets-mcp/Cargo.toml 中的 version，并执行 cargo build 同步 Cargo.lock。"
|
||||||
exit 1
|
exit 1
|
||||||
|
|
||||||
- name: 创建 Tag
|
- name: 创建 Tag
|
||||||
@@ -112,7 +114,7 @@ jobs:
|
|||||||
|
|
||||||
payload=$(jq -n \
|
payload=$(jq -n \
|
||||||
--arg tag "$tag" \
|
--arg tag "$tag" \
|
||||||
--arg name "${{ env.BINARY_NAME }} ${version}" \
|
--arg name "secrets-mcp ${version}" \
|
||||||
--arg body "$body" \
|
--arg body "$body" \
|
||||||
'{tag_name: $tag, name: $name, body: $body, draft: true}')
|
'{tag_name: $tag, name: $name, body: $body, draft: true}')
|
||||||
|
|
||||||
@@ -138,7 +140,7 @@ jobs:
|
|||||||
check:
|
check:
|
||||||
name: 质量检查 (fmt / clippy / test)
|
name: 质量检查 (fmt / clippy / test)
|
||||||
runs-on: debian
|
runs-on: debian
|
||||||
timeout-minutes: 10
|
timeout-minutes: 15
|
||||||
steps:
|
steps:
|
||||||
- name: 安装 Rust
|
- name: 安装 Rust
|
||||||
run: |
|
run: |
|
||||||
@@ -168,10 +170,10 @@ jobs:
|
|||||||
- run: cargo test --locked
|
- run: cargo test --locked
|
||||||
|
|
||||||
build-linux:
|
build-linux:
|
||||||
name: Build (x86_64-unknown-linux-musl)
|
name: Build Linux (secrets-mcp, musl)
|
||||||
needs: [version, check]
|
needs: [version, check]
|
||||||
runs-on: debian
|
runs-on: debian
|
||||||
timeout-minutes: 15
|
timeout-minutes: 25
|
||||||
steps:
|
steps:
|
||||||
- name: 安装依赖
|
- name: 安装依赖
|
||||||
run: |
|
run: |
|
||||||
@@ -198,8 +200,10 @@ jobs:
|
|||||||
restore-keys: |
|
restore-keys: |
|
||||||
cargo-x86_64-unknown-linux-musl-
|
cargo-x86_64-unknown-linux-musl-
|
||||||
|
|
||||||
- run: cargo build --release --locked --target x86_64-unknown-linux-musl
|
- name: 构建 secrets-mcp (musl)
|
||||||
- run: strip target/x86_64-unknown-linux-musl/release/${{ env.BINARY_NAME }}
|
run: |
|
||||||
|
cargo build --release --locked --target x86_64-unknown-linux-musl -p secrets-mcp
|
||||||
|
strip target/x86_64-unknown-linux-musl/release/${{ env.MCP_BINARY }}
|
||||||
|
|
||||||
- name: 上传 Release 产物
|
- name: 上传 Release 产物
|
||||||
if: needs.version.outputs.release_id != ''
|
if: needs.version.outputs.release_id != ''
|
||||||
@@ -208,16 +212,15 @@ jobs:
|
|||||||
run: |
|
run: |
|
||||||
[ -z "$RELEASE_TOKEN" ] && exit 0
|
[ -z "$RELEASE_TOKEN" ] && exit 0
|
||||||
tag="${{ needs.version.outputs.tag }}"
|
tag="${{ needs.version.outputs.tag }}"
|
||||||
bin="target/x86_64-unknown-linux-musl/release/${{ env.BINARY_NAME }}"
|
bin="target/x86_64-unknown-linux-musl/release/${{ env.MCP_BINARY }}"
|
||||||
archive="${{ env.BINARY_NAME }}-${tag}-x86_64-linux-musl.tar.gz"
|
archive="${{ env.MCP_BINARY }}-${tag}-x86_64-linux-musl.tar.gz"
|
||||||
tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
|
tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
|
||||||
sha256sum "$archive" > "${archive}.sha256"
|
sha256sum "$archive" > "${archive}.sha256"
|
||||||
|
release_url="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||||||
-F "attachment=@${archive}" \
|
-F "attachment=@${archive}" "$release_url"
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
||||||
-F "attachment=@${archive}.sha256" \
|
-F "attachment=@${archive}.sha256" "$release_url"
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
|
||||||
|
|
||||||
- name: 飞书通知
|
- name: 飞书通知
|
||||||
if: always()
|
if: always()
|
||||||
@@ -231,7 +234,7 @@ jobs:
|
|||||||
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
||||||
result="${{ job.status }}"
|
result="${{ job.status }}"
|
||||||
if [ "$result" = "success" ]; then icon="✅"; else icon="❌"; fi
|
if [ "$result" = "success" ]; then icon="✅"; else icon="❌"; fi
|
||||||
msg="secrets linux 构建${icon}
|
msg="secrets-mcp linux 构建${icon}
|
||||||
版本：${tag}
|
版本：${tag}
|
||||||
提交：${commit}
|
提交：${commit}
|
||||||
作者：${{ github.actor }}
|
作者：${{ github.actor }}
|
||||||
@@ -239,23 +242,29 @@ jobs:
|
|||||||
payload=$(jq -n --arg text "$msg" '{msg_type: "text", content: {text: $text}}')
|
payload=$(jq -n --arg text "$msg" '{msg_type: "text", content: {text: $text}}')
|
||||||
curl -sS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
|
curl -sS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
|
||||||
|
|
||||||
build-macos:
|
deploy-mcp:
|
||||||
name: Build (macOS aarch64 + x86_64)
|
name: 部署 secrets-mcp
|
||||||
needs: [version, check]
|
needs: [version, build-linux]
|
||||||
runs-on: darwin-arm64
|
# 部署目标由仓库 Actions 配置：vars.DEPLOY_HOST / vars.DEPLOY_USER；私钥 secrets.DEPLOY_SSH_KEY（PEM 原文，勿 base64）
|
||||||
timeout-minutes: 15
|
# （可用 scripts/setup-gitea-actions.sh 或 Gitea API 写入，勿写进本文件）
|
||||||
|
# Google OAuth / SERVER_MASTER_KEY / SECRETS_DATABASE_URL 等勿写入 CI，请在 ECS 上
|
||||||
|
# /opt/secrets-mcp/.env 配置（见 deploy/.env.example）。
|
||||||
|
# 若仓库 main 仍为纯 CLI、仅 feat/mcp 含本 workflow，请去掉条件里的 main，避免误部署。
|
||||||
|
if: needs.build-linux.result == 'success' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/feat/mcp')
|
||||||
|
runs-on: debian
|
||||||
|
timeout-minutes: 10
|
||||||
steps:
|
steps:
|
||||||
- name: 安装依赖
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: 安装 Rust
|
||||||
run: |
|
run: |
|
||||||
if ! command -v cargo >/dev/null 2>&1; then
|
if ! command -v cargo >/dev/null 2>&1; then
|
||||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
||||||
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||||||
fi
|
fi
|
||||||
source "$HOME/.cargo/env" 2>/dev/null || true
|
source "$HOME/.cargo/env" 2>/dev/null || true
|
||||||
rustup target add aarch64-apple-darwin
|
sudo apt-get update -qq && sudo apt-get install -y -qq pkg-config musl-tools
|
||||||
rustup target add x86_64-apple-darwin
|
rustup target add x86_64-unknown-linux-musl
|
||||||
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
||||||
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: 缓存 Cargo
|
- name: 缓存 Cargo
|
||||||
uses: actions/cache@v4
|
uses: actions/cache@v4
|
||||||
@@ -265,45 +274,43 @@ jobs:
|
|||||||
~/.cargo/registry/cache
|
~/.cargo/registry/cache
|
||||||
~/.cargo/git/db
|
~/.cargo/git/db
|
||||||
target
|
target
|
||||||
key: cargo-macos-${{ hashFiles('Cargo.lock') }}
|
key: cargo-x86_64-unknown-linux-musl-${{ hashFiles('Cargo.lock') }}
|
||||||
restore-keys: |
|
restore-keys: |
|
||||||
cargo-macos-
|
cargo-x86_64-unknown-linux-musl-
|
||||||
|
|
||||||
- run: cargo build --release --locked --target aarch64-apple-darwin
|
- name: 构建 secrets-mcp
|
||||||
- run: cargo build --release --locked --target x86_64-apple-darwin
|
|
||||||
- run: strip -x target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}
|
|
||||||
- run: strip -x target/x86_64-apple-darwin/release/${{ env.BINARY_NAME }}
|
|
||||||
|
|
||||||
- name: 上传 Release 产物
|
|
||||||
if: needs.version.outputs.release_id != ''
|
|
||||||
env:
|
|
||||||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
||||||
run: |
|
run: |
|
||||||
[ -z "$RELEASE_TOKEN" ] && exit 0
|
cargo build --release --locked --target x86_64-unknown-linux-musl -p secrets-mcp
|
||||||
tag="${{ needs.version.outputs.tag }}"
|
strip target/x86_64-unknown-linux-musl/release/${{ env.MCP_BINARY }}
|
||||||
release_id="${{ needs.version.outputs.release_id }}"
|
|
||||||
|
|
||||||
arm_bin="target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}"
|
- name: 部署到阿里云 ECS
|
||||||
arm_archive="${{ env.BINARY_NAME }}-${tag}-aarch64-macos.tar.gz"
|
env:
|
||||||
tar -czf "$arm_archive" -C "$(dirname "$arm_bin")" "$(basename "$arm_bin")"
|
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
||||||
shasum -a 256 "$arm_archive" > "${arm_archive}.sha256"
|
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||||
-F "attachment=@${arm_archive}" \
|
run: |
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
|
if [ -z "$DEPLOY_HOST" ] || [ -z "$DEPLOY_USER" ] || [ -z "$DEPLOY_SSH_KEY" ]; then
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
echo "部署跳过：请在仓库 Actions 中配置 vars.DEPLOY_HOST、vars.DEPLOY_USER 与 secrets.DEPLOY_SSH_KEY"
|
||||||
-F "attachment=@${arm_archive}.sha256" \
|
exit 0
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
|
fi
|
||||||
|
|
||||||
intel_bin="target/x86_64-apple-darwin/release/${{ env.BINARY_NAME }}"
|
echo "$DEPLOY_SSH_KEY" > /tmp/deploy_key
|
||||||
intel_archive="${{ env.BINARY_NAME }}-${tag}-x86_64-macos.tar.gz"
|
chmod 600 /tmp/deploy_key
|
||||||
tar -czf "$intel_archive" -C "$(dirname "$intel_bin")" "$(basename "$intel_bin")"
|
|
||||||
shasum -a 256 "$intel_archive" > "${intel_archive}.sha256"
|
SCP="scp -i /tmp/deploy_key -o StrictHostKeyChecking=no"
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
|
||||||
-F "attachment=@${intel_archive}" \
|
$SCP target/x86_64-unknown-linux-musl/release/${{ env.MCP_BINARY }} \
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
|
"${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/secrets-mcp.new"
|
||||||
curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
|
|
||||||
-F "attachment=@${intel_archive}.sha256" \
|
ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no "${DEPLOY_USER}@${DEPLOY_HOST}" "
|
||||||
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
|
sudo mv /tmp/secrets-mcp.new /opt/secrets-mcp/secrets-mcp
|
||||||
|
sudo chmod +x /opt/secrets-mcp/secrets-mcp
|
||||||
|
sudo systemctl restart secrets-mcp
|
||||||
|
sleep 2
|
||||||
|
sudo systemctl is-active secrets-mcp && echo '服务启动成功' || (sudo journalctl -u secrets-mcp -n 20 && exit 1)
|
||||||
|
"
|
||||||
|
|
||||||
|
rm -f /tmp/deploy_key
|
||||||
|
|
||||||
- name: 飞书通知
|
- name: 飞书通知
|
||||||
if: always()
|
if: always()
|
||||||
@@ -311,102 +318,29 @@ jobs:
|
|||||||
WEBHOOK_URL: ${{ vars.WEBHOOK_URL }}
|
WEBHOOK_URL: ${{ vars.WEBHOOK_URL }}
|
||||||
run: |
|
run: |
|
||||||
[ -z "$WEBHOOK_URL" ] && exit 0
|
[ -z "$WEBHOOK_URL" ] && exit 0
|
||||||
|
command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
|
||||||
tag="${{ needs.version.outputs.tag }}"
|
tag="${{ needs.version.outputs.tag }}"
|
||||||
commit=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "N/A")
|
commit=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "N/A")
|
||||||
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
||||||
result="${{ job.status }}"
|
result="${{ job.status }}"
|
||||||
if [ "$result" = "success" ]; then icon="✅"; else icon="❌"; fi
|
if [ "$result" = "success" ]; then icon="✅"; else icon="❌"; fi
|
||||||
msg="secrets macOS 双架构构建${icon}
|
msg="secrets-mcp 部署${icon}
|
||||||
版本：${tag}
|
版本：${tag}
|
||||||
目标：aarch64-apple-darwin, x86_64-apple-darwin
|
|
||||||
提交：${commit}
|
提交：${commit}
|
||||||
作者：${{ github.actor }}
|
作者：${{ github.actor }}
|
||||||
详情：${url}"
|
详情：${url}"
|
||||||
payload=$(python3 -c "import json,sys; print(json.dumps({'msg_type':'text','content':{'text':sys.argv[1]}}))" "$msg")
|
payload=$(jq -n --arg text "$msg" '{msg_type: "text", content: {text: $text}}')
|
||||||
curl -sS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
|
curl -sS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
|
||||||
|
|
||||||
build-windows:
|
|
||||||
name: Build (x86_64-pc-windows-msvc)
|
|
||||||
needs: [version, check]
|
|
||||||
runs-on: windows
|
|
||||||
timeout-minutes: 15
|
|
||||||
steps:
|
|
||||||
- name: 安装依赖
|
|
||||||
shell: pwsh
|
|
||||||
run: |
|
|
||||||
$cargoBin = Join-Path $env:USERPROFILE ".cargo\bin"
|
|
||||||
if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
|
|
||||||
Invoke-WebRequest -Uri "https://win.rustup.rs/x86_64" -OutFile rustup-init.exe
|
|
||||||
.\rustup-init.exe -y --default-toolchain stable
|
|
||||||
Remove-Item rustup-init.exe
|
|
||||||
}
|
|
||||||
$env:Path = "$cargoBin;$env:Path"
|
|
||||||
Add-Content -Path $env:GITHUB_PATH -Value $cargoBin
|
|
||||||
rustup target add x86_64-pc-windows-msvc
|
|
||||||
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: 缓存 Cargo
|
|
||||||
uses: actions/cache@v4
|
|
||||||
with:
|
|
||||||
path: |
|
|
||||||
~/.cargo/registry/index
|
|
||||||
~/.cargo/registry/cache
|
|
||||||
~/.cargo/git/db
|
|
||||||
target
|
|
||||||
key: cargo-x86_64-pc-windows-msvc-${{ hashFiles('Cargo.lock') }}
|
|
||||||
restore-keys: |
|
|
||||||
cargo-x86_64-pc-windows-msvc-
|
|
||||||
|
|
||||||
- name: 构建
|
|
||||||
shell: pwsh
|
|
||||||
run: cargo build --release --locked --target x86_64-pc-windows-msvc
|
|
||||||
|
|
||||||
- name: 上传 Release 产物
|
|
||||||
if: needs.version.outputs.release_id != ''
|
|
||||||
shell: pwsh
|
|
||||||
env:
|
|
||||||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
||||||
run: |
|
|
||||||
if (-not $env:RELEASE_TOKEN) { exit 0 }
|
|
||||||
$tag = "${{ needs.version.outputs.tag }}"
|
|
||||||
$bin = "target\x86_64-pc-windows-msvc\release\${{ env.BINARY_NAME }}.exe"
|
|
||||||
$archive = "${{ env.BINARY_NAME }}-${tag}-x86_64-windows.zip"
|
|
||||||
Compress-Archive -Path $bin -DestinationPath $archive -Force
|
|
||||||
$hash = (Get-FileHash -Algorithm SHA256 $archive).Hash.ToLower()
|
|
||||||
Set-Content -Path "${archive}.sha256" -Value "$hash $archive" -NoNewline
|
|
||||||
$url = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
|
|
||||||
Invoke-RestMethod -Uri $url -Method Post `
|
|
||||||
-Headers @{ "Authorization" = "token $env:RELEASE_TOKEN" } `
|
|
||||||
-Form @{ attachment = Get-Item $archive }
|
|
||||||
Invoke-RestMethod -Uri $url -Method Post `
|
|
||||||
-Headers @{ "Authorization" = "token $env:RELEASE_TOKEN" } `
|
|
||||||
-Form @{ attachment = Get-Item "${archive}.sha256" }
|
|
||||||
|
|
||||||
- name: 飞书通知
|
|
||||||
if: always()
|
|
||||||
shell: pwsh
|
|
||||||
env:
|
|
||||||
WEBHOOK_URL: ${{ vars.WEBHOOK_URL }}
|
|
||||||
run: |
|
|
||||||
if (-not $env:WEBHOOK_URL) { exit 0 }
|
|
||||||
$tag = "${{ needs.version.outputs.tag }}"
|
|
||||||
$commit = (git log -1 --pretty=format:"%s" 2>$null) ?? "N/A"
|
|
||||||
$url = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
|
||||||
$result = "${{ job.status }}"
|
|
||||||
$icon = if ($result -eq "success") { "✅" } else { "❌" }
|
|
||||||
$msg = "secrets windows 构建${icon}`n版本：${tag}`n提交：${commit}`n作者：${{ github.actor }}`n详情：${url}"
|
|
||||||
$payload = @{ msg_type = "text"; content = @{ text = $msg } } | ConvertTo-Json
|
|
||||||
Invoke-RestMethod -Uri $env:WEBHOOK_URL -Method Post `
|
|
||||||
-ContentType "application/json" -Body $payload
|
|
||||||
|
|
||||||
publish-release:
|
publish-release:
|
||||||
name: 发布草稿 Release
|
name: 发布草稿 Release
|
||||||
needs: [version, build-linux, build-macos, build-windows]
|
needs: [version, build-linux]
|
||||||
if: always() && needs.version.outputs.release_id != ''
|
if: always() && needs.version.outputs.release_id != ''
|
||||||
runs-on: debian
|
runs-on: debian
|
||||||
timeout-minutes: 5
|
timeout-minutes: 5
|
||||||
steps:
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: 发布草稿
|
- name: 发布草稿
|
||||||
env:
|
env:
|
||||||
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||||||
@@ -414,11 +348,8 @@ jobs:
|
|||||||
[ -z "$RELEASE_TOKEN" ] && exit 0
|
[ -z "$RELEASE_TOKEN" ] && exit 0
|
||||||
|
|
||||||
linux_r="${{ needs.build-linux.result }}"
|
linux_r="${{ needs.build-linux.result }}"
|
||||||
macos_r="${{ needs.build-macos.result }}"
|
if [ "$linux_r" != "success" ]; then
|
||||||
windows_r="${{ needs.build-windows.result }}"
|
echo "linux 构建未成功，保留草稿 Release"
|
||||||
if [ "$linux_r" != "success" ] || [ "$macos_r" != "success" ] || [ "$windows_r" != "success" ]; then
|
|
||||||
echo "存在未成功的构建任务，保留草稿 Release"
|
|
||||||
echo "linux=${linux_r} macos=${macos_r} windows=${windows_r}"
|
|
||||||
exit 0
|
exit 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
@@ -451,15 +382,13 @@ jobs:
|
|||||||
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
|
||||||
|
|
||||||
linux_r="${{ needs.build-linux.result }}"
|
linux_r="${{ needs.build-linux.result }}"
|
||||||
macos_r="${{ needs.build-macos.result }}"
|
|
||||||
windows_r="${{ needs.build-windows.result }}"
|
|
||||||
publish_r="${{ job.status }}"
|
publish_r="${{ job.status }}"
|
||||||
|
|
||||||
icon() { case "$1" in success) echo "✅";; skipped) echo "⏭";; *) echo "❌";; esac; }
|
icon() { case "$1" in success) echo "✅";; skipped) echo "⏭";; *) echo "❌";; esac; }
|
||||||
|
|
||||||
if [ "$linux_r" = "success" ] && [ "$macos_r" = "success" ] && [ "$windows_r" = "success" ] && [ "$publish_r" = "success" ]; then
|
if [ "$linux_r" = "success" ] && [ "$publish_r" = "success" ]; then
|
||||||
status="发布成功 ✅"
|
status="发布成功 ✅"
|
||||||
elif [ "$linux_r" != "success" ] || [ "$macos_r" != "success" ] || [ "$windows_r" != "success" ]; then
|
elif [ "$linux_r" != "success" ]; then
|
||||||
status="构建失败 ❌"
|
status="构建失败 ❌"
|
||||||
else
|
else
|
||||||
status="发布失败 ❌"
|
status="发布失败 ❌"
|
||||||
@@ -471,9 +400,9 @@ jobs:
|
|||||||
version_line="🔄 重复构建 ${tag}"
|
version_line="🔄 重复构建 ${tag}"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
msg="secrets ${status}
|
msg="secrets-mcp ${status}
|
||||||
${version_line}
|
${version_line}
|
||||||
linux $(icon "$linux_r") | macOS $(icon "$macos_r") | windows $(icon "$windows_r") | Release $(icon "$publish_r")
|
linux $(icon "$linux_r") | Release $(icon "$publish_r")
|
||||||
提交：${commit}
|
提交：${commit}
|
||||||
作者：${{ github.actor }}
|
作者：${{ github.actor }}
|
||||||
详情：${url}"
|
详情：${url}"
|
||||||
|
|||||||
2
.gitignore
vendored
2
.gitignore
vendored
@@ -2,3 +2,5 @@
|
|||||||
.env
|
.env
|
||||||
.DS_Store
|
.DS_Store
|
||||||
.cursor/
|
.cursor/
|
||||||
|
# Google OAuth 下载的 JSON 凭据文件
|
||||||
|
client_secret_*.apps.googleusercontent.com.json
|
||||||
|
|||||||
166
.vscode/tasks.json
vendored
166
.vscode/tasks.json
vendored
@@ -4,146 +4,48 @@
|
|||||||
{
|
{
|
||||||
"label": "build",
|
"label": "build",
|
||||||
"type": "shell",
|
"type": "shell",
|
||||||
"command": "cargo build",
|
"command": "cargo build --workspace --locked",
|
||||||
"group": { "kind": "build", "isDefault": true }
|
"group": { "kind": "build", "isDefault": true }
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"label": "cli: version",
|
"label": "mcp: build",
|
||||||
"type": "shell",
|
"type": "shell",
|
||||||
"command": "./target/debug/secrets -V",
|
"command": "cargo build --locked -p secrets-mcp",
|
||||||
|
"group": "build"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"label": "mcp: run",
|
||||||
|
"type": "shell",
|
||||||
|
"command": "cargo run --locked -p secrets-mcp",
|
||||||
|
"dependsOn": "mcp: build",
|
||||||
|
"options": {
|
||||||
|
"envFile": "${workspaceFolder}/.env"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"label": "test: workspace",
|
||||||
|
"type": "shell",
|
||||||
|
"command": "cargo test --workspace --locked",
|
||||||
|
"dependsOn": "build",
|
||||||
|
"group": { "kind": "test", "isDefault": true }
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"label": "fmt: check",
|
||||||
|
"type": "shell",
|
||||||
|
"command": "cargo fmt -- --check",
|
||||||
|
"problemMatcher": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"label": "clippy: workspace",
|
||||||
|
"type": "shell",
|
||||||
|
"command": "cargo clippy --workspace --locked -- -D warnings",
|
||||||
"dependsOn": "build"
|
"dependsOn": "build"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"label": "cli: help",
|
"label": "ci: release-check",
|
||||||
"type": "shell",
|
"type": "shell",
|
||||||
"command": "./target/debug/secrets --help",
|
"command": "./scripts/release-check.sh",
|
||||||
"dependsOn": "build"
|
"problemMatcher": []
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "cli: help add",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets help add",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "cli: help config",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets help config",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "cli: config path",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets config path",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "cli: config show",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets config show",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search all",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search all (verbose)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets --verbose search",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search by namespace (refining)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search -n refining",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search by namespace (ricnsmart)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search -n ricnsmart",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search servers",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search --kind server",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search services",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search --kind service",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search keys",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search --kind key",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search by tag (aliyun)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search --tag aliyun",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search by tag (hongkong)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search --tag hongkong",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: search keyword (gitea)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search -q gitea",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: run service secrets",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets run -n refining --kind service --name gitea -- printenv",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: combined search (ricnsmart + server + shanghai)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "./target/debug/secrets search -n ricnsmart --kind server --tag shanghai",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: add + delete roundtrip",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "echo '--- add ---' && ./target/debug/secrets add -n test --kind demo --name roundtrip-test --tag test -m foo=bar -s password=secret123 && echo '--- search metadata ---' && ./target/debug/secrets search -n test && echo '--- run secrets ---' && ./target/debug/secrets run -n test --kind demo --name roundtrip-test -- printenv && echo '--- delete ---' && ./target/debug/secrets delete -n test --kind demo --name roundtrip-test && echo '--- verify deleted ---' && ./target/debug/secrets search -n test",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: add + delete roundtrip (verbose)",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "echo '--- add (verbose) ---' && ./target/debug/secrets --verbose add -n test --kind demo --name roundtrip-verbose --tag test -m foo=bar -s password=secret123 && echo '--- delete (verbose) ---' && ./target/debug/secrets --verbose delete -n test --kind demo --name roundtrip-verbose",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: update roundtrip",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "echo '--- add ---' && ./target/debug/secrets add -n test --kind demo --name update-test --tag v1 -m env=staging && echo '--- update ---' && ./target/debug/secrets update -n test --kind demo --name update-test --add-tag v2 --remove-tag v1 -m env=production && echo '--- verify ---' && ./target/debug/secrets search -n test --kind demo && echo '--- cleanup ---' && ./target/debug/secrets delete -n test --kind demo --name update-test",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: audit log",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "echo '--- add ---' && ./target/debug/secrets add -n test --kind demo --name audit-test -m foo=bar -s key=val && echo '--- update ---' && ./target/debug/secrets update -n test --kind demo --name audit-test -m foo=baz && echo '--- delete ---' && ./target/debug/secrets delete -n test --kind demo --name audit-test && echo '--- audit log (last 5) ---' && psql $DATABASE_URL -c \"SELECT action, namespace, kind, name, actor, detail, created_at FROM audit_log ORDER BY created_at DESC LIMIT 5;\"",
|
|
||||||
"dependsOn": "build"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"label": "test: add with file secret",
|
|
||||||
"type": "shell",
|
|
||||||
"command": "echo '--- add key from file ---' && ./target/debug/secrets add -n test --kind key --name test-key --tag test -s content=@./test-fixtures/example-key.pem && echo '--- verify metadata ---' && ./target/debug/secrets search -n test --kind key && echo '--- verify run ---' && ./target/debug/secrets run -n test --kind key --name test-key -- printenv && echo '--- cleanup ---' && ./target/debug/secrets delete -n test --kind key --name test-key",
|
|
||||||
"dependsOn": "build"
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
702
AGENTS.md
702
AGENTS.md
@@ -1,68 +1,49 @@
|
|||||||
# Secrets CLI — AGENTS.md
|
# Secrets MCP — AGENTS.md
|
||||||
|
|
||||||
## 提交 / 发版硬规则（优先于下文其他说明）
|
本仓库为 **MCP SaaS**：`secrets-core`（业务与持久化）+ `secrets-mcp`（Streamable HTTP MCP、Web、OAuth、API Key）。对外入口见 `crates/secrets-mcp`。
|
||||||
|
|
||||||
1. 涉及 `src/**`、`Cargo.toml`、`Cargo.lock`、CLI 行为变更的提交，默认视为**需要发版**，除非用户明确说明“本次不发版”。
|
## 提交 / 发版硬规则（优先于下文）
|
||||||
2. 发版前必须先检查 `Cargo.toml` 中的 `version`，再检查是否已存在对应 tag：`git tag -l 'secrets-*'`。
|
|
||||||
3. 若当前版本对应 tag 已存在，必须先 bump `Cargo.toml` 的 `version`，再执行 `cargo build` 同步 `Cargo.lock`，然后才能提交。
|
|
||||||
4. 提交前优先运行 `./scripts/release-check.sh`；该脚本会检查重复版本并执行 `cargo fmt -- --check && cargo clippy --locked -- -D warnings && cargo test --locked`。
|
|
||||||
|
|
||||||
跨设备密钥与配置管理 CLI 工具，将服务器信息、服务凭据等存储到 PostgreSQL 18，供 AI 工具读取上下文。每个加密字段单独行存储（`secrets` 子表），字段名、类型、长度以明文保存，主密钥由 Argon2id 从主密码派生并存入平台安全存储（macOS Keychain / Windows Credential Manager / Linux keyutils）。
|
1. 涉及 `crates/**`、根目录 `Cargo.toml`/`Cargo.lock`、`secrets-mcp` 行为变更的提交，默认视为**需要发版**，除非明确说明「本次不发版」。
|
||||||
|
2. 发版前检查 `crates/secrets-mcp/Cargo.toml` 的 `version`，再查 tag：`git tag -l 'secrets-mcp-*'`。
|
||||||
|
3. 若当前版本对应 tag 已存在，须先 bump `version`，再 `cargo build` 同步 `Cargo.lock` 后提交。
|
||||||
|
4. 提交前优先运行 `./scripts/release-check.sh`（版本/tag + `fmt` + `clippy --locked` + `test --locked`）。
|
||||||
|
|
||||||
## 项目结构
|
## 项目结构
|
||||||
|
|
||||||
```
|
```
|
||||||
secrets/
|
secrets/
|
||||||
src/
|
Cargo.toml
|
||||||
main.rs # CLI 入口，clap 命令定义，auto-migrate，--verbose 全局参数
|
crates/
|
||||||
output.rs # OutputMode 枚举（默认 json，-o text 供人类使用）
|
secrets-core/ # db / crypto / models / audit / service
|
||||||
config.rs # 配置读写：~/.config/secrets/config.toml（database_url）
|
secrets-mcp/ # rmcp tools、axum、OAuth、Dashboard
|
||||||
db.rs # PgPool 创建 + 建表/索引（DROP+CREATE，含所有表）
|
|
||||||
crypto.rs # AES-256-GCM 加解密、Argon2id 派生、OS 钥匙串
|
|
||||||
models.rs # Entry + SecretField 结构体（sqlx::FromRow + serde）
|
|
||||||
audit.rs # 审计写入：log_tx（事务内）
|
|
||||||
commands/
|
|
||||||
init.rs # init 命令：主密钥初始化（每台设备一次）
|
|
||||||
add.rs # add 命令：upsert entries + 逐字段写入 secrets，含历史快照
|
|
||||||
config.rs # config 命令：set-db / show / path（持久化 database_url）
|
|
||||||
search.rs # search 命令：多条件查询，展示 secrets 字段 schema（无需 master_key）
|
|
||||||
delete.rs # delete 命令：事务化，CASCADE 删除 secrets，含历史快照
|
|
||||||
update.rs # update 命令：增量更新，secrets 行级 UPSERT/DELETE，CAS 并发保护
|
|
||||||
rollback.rs # rollback 命令：按 entry_version 恢复 entry + secrets
|
|
||||||
history.rs # history 命令：查看 entry 变更历史列表
|
|
||||||
run.rs # run 命令：仅 secrets 逐字段解密 + key_ref 引用解析（不含 metadata）
|
|
||||||
upgrade.rs # upgrade 命令：检查、校验摘要并下载最新版本，自动替换二进制
|
|
||||||
export_cmd.rs # export 命令：批量导出记录，支持 JSON/TOML/YAML，含解密明文
|
|
||||||
import_cmd.rs # import 命令：批量导入记录，冲突检测，dry-run，重新加密写入
|
|
||||||
scripts/
|
scripts/
|
||||||
release-check.sh # 发版前检查版本号/tag 是否重复，并执行 fmt/clippy/test
|
release-check.sh
|
||||||
setup-gitea-actions.sh # 配置 Gitea Actions 变量与 Secrets
|
setup-gitea-actions.sh
|
||||||
.gitea/workflows/
|
.gitea/workflows/secrets.yml
|
||||||
secrets.yml # CI：fmt + clippy + musl 构建 + Release 上传 + 飞书通知
|
.vscode/tasks.json
|
||||||
.vscode/tasks.json # 本地测试任务（build / config / search / add+delete / update / audit 等）
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## 数据库
|
## 数据库
|
||||||
|
|
||||||
- **Host**: `<host>:<port>`
|
- **建议库名**：`secrets-mcp`（专用实例，与历史库名区分）。
|
||||||
- **Database**: `secrets`
|
- **连接**：环境变量 **`SECRETS_DATABASE_URL`**（本分支无本地配置文件路径）。
|
||||||
- **连接串**: `postgres://postgres:<password>@<host>:<port>/secrets`
|
- **表**：`entries`（含 `user_id`）、`secrets`、`entries_history`、`secrets_history`、`audit_log`、`users`、`oauth_accounts`、`api_keys`，首次连接 **auto-migrate**。
|
||||||
- **表**: `entries`（主表）+ `secrets`（加密字段子表）+ `entries_history` + `secrets_history` + `audit_log` + `kv_config`，首次连接自动建表（auto-migrate）
|
|
||||||
|
|
||||||
### 表结构
|
### 表结构（摘录）
|
||||||
|
|
||||||
```sql
|
```sql
|
||||||
entries (
|
entries (
|
||||||
id UUID PRIMARY KEY DEFAULT uuidv7(), -- PG18 时间有序 UUID
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
namespace VARCHAR(64) NOT NULL, -- 一级隔离: "refining" | "ricnsmart"
|
user_id UUID, -- 多租户：NULL=遗留行；非空=归属用户
|
||||||
kind VARCHAR(64) NOT NULL, -- 类型: "server" | "service" | "key"（可扩展）
|
namespace VARCHAR(64) NOT NULL,
|
||||||
name VARCHAR(256) NOT NULL, -- 人类可读标识
|
kind VARCHAR(64) NOT NULL,
|
||||||
tags TEXT[] NOT NULL DEFAULT '{}', -- 灵活标签: ["aliyun","hongkong"]
|
name VARCHAR(256) NOT NULL,
|
||||||
metadata JSONB NOT NULL DEFAULT '{}', -- 明文描述: ip, desc, domains, location...
|
tags TEXT[] NOT NULL DEFAULT '{}',
|
||||||
version BIGINT NOT NULL DEFAULT 1, -- 乐观锁版本号，每次写操作自增
|
metadata JSONB NOT NULL DEFAULT '{}',
|
||||||
|
version BIGINT NOT NULL DEFAULT 1,
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||||
UNIQUE(namespace, kind, name)
|
|
||||||
)
|
)
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -70,8 +51,8 @@ entries (
|
|||||||
secrets (
|
secrets (
|
||||||
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
entry_id UUID NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
|
entry_id UUID NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
|
||||||
field_name VARCHAR(256) NOT NULL, -- 明文字段名: "username", "token", "ssh_key"
|
field_name VARCHAR(256) NOT NULL,
|
||||||
encrypted BYTEA NOT NULL DEFAULT '\x', -- 仅加密值本身：nonce(12B)||ciphertext+tag
|
encrypted BYTEA NOT NULL DEFAULT '\x',
|
||||||
version BIGINT NOT NULL DEFAULT 1,
|
version BIGINT NOT NULL DEFAULT 1,
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
@@ -79,588 +60,109 @@ secrets (
|
|||||||
)
|
)
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### users / oauth_accounts / api_keys
|
||||||
|
|
||||||
```sql
|
```sql
|
||||||
kv_config (
|
users (
|
||||||
key TEXT PRIMARY KEY, -- 如 'argon2_salt'
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
value BYTEA NOT NULL -- Argon2id salt，首台设备 init 时生成
|
email VARCHAR(256),
|
||||||
|
name VARCHAR(256) NOT NULL DEFAULT '',
|
||||||
|
avatar_url TEXT,
|
||||||
|
key_salt BYTEA, -- PBKDF2 salt（32B），首次设置密码短语时写入
|
||||||
|
key_check BYTEA, -- 派生密钥加密已知常量，用于验证密码短语
|
||||||
|
key_params JSONB, -- 算法参数，如 {"alg":"pbkdf2-sha256","iterations":600000}
|
||||||
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||||
|
)
|
||||||
|
|
||||||
|
oauth_accounts (
|
||||||
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||||
|
provider VARCHAR(32) NOT NULL,
|
||||||
|
provider_id VARCHAR(256) NOT NULL,
|
||||||
|
...
|
||||||
|
UNIQUE(provider, provider_id)
|
||||||
|
)
|
||||||
|
|
||||||
|
api_keys (
|
||||||
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||||
|
name VARCHAR(256) NOT NULL,
|
||||||
|
key_hash VARCHAR(64) NOT NULL UNIQUE,
|
||||||
|
key_prefix VARCHAR(12) NOT NULL,
|
||||||
|
last_used_at TIMESTAMPTZ,
|
||||||
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||||
)
|
)
|
||||||
```
|
```
|
||||||
|
|
||||||
### audit_log 表结构
|
### audit_log / history
|
||||||
|
|
||||||
```sql
|
与迁移脚本一致：`audit_log`、`entries_history`、`secrets_history` 用于审计与时间旅行恢复；字段定义见 `crates/secrets-core/src/db.rs` 内 `migrate` SQL。
|
||||||
audit_log (
|
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
|
||||||
action VARCHAR(32) NOT NULL, -- 'add' | 'update' | 'delete' | 'rollback'
|
|
||||||
namespace VARCHAR(64) NOT NULL,
|
|
||||||
kind VARCHAR(64) NOT NULL,
|
|
||||||
name VARCHAR(256) NOT NULL,
|
|
||||||
detail JSONB NOT NULL DEFAULT '{}', -- 变更摘要（tags/meta keys/secret keys，不含 value）
|
|
||||||
actor VARCHAR(128) NOT NULL DEFAULT '', -- 操作者（$USER 环境变量）
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
||||||
)
|
|
||||||
```
|
|
||||||
|
|
||||||
### entries_history 表结构
|
### 字段职责
|
||||||
|
|
||||||
```sql
|
| 字段 | 含义 | 示例 |
|
||||||
entries_history (
|
|------|------|------|
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
| `namespace` | 隔离空间 | `refining` |
|
||||||
entry_id UUID NOT NULL,
|
|
||||||
namespace VARCHAR(64) NOT NULL,
|
|
||||||
kind VARCHAR(64) NOT NULL,
|
|
||||||
name VARCHAR(256) NOT NULL,
|
|
||||||
version BIGINT NOT NULL, -- 被快照时的版本号
|
|
||||||
action VARCHAR(16) NOT NULL, -- 'add' | 'update' | 'delete' | 'rollback'
|
|
||||||
tags TEXT[] NOT NULL DEFAULT '{}',
|
|
||||||
metadata JSONB NOT NULL DEFAULT '{}',
|
|
||||||
actor VARCHAR(128) NOT NULL DEFAULT '',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
||||||
)
|
|
||||||
```
|
|
||||||
|
|
||||||
### secrets_history 表结构
|
|
||||||
|
|
||||||
```sql
|
|
||||||
secrets_history (
|
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
|
||||||
entry_id UUID NOT NULL,
|
|
||||||
secret_id UUID NOT NULL, -- 对应 secrets.id
|
|
||||||
entry_version BIGINT NOT NULL, -- 关联 entries_history 的版本号
|
|
||||||
field_name VARCHAR(256) NOT NULL,
|
|
||||||
encrypted BYTEA NOT NULL DEFAULT '\x',
|
|
||||||
action VARCHAR(16) NOT NULL, -- 'add' | 'update' | 'delete' | 'rollback'
|
|
||||||
actor VARCHAR(128) NOT NULL DEFAULT '',
|
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
||||||
)
|
|
||||||
```
|
|
||||||
|
|
||||||
### 字段职责划分
|
|
||||||
|
|
||||||
| 字段 | 存什么 | 示例 |
|
|
||||||
|------|--------|------|
|
|
||||||
| `namespace` | 项目/团队隔离 | `refining`, `ricnsmart` |
|
|
||||||
| `kind` | 记录类型 | `server`, `service`, `key` |
|
| `kind` | 记录类型 | `server`, `service`, `key` |
|
||||||
| `name` | 唯一标识名 | `i-example0abcd1234efgh`, `gitea` |
|
| `name` | 标识名 | `gitea`, `i-example0…` |
|
||||||
| `tags` | 多维分类标签 | `["aliyun","hongkong","ricn"]` |
|
| `tags` | 标签 | `["aliyun","prod"]` |
|
||||||
| `metadata` | 明文非敏感信息 | `{"ip":"192.0.2.1","desc":"Grafana","key_ref":"my-shared-key"}` |
|
| `metadata` | 明文描述 | `ip`、`url`、`key_ref` |
|
||||||
| `secrets.field_name` | 加密字段名（明文） | `"username"`, `"token"`, `"ssh_key"` |
|
| `secrets.field_name` | 加密字段名（明文） | `token`, `ssh_key` |
|
||||||
| `secrets.encrypted` | 仅加密值本身 | AES-256-GCM 密文 |
|
| `secrets.encrypted` | 密文 | AES-GCM |
|
||||||
|
|
||||||
### PEM 共享机制（key_ref）
|
### PEM 共享（`key_ref`）
|
||||||
|
|
||||||
同一 PEM 被多台服务器共享时，将 PEM 存为独立的 `kind=key` 记录，服务器通过 `metadata.key_ref` 引用：
|
将共享 PEM 存为 `kind=key` 的 entry；其它记录在 `metadata.key_ref` 指向该 key 的 `name`。更新 key 记录后，引用方通过服务层解析合并逻辑即可使用新密钥（实现见 `secrets_core::service`）。
|
||||||
|
|
||||||
```bash
|
|
||||||
# 1. 存共享 PEM
|
|
||||||
secrets add -n refining --kind key --name my-shared-key \
|
|
||||||
--tag aliyun --tag hongkong \
|
|
||||||
-s content=@./keys/my-shared-key.pem
|
|
||||||
|
|
||||||
# 2. 服务器通过 metadata.key_ref 引用（run 时自动合并 key 的 secrets）
|
|
||||||
secrets add -n refining --kind server --name i-example0xyz789 \
|
|
||||||
-m ip=192.0.2.1 -m key_ref=my-shared-key \
|
|
||||||
-s username=ecs-user
|
|
||||||
|
|
||||||
# 3. 轮换只需更新 key 记录，所有引用服务器自动生效
|
|
||||||
secrets update -n refining --kind key --name my-shared-key \
|
|
||||||
-s content=@./keys/new-key.pem
|
|
||||||
```
|
|
||||||
|
|
||||||
## 数据库配置
|
|
||||||
|
|
||||||
首次使用需显式配置数据库连接，设置一次后在该设备上持久生效：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets config set-db "postgres://postgres:<password>@<host>:<port>/secrets"
|
|
||||||
secrets config show # 查看当前配置（密码脱敏）
|
|
||||||
secrets config path # 打印配置文件路径
|
|
||||||
```
|
|
||||||
|
|
||||||
`set-db` 会先验证连接可用，成功后才写入配置文件；连接失败时提示 "Database connection failed" 且不修改配置。
|
|
||||||
|
|
||||||
配置文件：`~/.config/secrets/config.toml`，权限 0600。`--db-url` 参数可一次性覆盖。
|
|
||||||
|
|
||||||
## 主密钥与加密
|
|
||||||
|
|
||||||
首次使用（每台设备各执行一次）：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets config set-db "postgres://postgres:<password>@<host>:<port>/secrets"
|
|
||||||
secrets init # 提示输入主密码，Argon2id 派生主密钥后存入 OS 钥匙串
|
|
||||||
```
|
|
||||||
|
|
||||||
主密码不存储；salt 存于 `kv_config`，首台设备生成后共享，确保同一主密码在所有设备派生出相同主密钥。
|
|
||||||
|
|
||||||
主密钥存储后端：macOS Keychain、Windows Credential Manager、Linux keyutils（会话级，重启后需再次 `secrets init`）。
|
|
||||||
|
|
||||||
**从旧版（明文 JSONB）升级**：升级后执行 `secrets init` 即可（明文记录需手动重新 add 或通过 update 更新）。
|
|
||||||
|
|
||||||
## CLI 命令
|
|
||||||
|
|
||||||
### AI 使用主路径
|
|
||||||
|
|
||||||
**读取一律用 `search`，写入用 `add` / `update`，避免反复查帮助。**
|
|
||||||
|
|
||||||
输出格式规则：
|
|
||||||
- 默认始终输出 `json`（pretty-printed），无论 TTY 还是管道
|
|
||||||
- 显式 `-o json-compact` → 单行 JSON（管道处理时更紧凑）
|
|
||||||
- 显式 `-o text` → 人类可读文本格式
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### init — 主密钥初始化（每台设备一次）
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 首次设备：生成 Argon2id salt 并存库，派生主密钥后存 OS 钥匙串
|
|
||||||
secrets init
|
|
||||||
|
|
||||||
# 后续设备：复用已有 salt，派生主密钥后存钥匙串（主密码需与首台相同）
|
|
||||||
secrets init
|
|
||||||
```
|
|
||||||
|
|
||||||
### search — 发现与读取
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明（带典型值）
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name gitea | i-example0abcd1234efgh | mqtt
|
|
||||||
# --tag aliyun | hongkong | production
|
|
||||||
# -q / --query mqtt | grafana | gitea （模糊匹配 name/namespace/kind/tags/metadata）
|
|
||||||
# secrets schema search 默认展示 secrets 字段名、类型与长度（无需 master_key）
|
|
||||||
# -f / --field metadata.ip | metadata.url | metadata.default_org
|
|
||||||
# --summary 不带值的 flag，仅返回摘要（name/tags/desc/updated_at）
|
|
||||||
# --limit 20 | 50（默认 50）
|
|
||||||
# --offset 0 | 10 | 20（分页偏移）
|
|
||||||
# --sort name（默认）| updated | created
|
|
||||||
# -o / --output text | json | json-compact
|
|
||||||
|
|
||||||
# 发现概览（起步推荐）
|
|
||||||
secrets search --summary --limit 20
|
|
||||||
secrets search -n refining --summary --limit 20
|
|
||||||
secrets search --sort updated --limit 10 --summary
|
|
||||||
|
|
||||||
# 精确定位单条记录
|
|
||||||
secrets search -n refining --kind service --name gitea
|
|
||||||
secrets search -n refining --kind server --name i-example0abcd1234efgh
|
|
||||||
|
|
||||||
# 精确定位并获取完整内容（secrets 保持加密占位）
|
|
||||||
secrets search -n refining --kind service --name gitea -o json
|
|
||||||
|
|
||||||
# 直接提取 metadata 字段值（最短路径）
|
|
||||||
secrets search -n refining --kind service --name gitea -f metadata.url
|
|
||||||
secrets search -n refining --kind service --name gitea \
|
|
||||||
-f metadata.url -f metadata.default_org
|
|
||||||
|
|
||||||
# 需要 secrets 时，改用 run
|
|
||||||
secrets run -n refining --kind service --name gitea -- printenv
|
|
||||||
|
|
||||||
# 模糊关键词搜索
|
|
||||||
secrets search -q mqtt
|
|
||||||
secrets search -q grafana
|
|
||||||
secrets search -q 192.0.2
|
|
||||||
|
|
||||||
# 按条件过滤
|
|
||||||
secrets search -n refining --kind service
|
|
||||||
secrets search -n ricnsmart --kind server
|
|
||||||
secrets search --tag hongkong
|
|
||||||
secrets search --tag aliyun --summary
|
|
||||||
|
|
||||||
# 分页
|
|
||||||
secrets search -n refining --summary --limit 10 --offset 0
|
|
||||||
secrets search -n refining --summary --limit 10 --offset 10
|
|
||||||
|
|
||||||
# 管道 / AI 调用（默认 json，直接可解析）
|
|
||||||
secrets search -n refining --kind service | jq '.[].name'
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### add — 新增或全量覆盖（upsert）
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明（带典型值）
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name gitea | i-example0abcd1234efgh
|
|
||||||
# --tag aliyun | hongkong（可重复）
|
|
||||||
# -m / --meta ip=10.0.0.1 | desc="ECS" | url=https://... | tls:cert@./cert.pem（可重复）
|
|
||||||
# -s / --secret token=<value> | ssh_key=@./key.pem | password=secret123 | credentials:content@./key.pem（可重复）
|
|
||||||
|
|
||||||
# 添加服务器
|
|
||||||
secrets add -n refining --kind server --name i-example0abcd1234efgh \
|
|
||||||
--tag aliyun --tag shanghai \
|
|
||||||
-m ip=10.0.0.1 -m desc="Aliyun Shanghai ECS" \
|
|
||||||
-s username=root -s ssh_key=@./keys/deploy-key.pem
|
|
||||||
|
|
||||||
# 添加服务凭据
|
|
||||||
secrets add -n refining --kind service --name gitea \
|
|
||||||
--tag gitea \
|
|
||||||
-m url=https://code.example.com -m default_org=refining -m username=voson \
|
|
||||||
-s token=<token> -s runner_token=<runner_token>
|
|
||||||
|
|
||||||
# 从文件读取 token
|
|
||||||
secrets add -n ricnsmart --kind service --name mqtt \
|
|
||||||
-m host=mqtt.example.com -m port=1883 \
|
|
||||||
-s password=@./mqtt_password.txt
|
|
||||||
|
|
||||||
# 多行文件直接写入嵌套 secret 字段
|
|
||||||
secrets add -n refining --kind server --name i-example0abcd1234efgh \
|
|
||||||
-s credentials:content@./keys/deploy-key.pem
|
|
||||||
|
|
||||||
# 使用类型化值（key:=<json>）存储非字符串类型
|
|
||||||
secrets add -n refining --kind service --name prometheus \
|
|
||||||
-m scrape_interval:=15 \
|
|
||||||
-m enabled:=true \
|
|
||||||
-m labels:='["prod","metrics"]' \
|
|
||||||
-s api_key=abc123
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### update — 增量更新（记录必须已存在）
|
|
||||||
|
|
||||||
只有传入的字段才会变动，其余全部保留。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明（带典型值）
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name gitea | i-example0abcd1234efgh
|
|
||||||
# --add-tag production | backup（不影响已有 tag，可重复）
|
|
||||||
# --remove-tag staging | deprecated（可重复）
|
|
||||||
# -m / --meta ip=10.0.0.1 | desc="新描述" | credentials:username=root（新增或覆盖，可重复）
|
|
||||||
# --remove-meta old_port | legacy_key | credentials:content（删除 metadata 字段，可重复）
|
|
||||||
# -s / --secret token=<new> | ssh_key=@./new.pem | credentials:content@./new.pem（新增或覆盖，可重复）
|
|
||||||
# --remove-secret old_password | deprecated_key | credentials:content（删除 secret 字段，可重复）
|
|
||||||
|
|
||||||
# 更新单个 metadata 字段
|
|
||||||
secrets update -n refining --kind server --name i-example0abcd1234efgh \
|
|
||||||
-m ip=10.0.0.1
|
|
||||||
|
|
||||||
# 轮换 token
|
|
||||||
secrets update -n refining --kind service --name gitea \
|
|
||||||
-s token=<new-token>
|
|
||||||
|
|
||||||
# 新增 tag 并轮换 token
|
|
||||||
secrets update -n refining --kind service --name gitea \
|
|
||||||
--add-tag production \
|
|
||||||
-s token=<new-token>
|
|
||||||
|
|
||||||
# 移除废弃字段
|
|
||||||
secrets update -n refining --kind service --name mqtt \
|
|
||||||
--remove-meta old_port --remove-secret old_password
|
|
||||||
|
|
||||||
# 从文件更新嵌套 secret 字段
|
|
||||||
secrets update -n refining --kind server --name i-example0abcd1234efgh \
|
|
||||||
-s credentials:content@./keys/deploy-key.pem
|
|
||||||
|
|
||||||
# 删除嵌套字段
|
|
||||||
secrets update -n refining --kind server --name i-example0abcd1234efgh \
|
|
||||||
--remove-secret credentials:content
|
|
||||||
|
|
||||||
# 移除 tag
|
|
||||||
secrets update -n refining --kind service --name gitea --remove-tag staging
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### delete — 删除记录（支持单条精确删除与批量删除）
|
|
||||||
|
|
||||||
删除时会自动将 entry 与所有关联 secret 字段快照到历史表，并写入审计日志，可通过 `rollback` 命令恢复。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明（带典型值）
|
|
||||||
# -n / --namespace refining | ricnsmart（必填）
|
|
||||||
# --kind server | service（指定 --name 时必填；批量时可选）
|
|
||||||
# --name gitea | i-example0abcd1234efgh（精确匹配；省略则批量删除）
|
|
||||||
# --dry-run 预览将删除的记录，不实际写入（仅批量模式有效）
|
|
||||||
# -o / --output text | json | json-compact
|
|
||||||
|
|
||||||
# 精确删除单条记录（--kind 必填）
|
|
||||||
secrets delete -n refining --kind service --name legacy-mqtt
|
|
||||||
secrets delete -n ricnsmart --kind server --name i-old-server-id
|
|
||||||
|
|
||||||
# 预览批量删除（不写入数据库）
|
|
||||||
secrets delete -n refining --dry-run
|
|
||||||
secrets delete -n ricnsmart --kind server --dry-run
|
|
||||||
|
|
||||||
# 批量删除整个 namespace 的所有记录
|
|
||||||
secrets delete -n ricnsmart
|
|
||||||
|
|
||||||
# 批量删除 namespace 下指定 kind 的所有记录
|
|
||||||
secrets delete -n ricnsmart --kind server
|
|
||||||
|
|
||||||
# JSON 输出
|
|
||||||
secrets delete -n refining --kind service -o json
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### history — 查看变更历史
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name 记录名
|
|
||||||
# --limit 返回条数（默认 20）
|
|
||||||
|
|
||||||
# 查看某条记录的历史版本列表
|
|
||||||
secrets history -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# 查最近 5 条
|
|
||||||
secrets history -n refining --kind service --name gitea --limit 5
|
|
||||||
|
|
||||||
# JSON 输出
|
|
||||||
secrets history -n refining --kind service --name gitea -o json
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### rollback — 回滚到指定版本
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name 记录名
|
|
||||||
# --to-version <N> 目标版本号（省略则恢复最近一次快照）
|
|
||||||
|
|
||||||
# 撤销上次修改（回滚到最近一次快照）
|
|
||||||
secrets rollback -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# 回滚到版本 3
|
|
||||||
secrets rollback -n refining --kind service --name gitea --to-version 3
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### run — 向子进程注入 secrets 并执行命令
|
|
||||||
|
|
||||||
仅注入 secrets 表中的加密字段（解密后），不含 metadata。secrets 仅作用于子进程环境，不修改当前 shell，进程退出码透传。
|
|
||||||
|
|
||||||
使用 `-s/--secret` 指定只注入哪些字段（最小权限原则）；使用 `--dry-run` 预览将注入哪些变量名及来源，不执行命令。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name 记录名
|
|
||||||
# --tag 按 tag 过滤（可重复）
|
|
||||||
# -s / --secret 只注入指定字段名（可重复；省略则注入全部）
|
|
||||||
# --prefix 变量名前缀
|
|
||||||
# --dry-run 预览变量映射，不执行命令
|
|
||||||
# -o / --output json（默认）| json-compact | text
|
|
||||||
# -- <command> 执行的命令及参数（--dry-run 时可省略）
|
|
||||||
|
|
||||||
# 注入全部 secrets 到脚本
|
|
||||||
secrets run -n refining --kind service --name gitea -- ./deploy.sh
|
|
||||||
|
|
||||||
# 只注入特定字段（最小化注入范围）
|
|
||||||
secrets run -n refining --kind service --name aliyun \
|
|
||||||
-s access_key_id -s access_key_secret -- aliyun ecs DescribeInstances
|
|
||||||
|
|
||||||
# 按 tag 批量注入（多条记录合并）
|
|
||||||
secrets run --tag production -- env | grep -i token
|
|
||||||
|
|
||||||
# 预览将注入哪些变量（不执行命令，默认 JSON 输出）
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run
|
|
||||||
|
|
||||||
# 配合字段过滤预览
|
|
||||||
secrets run -n refining --kind service --name gitea -s token --dry-run
|
|
||||||
|
|
||||||
# text 模式预览（人类阅读）
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run -o text
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### upgrade — 自动更新 CLI 二进制
|
|
||||||
|
|
||||||
从 Release 服务器下载最新版本，校验对应 `.sha256` 摘要后替换当前二进制，无需数据库连接或主密钥。
|
|
||||||
|
|
||||||
**配置方式**：`SECRETS_UPGRADE_URL` 必填。优先用**构建时**：`SECRETS_UPGRADE_URL=https://... cargo build`，CI 已自动注入。或**运行时**：写在 `.env` 或 `export` 后执行。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 检查是否有新版本（不下载）
|
|
||||||
secrets upgrade --check
|
|
||||||
|
|
||||||
# 下载、校验 SHA-256 并安装最新版本
|
|
||||||
secrets upgrade
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### export — 批量导出记录
|
|
||||||
|
|
||||||
将匹配的记录（含解密后的明文 secrets）导出到文件或 stdout。支持 JSON、TOML、YAML 三种格式，文件格式由扩展名自动推断。使用 `--no-secrets` 时无需主密钥。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明
|
|
||||||
# -n / --namespace refining | ricnsmart
|
|
||||||
# --kind server | service
|
|
||||||
# --name gitea | i-example0abcd1234efgh
|
|
||||||
# --tag aliyun | production（可重复）
|
|
||||||
# -q / --query 模糊关键词
|
|
||||||
# --file <path> 输出文件路径，格式由扩展名推断（.json / .toml / .yaml / .yml）
|
|
||||||
# --format json | toml | yaml 显式指定格式（输出到 stdout 时必须指定）
|
|
||||||
# --no-secrets 不导出 secrets，无需主密钥
|
|
||||||
|
|
||||||
# 全量导出到 JSON 文件
|
|
||||||
secrets export --file backup.json
|
|
||||||
|
|
||||||
# 按 namespace 导出为 TOML
|
|
||||||
secrets export -n refining --file refining.toml
|
|
||||||
|
|
||||||
# 按 kind 导出为 YAML
|
|
||||||
secrets export -n refining --kind service --file services.yaml
|
|
||||||
|
|
||||||
# 按 tag 过滤导出
|
|
||||||
secrets export --tag production --file prod.json
|
|
||||||
|
|
||||||
# 模糊关键词导出
|
|
||||||
secrets export -q mqtt --file mqtt.json
|
|
||||||
|
|
||||||
# 仅导出 schema（不含 secrets，无需主密钥）
|
|
||||||
secrets export --no-secrets --file schema.json
|
|
||||||
|
|
||||||
# 输出到 stdout（必须指定 --format）
|
|
||||||
secrets export -n refining --format yaml
|
|
||||||
secrets export --format json | jq '.'
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### import — 批量导入记录
|
|
||||||
|
|
||||||
从导出文件读取记录并写入数据库，自动重新加密 secrets。支持 JSON、TOML、YAML 三种格式，文件格式由扩展名自动推断。
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 参数说明
|
|
||||||
# <file> 必选，输入文件路径（格式由扩展名推断）
|
|
||||||
# --force 冲突时覆盖已有记录（默认：报错并停止）
|
|
||||||
# --dry-run 预览将执行的操作，不写入数据库
|
|
||||||
# -o / --output text | json | json-compact
|
|
||||||
|
|
||||||
# 导入 JSON 文件（遇到已存在记录报错）
|
|
||||||
secrets import backup.json
|
|
||||||
|
|
||||||
# 导入 TOML 文件，冲突时覆盖
|
|
||||||
secrets import --force refining.toml
|
|
||||||
|
|
||||||
# 导入 YAML 文件，冲突时覆盖
|
|
||||||
secrets import --force services.yaml
|
|
||||||
|
|
||||||
# 预览将执行的操作（不写入）
|
|
||||||
secrets import --dry-run backup.json
|
|
||||||
|
|
||||||
# JSON 格式输出导入摘要
|
|
||||||
secrets import backup.json -o json
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### config — 配置管理（无需主密钥）
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 设置数据库连接（每台设备执行一次，之后永久生效；先验证连接可用再写入）
|
|
||||||
secrets config set-db "postgres://postgres:<password>@<host>:<port>/secrets"
|
|
||||||
|
|
||||||
# 查看当前配置（密码脱敏）
|
|
||||||
secrets config show
|
|
||||||
|
|
||||||
# 打印配置文件路径
|
|
||||||
secrets config path
|
|
||||||
# 输出: /Users/<user>/.config/secrets/config.toml
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
### 全局参数
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# debug 日志（位于子命令之前）
|
|
||||||
secrets --verbose search -q mqtt
|
|
||||||
secrets -v add -n refining --kind service --name gitea -m url=xxx -s token=yyy
|
|
||||||
|
|
||||||
# 或通过环境变量精细控制
|
|
||||||
RUST_LOG=secrets=trace secrets search
|
|
||||||
|
|
||||||
# 一次性覆盖数据库连接
|
|
||||||
secrets --db-url "postgres://..." search -n refining
|
|
||||||
```
|
|
||||||
|
|
||||||
## 代码规范
|
## 代码规范
|
||||||
|
|
||||||
- 错误处理：统一使用 `anyhow::Result`，不用 `unwrap()`
|
- 错误：业务层 `anyhow::Result`，避免生产路径 `unwrap()`。
|
||||||
- 异步：全程 `tokio`，数据库操作 `sqlx` async
|
- 异步：`tokio` + `sqlx` async。
|
||||||
- SQL：使用 `sqlx::query` / `sqlx::query_as` 绑定参数，禁止字符串拼接（搜索的动态 WHERE 子句除外，需使用参数绑定 `$1/$2`）
|
- SQL：`sqlx::query` / `query_as` 参数绑定；动态 WHERE 仍须用占位符绑定。
|
||||||
- 新增 `kind` 类型时：只需在 `add` 调用时传入，无需改代码
|
- 日志：运维用 `tracing`；面向用户的 Web 响应走 axum handler。
|
||||||
- 字段命名：CLI 短标志 `-n`=namespace，`-m`=meta，`-s`=secret，`-q`=query，`-v`=verbose，`-f`=field，`-o`=output
|
- 审计：写操作成功后尽量 `audit::log_tx`；失败可 `warn`，不掩盖主错误。
|
||||||
- 日志：用户可见输出用 `println!`；调试/运维信息用 `tracing::debug!`/`info!`/`warn!`/`error!`
|
- 加密：密钥由用户密码短语通过 **PBKDF2-SHA256（600k 次）** 在客户端派生，服务端只存 `key_salt`/`key_check`/`key_params`，不持有原始密钥。Web 客户端在浏览器本地完成加解密；MCP 客户端通过 `X-Encryption-Key` 请求头传递密钥，服务端临时解密后返回明文。
|
||||||
- 审计：`add`/`update`/`delete` 成功后调用 `audit::log_tx`，写入 `audit_log` 表；失败只 warn 不中断
|
- MCP：tools 参数与 JSON Schema（`schemars`）保持同步，鉴权以请求扩展中的用户上下文为准。
|
||||||
- 加密：`encrypted` 列存储 AES-256-GCM 密文；`add`/`update`/`search`/`delete` 需主密钥（`secrets init` 后从 OS 钥匙串加载）
|
|
||||||
- 输出：读命令通过 `OutputMode` 支持 text/json/json-compact；默认始终 `json`（pretty），`-o text` 供人类阅读；写命令 `add` 同样支持 `-o json`
|
|
||||||
|
|
||||||
## 提交前检查（必须全部通过）
|
## 提交前检查
|
||||||
|
|
||||||
每次提交代码前，请在本地依次执行以下检查，**全部通过后再 push**：
|
|
||||||
|
|
||||||
优先使用：
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
./scripts/release-check.sh
|
./scripts/release-check.sh
|
||||||
```
|
```
|
||||||
|
|
||||||
它等价于先检查版本号 / tag，再执行下面的格式、Lint、测试。
|
或手动：
|
||||||
|
|
||||||
### 1. 版本号（按需）
|
|
||||||
|
|
||||||
若本次改动需要发版，请先确认 `Cargo.toml` 中的 `version` 已提升，避免 CI 打出的 Tag 与已有版本重复。**升级版本后需同时更新 `Cargo.lock`**（运行 `cargo build` 即可自动同步），否则 CI 中 `cargo clippy --locked` 会因 lock 与 manifest 不一致而失败。可通过 git tag 判断：
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# 查看当前 Cargo.toml 版本
|
cargo fmt -- --check
|
||||||
grep '^version' Cargo.toml
|
cargo clippy --locked -- -D warnings
|
||||||
|
cargo test --locked
|
||||||
# 查看是否已存在该版本对应的 tag（CI 使用格式 secrets-<version>）
|
|
||||||
git tag -l 'secrets-*'
|
|
||||||
```
|
```
|
||||||
|
|
||||||
若当前版本已被 tag（例如已有 `secrets-0.3.0` 且 `Cargo.toml` 仍为 `0.3.0`），则应在 `Cargo.toml` 中 bump 版本号，再执行 `cargo build` 同步 `Cargo.lock`，最后一并提交，以便 CI 自动打新 Tag 并发布 Release。
|
发版前确认未重复 tag：
|
||||||
|
|
||||||
### 2. 格式、Lint、测试
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cargo fmt -- --check # 格式检查（不通过则运行 cargo fmt 修复）
|
grep '^version' crates/secrets-mcp/Cargo.toml
|
||||||
cargo clippy -- -D warnings # Lint 检查（消除所有 warning）
|
git tag -l 'secrets-mcp-*'
|
||||||
cargo test # 单元/集成测试
|
|
||||||
```
|
|
||||||
|
|
||||||
或一次性执行：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cargo fmt -- --check && cargo clippy -- -D warnings && cargo test
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## CI/CD
|
## CI/CD
|
||||||
|
|
||||||
- Gitea Actions（runners: debian / darwin-arm64 / windows）
|
- **触发**：`main` / `feat/mcp`（以仓库 workflow 为准）；路径含 `crates/**`、`deploy/**`、`Cargo.toml`、`Cargo.lock`。
|
||||||
- 触发：`src/**`、`Cargo.toml`、`Cargo.lock` 变更推送到 main
|
- **构建**：`x86_64-unknown-linux-musl` → `secrets-mcp`。
|
||||||
- 构建目标：`x86_64-unknown-linux-musl`、`aarch64-apple-darwin`、`x86_64-apple-darwin`（由 ARM mac runner 交叉编译）、`x86_64-pc-windows-msvc`
|
- **Release**：tag `secrets-mcp-<version>`，上传 tar.gz + `.sha256`。
|
||||||
- 新版本自动打 Tag（格式 `secrets-<version>`）并上传二进制与对应 `.sha256` 摘要到 Gitea Release
|
- **部署**：可选在仓库 Actions 中配置 `vars.DEPLOY_HOST`、`vars.DEPLOY_USER` 与 `secrets.DEPLOY_SSH_KEY`（勿写进 workflow）；可用 `scripts/setup-gitea-actions.sh` 调 Gitea API 写入。Actions **secrets 须为原始值**（如 PEM 全文、PAT 明文），**不要**先 base64 再写入，否则工作流内无法识别（例如 SSH 私钥无效）。**勿**在 CI 中保存 `GOOGLE_CLIENT_SECRET`、DB 密码。
|
||||||
- Release 仅在 Linux/macOS/Windows 构建全部成功后才会从 draft 发布
|
- **通知**：`vars.WEBHOOK_URL`（可选）。
|
||||||
- 通知：飞书 Webhook（`vars.WEBHOOK_URL`）
|
|
||||||
- 所需 secrets/vars：`RELEASE_TOKEN`（Release 上传，Gitea PAT）、`vars.WEBHOOK_URL`（通知，可选）
|
|
||||||
- **注意**：Gitea Actions 的 Secret/Variable 创建时，`data`/`value` 字段需传入**原始值**，不要使用 base64 编码
|
|
||||||
|
|
||||||
## 环境变量
|
## 环境变量（secrets-mcp）
|
||||||
|
|
||||||
| 变量 | 说明 |
|
| 变量 | 说明 |
|
||||||
|------|------|
|
|------|------|
|
||||||
| `RUST_LOG` | 日志级别，如 `secrets=debug`、`secrets=trace`（默认 warn） |
|
| `SECRETS_DATABASE_URL` | **必填**。PostgreSQL URL。 |
|
||||||
| `USER` | 审计日志 actor 字段来源，Shell 自动设置，通常无需手动配置 |
|
| `BASE_URL` | 对外基址；OAuth 回调 `${BASE_URL}/auth/google/callback`。 |
|
||||||
| `SECRETS_UPGRADE_URL` | upgrade 的 Release API 地址。构建时（cargo build）或运行时（.env/export） |
|
| `SECRETS_MCP_BIND` | 监听地址，默认 `0.0.0.0:9315`。 |
|
||||||
|
| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | 可选；仅运行时配置。 |
|
||||||
|
| `RUST_LOG` | 如 `secrets_mcp=debug`。 |
|
||||||
|
| `USER` | 若写入审计 `actor`，由运行环境提供。 |
|
||||||
|
|
||||||
数据库连接通过 `secrets config set-db` 持久化到 `~/.config/secrets/config.toml`，不支持环境变量。
|
> `SERVER_MASTER_KEY` 已不再需要。新架构下密钥由用户密码短语在客户端派生，服务端不持有。
|
||||||
|
|||||||
956
Cargo.lock
generated
956
Cargo.lock
generated
File diff suppressed because it is too large
Load Diff
55
Cargo.toml
55
Cargo.toml
@@ -1,33 +1,38 @@
|
|||||||
[package]
|
[workspace]
|
||||||
name = "secrets"
|
members = [
|
||||||
version = "0.9.6"
|
"crates/secrets-core",
|
||||||
|
"crates/secrets-mcp",
|
||||||
|
]
|
||||||
|
resolver = "2"
|
||||||
|
|
||||||
|
[workspace.package]
|
||||||
edition = "2024"
|
edition = "2024"
|
||||||
|
|
||||||
[dependencies]
|
[workspace.dependencies]
|
||||||
aes-gcm = "^0.10.3"
|
# Async runtime
|
||||||
anyhow = "^1.0.102"
|
tokio = { version = "^1.50.0", features = ["rt-multi-thread", "macros", "fs", "io-util", "process", "signal"] }
|
||||||
argon2 = { version = "^0.5.3", features = ["std"] }
|
|
||||||
chrono = { version = "^0.4.44", features = ["serde"] }
|
# Database
|
||||||
clap = { version = "^4.6.0", features = ["derive"] }
|
sqlx = { version = "^0.8.6", features = ["runtime-tokio", "tls-rustls", "postgres", "uuid", "json", "chrono"] }
|
||||||
dirs = "^6.0.0"
|
|
||||||
dotenvy = "^0.15"
|
# Serialization
|
||||||
flate2 = "^1.1.9"
|
|
||||||
keyring = { version = "^3.6.3", features = ["apple-native", "windows-native", "linux-native"] }
|
|
||||||
rand = "^0.10.0"
|
|
||||||
reqwest = { version = "^0.12", default-features = false, features = ["rustls-tls", "json"] }
|
|
||||||
rpassword = "^7.4.0"
|
|
||||||
self-replace = "^1.5.0"
|
|
||||||
semver = "^1.0.27"
|
|
||||||
serde = { version = "^1.0.228", features = ["derive"] }
|
serde = { version = "^1.0.228", features = ["derive"] }
|
||||||
serde_json = "^1.0.149"
|
serde_json = "^1.0.149"
|
||||||
serde_yaml = "^0.9"
|
serde_yaml = "^0.9"
|
||||||
sha2 = "^0.10.9"
|
|
||||||
sqlx = { version = "^0.8.6", features = ["runtime-tokio", "tls-rustls", "postgres", "uuid", "json", "chrono"] }
|
|
||||||
tar = "^0.4.44"
|
|
||||||
tempfile = "^3.19"
|
|
||||||
tokio = { version = "^1.50.0", features = ["rt-multi-thread", "macros", "fs", "io-util", "process", "signal"] }
|
|
||||||
toml = "^1.0.7"
|
toml = "^1.0.7"
|
||||||
|
|
||||||
|
# Crypto
|
||||||
|
aes-gcm = "^0.10.3"
|
||||||
|
sha2 = "^0.10.9"
|
||||||
|
rand = "^0.10.0"
|
||||||
|
|
||||||
|
# Utils
|
||||||
|
anyhow = "^1.0.102"
|
||||||
|
chrono = { version = "^0.4.44", features = ["serde"] }
|
||||||
|
uuid = { version = "^1.22.0", features = ["serde"] }
|
||||||
tracing = "^0.1"
|
tracing = "^0.1"
|
||||||
tracing-subscriber = { version = "^0.3", features = ["env-filter"] }
|
tracing-subscriber = { version = "^0.3", features = ["env-filter"] }
|
||||||
uuid = { version = "^1.22.0", features = ["serde"] }
|
dotenvy = "^0.15"
|
||||||
zip = { version = "^8.2.0", default-features = false, features = ["deflate"] }
|
|
||||||
|
# HTTP
|
||||||
|
reqwest = { version = "^0.12", default-features = false, features = ["rustls-tls", "json"] }
|
||||||
|
|||||||
401
README.md
401
README.md
@@ -1,308 +1,149 @@
|
|||||||
# secrets
|
# secrets-mcp
|
||||||
|
|
||||||
跨设备密钥与配置管理 CLI，基于 Rust + PostgreSQL 18。
|
Workspace：**`secrets-core`** + **`secrets-mcp`**（HTTP Streamable MCP + Web）。多租户密钥与元数据存 PostgreSQL；用户通过 **Google OAuth** 登录，**API Key** 鉴权 MCP 请求；秘密数据用**用户密码短语派生的密钥**在客户端加密，服务端不持有原始密钥。
|
||||||
|
|
||||||
将服务器信息、服务凭据统一存入数据库，供本地工具和 AI 读取上下文。每个敏感字段单独行存储（`secrets` 子表），字段名、类型、长度以明文保存便于 AI 理解，仅值本身使用 AES-256-GCM 加密；主密钥由 Argon2id 从主密码派生并存入系统钥匙串。
|
|
||||||
|
|
||||||
## 安装
|
## 安装
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cargo build --release
|
cargo build --release -p secrets-mcp
|
||||||
# 或从 Release 页面下载预编译二进制
|
# 产物: target/release/secrets-mcp
|
||||||
```
|
```
|
||||||
|
|
||||||
已有旧版本时，可执行 `secrets upgrade` 自动下载最新版并替换。该命令会校验 Release 附带的 `.sha256` 摘要后再安装。
|
发版产物见 Gitea Release（tag：`secrets-mcp-<version>`，Linux musl 预编译）；其它平台本地 `cargo build`。
|
||||||
|
|
||||||
## 首次使用（每台设备各执行一次）
|
## 环境变量与本地运行
|
||||||
|
|
||||||
|
复制 `deploy/.env.example` 为项目根目录 `.env`（已在 `.gitignore`），或导出同名变量：
|
||||||
|
|
||||||
|
| 变量 | 说明 |
|
||||||
|
|------|------|
|
||||||
|
| `SECRETS_DATABASE_URL` | **必填**。PostgreSQL 连接串（建议专用库，如 `secrets-mcp`）。 |
|
||||||
|
| `BASE_URL` | 对外访问基址；OAuth 回调为 `{BASE_URL}/auth/google/callback`。默认 `http://localhost:9315`。 |
|
||||||
|
| `SECRETS_MCP_BIND` | 监听地址，默认 `0.0.0.0:9315`。反代时常为 `127.0.0.1:9315`。 |
|
||||||
|
| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | 可选；不配置则无 Google 登录入口。运行时从环境读取，勿写入 CI、勿打入二进制。 |
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# 1. 配置数据库连接（会先验证连接可用再写入）
|
cargo run -p secrets-mcp
|
||||||
secrets config set-db "postgres://postgres:<password>@<host>:<port>/secrets"
|
|
||||||
|
|
||||||
# 2. 初始化主密钥（提示输入至少 8 位的主密码，派生后存入 OS 钥匙串）
|
|
||||||
secrets init
|
|
||||||
```
|
```
|
||||||
|
|
||||||
主密码不会存储，仅用于派生主密钥，且至少需 8 位。同一主密码在所有设备上会得到相同主密钥（salt 存于数据库，首台设备生成后共享）。
|
- **Web**：`BASE_URL`（登录、Dashboard、设置密码短语、创建 API Key）。
|
||||||
|
- **MCP**：Streamable HTTP 基址 `{BASE_URL}/mcp`，需 `Authorization: Bearer <api_key>` + `X-Encryption-Key: <hex>` 请求头。
|
||||||
|
|
||||||
**主密钥存储**：macOS → Keychain；Windows → Credential Manager；Linux → keyutils（会话级，重启后需再次 `secrets init`）。
|
## 加密架构（混合 E2EE）
|
||||||
|
|
||||||
**从旧版（明文存储）升级**：升级后首次运行需执行 `secrets init` 即可（明文记录需手动重新 add 或通过 update 更新）。
|
### 密钥派生
|
||||||
|
|
||||||
## AI Agent 快速指南
|
用户在 Web Dashboard 设置**密码短语**，浏览器使用 **Web Crypto API（PBKDF2-SHA256，600k 次迭代）**在本地派生 256-bit AES 密钥。
|
||||||
|
|
||||||
这个 CLI 以 AI 使用优先设计。核心路径只有一条：**读取用 `search`，写入用 `add` / `update`**。
|
- **Salt（32B）**：首次设置时在浏览器生成，存入服务端 `users.key_salt`
|
||||||
|
- **key_check**：派生密钥加密已知常量 `"secrets-mcp-key-check"`，存入 `users.key_check`，用于登录时验证密码短语
|
||||||
|
- **服务端不存储原始密钥**，只存 salt + key_check
|
||||||
|
|
||||||
### 第一步：发现有哪些数据
|
跨设备同步：新设备登录 → 输入相同密码短语 → 从服务端取 salt → 同样的 PBKDF2 → 得到相同密钥。
|
||||||
|
|
||||||
```bash
|
### 写入与读取流程
|
||||||
# 列出所有记录摘要（默认最多 50 条，安全起步）
|
|
||||||
secrets search --summary --limit 20
|
|
||||||
|
|
||||||
# 按 namespace 过滤
|
```mermaid
|
||||||
secrets search -n refining --summary --limit 20
|
flowchart LR
|
||||||
|
subgraph Web["Web 浏览器（E2E）"]
|
||||||
|
P["密码短语"] --> K["PBKDF2 → 256-bit key"]
|
||||||
|
K --> Enc["AES-256-GCM 加密"]
|
||||||
|
K --> Dec["AES-256-GCM 解密"]
|
||||||
|
end
|
||||||
|
|
||||||
# 按最近更新排序
|
subgraph AI["AI 客户端（MCP）"]
|
||||||
secrets search --sort updated --limit 10 --summary
|
HdrKey["X-Encryption-Key: hex"]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Server["secrets-mcp 服务端"]
|
||||||
|
Middleware["请求中临时持有 key\n请求结束即丢弃"]
|
||||||
|
DB[(PostgreSQL\nsecrets.encrypted = 密文\nentries.metadata = 明文)]
|
||||||
|
end
|
||||||
|
|
||||||
|
Enc -->|密文| Server
|
||||||
|
HdrKey -->|key + 请求| Middleware
|
||||||
|
Middleware <-->|加解密| DB
|
||||||
|
DB -->|密文| Dec
|
||||||
```
|
```
|
||||||
|
|
||||||
`--summary` 只返回轻量字段（namespace、kind、name、tags、desc、updated_at），不含完整 metadata 和 secrets。
|
### 两种客户端对比
|
||||||
|
|
||||||
### 第二步：精确读取单条记录
|
| | Web 浏览器 | AI 客户端（MCP） |
|
||||||
|
|---|---|---|
|
||||||
|
| 密钥位置 | 仅在浏览器内存 / sessionStorage | MCP 配置 headers 中 |
|
||||||
|
| 加解密位置 | 客户端（真正 E2E） | 服务端临时（请求级生命周期） |
|
||||||
|
| 安全边界 | 服务端零知识 | 依赖 TLS + 服务端内存隔离 |
|
||||||
|
|
||||||
```bash
|
### 敏感数据传输
|
||||||
# 精确定位（namespace + kind + name 三元组）
|
|
||||||
secrets search -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# 获取完整记录（含 secrets 字段名，无需 master_key）
|
- **OAuth `client_secret`** 只存服务端环境变量，不发给浏览器
|
||||||
secrets search -n refining --kind service --name gitea -o json
|
- **API Key** 创建时原始 key 仅展示一次，库中只存 SHA-256 哈希
|
||||||
|
- **X-Encryption-Key** 随 MCP 请求经 TLS 传输，服务端仅在请求处理期间持有（不持久化）
|
||||||
|
- **生产环境必须走 HTTPS/TLS**
|
||||||
|
|
||||||
# 直接提取单个 metadata 字段值（最短路径）
|
## AI 客户端配置
|
||||||
secrets search -n refining --kind service --name gitea -f metadata.url
|
|
||||||
|
|
||||||
# 同时提取多个 metadata 字段
|
在 Web Dashboard 设置密码短语后，解锁页面会按客户端格式生成配置。常见客户端示例如下：
|
||||||
secrets search -n refining --kind service --name gitea \
|
|
||||||
-f metadata.url -f metadata.default_org
|
|
||||||
|
|
||||||
# 需要 secrets 时，改用 run（只注入 token 字段到子进程）
|
`Cursor / Claude Desktop` 风格：
|
||||||
secrets run -n refining --kind service --name gitea -s token -- ./deploy.sh
|
|
||||||
|
|
||||||
# 预览 run 会注入哪些变量（不执行命令）
|
```json
|
||||||
secrets run -n refining --kind service --name gitea --dry-run
|
{
|
||||||
|
"mcpServers": {
|
||||||
|
"secrets": {
|
||||||
|
"url": "https://secrets.example.com/mcp",
|
||||||
|
"headers": {
|
||||||
|
"Authorization": "Bearer sk_abc123...",
|
||||||
|
"X-Encryption-Key": "a1b2c3...（64位hex）"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
`search` 展示 metadata 与 secrets 的字段名，不展示 secret 值本身；需要 secret 值时用 `run`（仅注入加密字段到子进程，不含 metadata）。用 `-s` 指定只注入特定字段，最小化注入范围。
|
`OpenCode` 风格：
|
||||||
|
|
||||||
### 输出格式
|
```json
|
||||||
|
{
|
||||||
| 场景 | 推荐命令 |
|
"mcp": {
|
||||||
|------|----------|
|
"secrets": {
|
||||||
| AI 解析 / 管道处理（默认） | json（pretty-printed） |
|
"type": "remote",
|
||||||
| 管道紧凑格式 | `-o json-compact` |
|
"enabled": true,
|
||||||
| 注入 secrets 到子进程环境 | `run` |
|
"url": "https://secrets.example.com/mcp",
|
||||||
| 人类查看 | `-o text` |
|
"headers": {
|
||||||
|
"Authorization": "Bearer sk_abc123...",
|
||||||
默认始终输出 JSON，无论是 TTY 还是管道。`text` 输出中时间按本地时区显示；`json/json-compact` 使用 UTC（RFC3339）。
|
"X-Encryption-Key": "a1b2c3...（64位hex）"
|
||||||
|
}
|
||||||
```bash
|
}
|
||||||
# 默认 JSON 输出，直接可 jq 解析
|
}
|
||||||
secrets search -n refining --kind service | jq '.[].name'
|
}
|
||||||
|
|
||||||
# 需要 secrets 时，使用 run（-s 指定只注入特定字段）
|
|
||||||
secrets run -n refining --kind service --name gitea -s token -- ./deploy.sh
|
|
||||||
|
|
||||||
# 预览 run 会注入哪些变量（不执行命令）
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run
|
|
||||||
```
|
|
||||||
|
|
||||||
## 完整命令参考
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 查看帮助（包含各子命令 EXAMPLES）
|
|
||||||
secrets --help
|
|
||||||
secrets init --help # 主密钥初始化
|
|
||||||
secrets search --help
|
|
||||||
secrets add --help
|
|
||||||
secrets update --help
|
|
||||||
secrets delete --help
|
|
||||||
secrets config --help
|
|
||||||
secrets upgrade --help # 检查并更新 CLI 版本
|
|
||||||
secrets export --help # 批量导出（JSON/TOML/YAML）
|
|
||||||
secrets import --help # 批量导入（JSON/TOML/YAML）
|
|
||||||
|
|
||||||
# ── search ──────────────────────────────────────────────────────────────────
|
|
||||||
secrets search --summary --limit 20 # 发现概览
|
|
||||||
secrets search -n refining --kind service # 按 namespace + kind
|
|
||||||
secrets search -n refining --kind service --name gitea # 精确查找
|
|
||||||
secrets search -q mqtt # 关键词模糊搜索
|
|
||||||
secrets search --tag hongkong # 按 tag 过滤
|
|
||||||
secrets search -n refining --kind service --name gitea -f metadata.url # 提取 metadata 字段
|
|
||||||
secrets search -n refining --kind service --name gitea -o json # 完整记录（含 secrets schema）
|
|
||||||
secrets search --sort updated --limit 10 --summary # 最近改动
|
|
||||||
secrets search -n refining --summary --limit 10 --offset 10 # 翻页
|
|
||||||
|
|
||||||
# ── add ──────────────────────────────────────────────────────────────────────
|
|
||||||
secrets add -n refining --kind server --name my-server \
|
|
||||||
--tag aliyun --tag shanghai \
|
|
||||||
-m ip=10.0.0.1 -m desc="Example ECS" \
|
|
||||||
-s username=root -s ssh_key=@./keys/server.pem
|
|
||||||
|
|
||||||
# 多行文件直接写入嵌套 secret 字段
|
|
||||||
secrets add -n refining --kind server --name my-server \
|
|
||||||
-s credentials:content@./keys/server.pem
|
|
||||||
|
|
||||||
# 使用 typed JSON 写入 secret（布尔、数字、数组、对象）
|
|
||||||
secrets add -n refining --kind service --name deploy-bot \
|
|
||||||
-s enabled:=true \
|
|
||||||
-s retry_count:=3 \
|
|
||||||
-s scopes:='["repo","workflow"]' \
|
|
||||||
-s extra:='{"region":"ap-east-1","verify_tls":true}'
|
|
||||||
|
|
||||||
secrets add -n refining --kind service --name gitea \
|
|
||||||
--tag gitea \
|
|
||||||
-m url=https://code.example.com -m default_org=myorg \
|
|
||||||
-s token=<token>
|
|
||||||
|
|
||||||
# ── update ───────────────────────────────────────────────────────────────────
|
|
||||||
secrets update -n refining --kind server --name my-server -m ip=10.0.0.1
|
|
||||||
secrets update -n refining --kind service --name gitea --add-tag production -s token=<new>
|
|
||||||
secrets update -n refining --kind service --name mqtt --remove-meta old_port --remove-secret old_key
|
|
||||||
secrets update -n refining --kind server --name my-server --remove-secret credentials:content
|
|
||||||
|
|
||||||
# ── delete ───────────────────────────────────────────────────────────────────
|
|
||||||
secrets delete -n refining --kind service --name legacy-mqtt # 精确删除单条（--kind 必填）
|
|
||||||
secrets delete -n refining --dry-run # 预览批量删除（不写入）
|
|
||||||
secrets delete -n ricnsmart # 批量删除整个 namespace
|
|
||||||
secrets delete -n ricnsmart --kind server # 批量删除指定 kind
|
|
||||||
|
|
||||||
# ── init ─────────────────────────────────────────────────────────────────────
|
|
||||||
secrets init # 主密钥初始化（每台设备一次，主密码至少 8 位，派生后存钥匙串）
|
|
||||||
|
|
||||||
# ── config ───────────────────────────────────────────────────────────────────
|
|
||||||
secrets config set-db "postgres://postgres:<password>@<host>:<port>/secrets" # 先验证再写入
|
|
||||||
secrets config show # 密码脱敏展示
|
|
||||||
secrets config path # 打印配置文件路径
|
|
||||||
|
|
||||||
# ── upgrade ──────────────────────────────────────────────────────────────────
|
|
||||||
secrets upgrade --check # 仅检查是否有新版本
|
|
||||||
secrets upgrade # 下载、校验 SHA-256 并安装最新版（可通过 SECRETS_UPGRADE_URL 自托管）
|
|
||||||
|
|
||||||
# ── export ────────────────────────────────────────────────────────────────────
|
|
||||||
secrets export --file backup.json # 全量导出到 JSON
|
|
||||||
secrets export -n refining --file refining.toml # 按 namespace 导出为 TOML
|
|
||||||
secrets export -n refining --kind service --file svc.yaml # 按 kind 导出为 YAML
|
|
||||||
secrets export --tag production --file prod.json # 按 tag 过滤
|
|
||||||
secrets export -q mqtt --file mqtt.json # 模糊搜索导出
|
|
||||||
secrets export --no-secrets --file schema.json # 仅导出 schema（无需主密钥）
|
|
||||||
secrets export -n refining --format yaml # 输出到 stdout，指定格式
|
|
||||||
|
|
||||||
# ── import ────────────────────────────────────────────────────────────────────
|
|
||||||
secrets import backup.json # 导入（冲突时报错）
|
|
||||||
secrets import --force refining.toml # 冲突时覆盖已有记录
|
|
||||||
secrets import --dry-run backup.yaml # 预览将要执行的操作（不写入）
|
|
||||||
|
|
||||||
# ── run ───────────────────────────────────────────────────────────────────────
|
|
||||||
secrets run -n refining --kind service --name gitea -- ./deploy.sh # 注入全部 secrets
|
|
||||||
secrets run -n refining --kind service --name gitea -s token -- ./deploy.sh # 只注入 token 字段
|
|
||||||
secrets run -n refining --kind service --name aliyun \
|
|
||||||
-s access_key_id -s access_key_secret -- aliyun ecs DescribeInstances # 只注入指定字段
|
|
||||||
secrets run --tag production -- env # 按 tag 批量注入
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run # 预览变量映射
|
|
||||||
secrets run -n refining --kind service --name gitea -s token --dry-run # 过滤后预览
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run -o text # 人类可读预览
|
|
||||||
|
|
||||||
# ── 调试 ──────────────────────────────────────────────────────────────────────
|
|
||||||
secrets --verbose search -q mqtt
|
|
||||||
RUST_LOG=secrets=trace secrets search
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## 数据模型
|
## 数据模型
|
||||||
|
|
||||||
主表 `entries`（namespace、kind、name、tags、metadata）+ 子表 `secrets`（每个加密字段一行，含 field_name、encrypted）。首次连接自动建表；同时创建 `audit_log`、`entries_history`、`secrets_history` 等表。
|
主表 **`entries`**（`namespace`、`kind`、`name`、`tags`、`metadata`，多租户时带 `user_id`）+ 子表 **`secrets`**（每行一个加密字段：`field_name`、`encrypted`）。另有 `entries_history`、`secrets_history`、`audit_log`，以及 **`users`**（含 `key_salt`、`key_check`、`key_params`）、**`oauth_accounts`**、**`api_keys`**。首次连库自动迁移建表。
|
||||||
|
|
||||||
| 位置 | 字段 | 说明 |
|
| 位置 | 字段 | 说明 |
|
||||||
|------|------|------|
|
|------|------|------|
|
||||||
| entries | namespace | 一级隔离，如 `refining`、`ricnsmart` |
|
| entries | namespace | 一级隔离，如 `refining`、`ricnsmart` |
|
||||||
| entries | kind | 记录类型，如 `server`、`service`、`key`（可自由扩展） |
|
| entries | kind | `server`、`service`、`key` 等（可扩展） |
|
||||||
| entries | name | 人类可读唯一标识 |
|
| entries | name | 人类可读标识 |
|
||||||
| entries | tags | 多维标签，如 `["aliyun","hongkong"]` |
|
| entries | metadata | 明文 JSON（ip、url、`key_ref` 等） |
|
||||||
| entries | metadata | 明文描述（ip、desc、domains、key_ref 等） |
|
| secrets | field_name | 明文字段名，便于 schema 展示 |
|
||||||
| secrets | field_name | 明文，search 可见，AI 可推断 run 会注入哪些变量 |
|
| secrets | encrypted | AES-GCM 密文（含 nonce） |
|
||||||
| secrets | encrypted | 仅加密值本身，AES-256-GCM |
|
| users | key_salt | PBKDF2 salt（32B），首次设置密码短语时写入 |
|
||||||
|
| users | key_check | 派生密钥加密已知常量，用于验证密码短语 |
|
||||||
|
| users | key_params | 派生算法参数，如 `{"alg":"pbkdf2-sha256","iterations":600000}` |
|
||||||
|
|
||||||
`-m` / `--meta` 写入 `metadata`，`-s` / `--secret` 写入 `secrets` 表的独立行。支持 `key=value`、`key=@file`、`key:=<json>`，也支持 `credentials:content@./key.pem` 这类嵌套字段文件写入；删除时支持 `--remove-secret credentials:content`。加解密使用主密钥（由 `secrets init` 设置）。
|
### PEM 共享（`key_ref`）
|
||||||
|
|
||||||
**PEM 共享**：同一 PEM 被多台服务器共享时，可存为 `kind=key` 记录，服务器通过 `metadata.key_ref` 引用；轮换只需 update 一条 key 记录，所有引用自动生效。详见 [AGENTS.md](AGENTS.md)。
|
同一 PEM 可被多条 `server` 记录引用：将 PEM 存为 `kind=key` 的 entry，在服务器条目的 `metadata.key_ref` 中写 key 的名称；轮换时只更新 key 对应记录即可。
|
||||||
|
|
||||||
### `-m` / `--meta` JSON 语法速查
|
|
||||||
|
|
||||||
`-m` 和 `-s` 走的是同一套解析规则，只是写入位置不同：`-m` 写到明文 `metadata`，适合端口、开关、标签、描述性配置等非敏感信息。
|
|
||||||
|
|
||||||
| 目标值 | 写法示例 | 实际存入 |
|
|
||||||
|------|------|------|
|
|
||||||
| 普通字符串 | `-m url=https://code.example.com` | `"https://code.example.com"` |
|
|
||||||
| 文件内容字符串 | `-m notes=@./service-notes.txt` | `"..."` |
|
|
||||||
| 布尔值 | `-m enabled:=true` | `true` |
|
|
||||||
| 数字 | `-m port:=3000` | `3000` |
|
|
||||||
| `null` | `-m deprecated_at:=null` | `null` |
|
|
||||||
| 数组 | `-m domains:='["code.example.com","git.example.com"]'` | `["code.example.com","git.example.com"]` |
|
|
||||||
| 对象 | `-m tls:='{"enabled":true,"redirect_http":true}'` | `{"enabled":true,"redirect_http":true}` |
|
|
||||||
| 嵌套路径 + JSON | `-m deploy:strategy:='{"type":"rolling","batch":2}'` | `{"deploy":{"strategy":{"type":"rolling","batch":2}}}` |
|
|
||||||
|
|
||||||
常见规则：
|
|
||||||
|
|
||||||
- `=` 表示按字符串存储。
|
|
||||||
- `:=` 表示按 JSON 解析。
|
|
||||||
- shell 中数组和对象建议整体用单引号包住。
|
|
||||||
- 嵌套字段继续用冒号分隔：`-m runtime:max_open_conns:=20`。
|
|
||||||
|
|
||||||
示例：新增一条带 typed metadata 的记录
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets add -n refining --kind service --name gitea \
|
|
||||||
-m url=https://code.example.com \
|
|
||||||
-m port:=3000 \
|
|
||||||
-m enabled:=true \
|
|
||||||
-m domains:='["code.example.com","git.example.com"]' \
|
|
||||||
-m tls:='{"enabled":true,"redirect_http":true}'
|
|
||||||
```
|
|
||||||
|
|
||||||
示例：更新已有记录中的嵌套 metadata
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets update -n refining --kind service --name gitea \
|
|
||||||
-m deploy:strategy:='{"type":"rolling","batch":2}' \
|
|
||||||
-m runtime:max_open_conns:=20
|
|
||||||
```
|
|
||||||
|
|
||||||
### `-s` / `--secret` JSON 语法速查
|
|
||||||
|
|
||||||
当你希望写入的不是普通字符串，而是 `true`、`123`、`null`、数组或对象时，用 `:=`，右侧按 JSON 解析。
|
|
||||||
|
|
||||||
| 目标值 | 写法示例 | 实际存入 |
|
|
||||||
|------|------|------|
|
|
||||||
| 普通字符串 | `-s token=abc123` | `"abc123"` |
|
|
||||||
| 文件内容字符串 | `-s ssh_key=@./id_ed25519` | `"-----BEGIN ..."` |
|
|
||||||
| 布尔值 | `-s enabled:=true` | `true` |
|
|
||||||
| 数字 | `-s retry_count:=3` | `3` |
|
|
||||||
| `null` | `-s deprecated_at:=null` | `null` |
|
|
||||||
| 数组 | `-s scopes:='["repo","workflow"]'` | `["repo","workflow"]` |
|
|
||||||
| 对象 | `-s extra:='{"region":"ap-east-1","verify_tls":true}'` | `{"region":"ap-east-1","verify_tls":true}` |
|
|
||||||
| 嵌套路径 + JSON | `-s auth:policy:='{"mfa":true,"ttl":3600}'` | `{"auth":{"policy":{"mfa":true,"ttl":3600}}}` |
|
|
||||||
|
|
||||||
常见规则：
|
|
||||||
|
|
||||||
- `=` 表示按字符串存储，不做 JSON 解析。
|
|
||||||
- `:=` 表示按 JSON 解析，适合布尔、数字、数组、对象、`null`。
|
|
||||||
- shell 里对象和数组通常要整体加引号，推荐单引号：`-s flags:='["a","b"]'`。
|
|
||||||
- 嵌套字段继续用冒号分隔：`-s credentials:enabled:=true`。
|
|
||||||
- 如果你就是想存一个“JSON 字符串字面量”，可以写成 `-s note:='"hello"'`，但大多数字符串场景直接用 `=` 更直观。
|
|
||||||
|
|
||||||
示例：新增一条同时包含字符串、文件、布尔、数组、对象的记录
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets add -n refining --kind service --name deploy-bot \
|
|
||||||
-s token=abc123 \
|
|
||||||
-s ssh_key=@./keys/deploy-bot.pem \
|
|
||||||
-s enabled:=true \
|
|
||||||
-s scopes:='["repo","workflow"]' \
|
|
||||||
-s policy:='{"ttl":3600,"mfa":true}'
|
|
||||||
```
|
|
||||||
|
|
||||||
示例：更新已有记录中的嵌套 JSON 字段
|
|
||||||
|
|
||||||
```bash
|
|
||||||
secrets update -n refining --kind service --name deploy-bot \
|
|
||||||
-s auth:config:='{"issuer":"gitea","rotate":true}' \
|
|
||||||
-s auth:retry:=5
|
|
||||||
```
|
|
||||||
|
|
||||||
## 审计日志
|
## 审计日志
|
||||||
|
|
||||||
`add`、`update`、`delete` 操作成功后自动向 `audit_log` 表写入一条记录，包含操作类型、操作对象和变更摘要（不含 secret 值）。操作者取自 `$USER` 环境变量。
|
`add`、`update`、`delete` 等写操作写入 **`audit_log`**（操作类型、对象、摘要，不含 secret 明文）。
|
||||||
|
|
||||||
```sql
|
```sql
|
||||||
-- 查看最近 20 条审计记录
|
|
||||||
SELECT action, namespace, kind, name, actor, detail, created_at
|
SELECT action, namespace, kind, name, actor, detail, created_at
|
||||||
FROM audit_log
|
FROM audit_log
|
||||||
ORDER BY created_at DESC
|
ORDER BY created_at DESC
|
||||||
@@ -312,49 +153,19 @@ LIMIT 20;
|
|||||||
## 项目结构
|
## 项目结构
|
||||||
|
|
||||||
```
|
```
|
||||||
src/
|
Cargo.toml
|
||||||
main.rs # CLI 入口（clap），含各子命令 after_help 示例
|
crates/secrets-core/ # db / crypto / models / audit / service
|
||||||
output.rs # OutputMode 枚举 + TTY 检测
|
crates/secrets-mcp/ # MCP HTTP、Web、OAuth、API Key
|
||||||
config.rs # 配置读写（~/.config/secrets/config.toml）
|
|
||||||
db.rs # 连接池 + auto-migrate（entries + secrets + entries_history + secrets_history + audit_log + kv_config）
|
|
||||||
crypto.rs # AES-256-GCM 加解密、Argon2id 派生、OS 钥匙串
|
|
||||||
models.rs # Entry + SecretField 结构体
|
|
||||||
audit.rs # 审计日志写入（audit_log 表）
|
|
||||||
commands/
|
|
||||||
init.rs # 主密钥初始化（首次/新设备）
|
|
||||||
add.rs # upsert entries + secrets 行，支持 -o json
|
|
||||||
config.rs # config set-db/show/path
|
|
||||||
search.rs # 多条件查询，展示 secrets schema（-f/-o/--summary/--limit/--offset/--sort）
|
|
||||||
delete.rs # 删除（CASCADE 删除 secrets）
|
|
||||||
update.rs # 增量更新（tags/metadata + secrets 行级 UPSERT/DELETE）
|
|
||||||
rollback.rs # rollback / history：按 entry_version 恢复
|
|
||||||
run.rs # run，仅 secrets 逐字段解密 + key_ref 引用解析（不含 metadata）
|
|
||||||
upgrade.rs # 从 Gitea Release 自更新
|
|
||||||
export_cmd.rs # export：批量导出，支持 JSON/TOML/YAML，含解密明文
|
|
||||||
import_cmd.rs # import：批量导入，冲突检测，dry-run，重新加密写入
|
|
||||||
scripts/
|
scripts/
|
||||||
setup-gitea-actions.sh # 配置 Gitea Actions 变量与 Secrets
|
deploy/ # systemd、.env 示例
|
||||||
```
|
```
|
||||||
|
|
||||||
## CI/CD（Gitea Actions）
|
## CI/CD（Gitea Actions）
|
||||||
|
|
||||||
推送 `main` 分支时自动：fmt/clippy/test 检查 → Linux/macOS/Windows 构建 → 上传二进制与 `.sha256` 摘要 → 所有平台成功后发布 Release。
|
见 [`.gitea/workflows/secrets.yml`](.gitea/workflows/secrets.yml)。变更 `crates/**`、`deploy/**`、根目录 `Cargo.toml`/`Cargo.lock` 并推送到配置的分支时：fmt / clippy / test → 构建 `x86_64-unknown-linux-musl` → tag `secrets-mcp-<version>` 与 Release 产物 → 可选 SSH 部署。
|
||||||
|
|
||||||
**首次使用需配置 Actions 变量和 Secrets：**
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
# 需有 ~/.config/gitea/config.env（GITEA_URL、GITEA_TOKEN、GITEA_WEBHOOK_URL）
|
./scripts/setup-gitea-actions.sh # 配置 Gitea 变量与 Secrets
|
||||||
./scripts/setup-gitea-actions.sh
|
|
||||||
```
|
```
|
||||||
|
|
||||||
- `RELEASE_TOKEN`（Secret）：Gitea PAT，用于创建 Release 上传二进制
|
详见 [AGENTS.md](AGENTS.md)（发版规则、代码规范）。
|
||||||
- `WEBHOOK_URL`（Variable）：飞书通知，可选
|
|
||||||
- **注意**：Secret/Variable 的 `data`/`value` 字段需传入原始值，不要 base64 编码
|
|
||||||
|
|
||||||
当前 Release 预编译产物覆盖：
|
|
||||||
- Linux `x86_64-unknown-linux-musl`
|
|
||||||
- macOS Apple Silicon `aarch64-apple-darwin`
|
|
||||||
- macOS Intel `x86_64-apple-darwin`（由 ARM mac runner 交叉编译）
|
|
||||||
- Windows `x86_64-pc-windows-msvc`
|
|
||||||
|
|
||||||
详见 [AGENTS.md](AGENTS.md)。
|
|
||||||
|
|||||||
26
crates/secrets-core/Cargo.toml
Normal file
26
crates/secrets-core/Cargo.toml
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
[package]
|
||||||
|
name = "secrets-core"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition.workspace = true
|
||||||
|
|
||||||
|
[lib]
|
||||||
|
name = "secrets_core"
|
||||||
|
path = "src/lib.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
aes-gcm.workspace = true
|
||||||
|
anyhow.workspace = true
|
||||||
|
chrono.workspace = true
|
||||||
|
rand.workspace = true
|
||||||
|
serde.workspace = true
|
||||||
|
serde_json.workspace = true
|
||||||
|
serde_yaml.workspace = true
|
||||||
|
sha2.workspace = true
|
||||||
|
sqlx.workspace = true
|
||||||
|
toml.workspace = true
|
||||||
|
tokio.workspace = true
|
||||||
|
tracing.workspace = true
|
||||||
|
uuid.workspace = true
|
||||||
|
|
||||||
|
[dev-dependencies]
|
||||||
|
tempfile = "3"
|
||||||
20
crates/secrets-core/src/config.rs
Normal file
20
crates/secrets-core/src/config.rs
Normal file
@@ -0,0 +1,20 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
|
||||||
|
/// Resolve database URL from environment.
|
||||||
|
/// Priority: `SECRETS_DATABASE_URL` env var → error.
|
||||||
|
pub fn resolve_db_url(override_url: &str) -> Result<String> {
|
||||||
|
if !override_url.is_empty() {
|
||||||
|
return Ok(override_url.to_string());
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Ok(url) = std::env::var("SECRETS_DATABASE_URL")
|
||||||
|
&& !url.is_empty()
|
||||||
|
{
|
||||||
|
return Ok(url);
|
||||||
|
}
|
||||||
|
|
||||||
|
anyhow::bail!(
|
||||||
|
"Database not configured. Set the SECRETS_DATABASE_URL environment variable.\n\
|
||||||
|
Example: SECRETS_DATABASE_URL=postgres://user:pass@host:port/dbname"
|
||||||
|
)
|
||||||
|
}
|
||||||
@@ -3,39 +3,10 @@ use aes_gcm::{
|
|||||||
aead::{Aead, AeadCore, KeyInit, OsRng},
|
aead::{Aead, AeadCore, KeyInit, OsRng},
|
||||||
};
|
};
|
||||||
use anyhow::{Context, Result, bail};
|
use anyhow::{Context, Result, bail};
|
||||||
use argon2::{Argon2, Params, Version};
|
|
||||||
use serde_json::Value;
|
use serde_json::Value;
|
||||||
|
|
||||||
const KEYRING_SERVICE: &str = "secrets-cli";
|
|
||||||
const KEYRING_USER: &str = "master-key";
|
|
||||||
const NONCE_LEN: usize = 12;
|
const NONCE_LEN: usize = 12;
|
||||||
|
|
||||||
// Argon2id parameters — OWASP recommended (m=64 MiB, t=3 iterations, p=4 threads, key=32 B)
|
|
||||||
const ARGON2_M_COST: u32 = 65_536;
|
|
||||||
const ARGON2_T_COST: u32 = 3;
|
|
||||||
const ARGON2_P_COST: u32 = 4;
|
|
||||||
const ARGON2_KEY_LEN: usize = 32;
|
|
||||||
|
|
||||||
// ─── Argon2id key derivation ─────────────────────────────────────────────────
|
|
||||||
|
|
||||||
/// Derive a 32-byte Master Key from a password and salt using Argon2id.
|
|
||||||
/// Parameters: m=65536 KiB (64 MB), t=3, p=4 — OWASP recommended.
|
|
||||||
pub fn derive_master_key(password: &str, salt: &[u8]) -> Result<[u8; 32]> {
|
|
||||||
let params = Params::new(
|
|
||||||
ARGON2_M_COST,
|
|
||||||
ARGON2_T_COST,
|
|
||||||
ARGON2_P_COST,
|
|
||||||
Some(ARGON2_KEY_LEN),
|
|
||||||
)
|
|
||||||
.context("invalid Argon2id params")?;
|
|
||||||
let argon2 = Argon2::new(argon2::Algorithm::Argon2id, Version::V0x13, params);
|
|
||||||
let mut key = [0u8; 32];
|
|
||||||
argon2
|
|
||||||
.hash_password_into(password.as_bytes(), salt, &mut key)
|
|
||||||
.map_err(|e| anyhow::anyhow!("Argon2id derivation failed: {}", e))?;
|
|
||||||
Ok(key)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ─── AES-256-GCM encrypt / decrypt ───────────────────────────────────────────
|
// ─── AES-256-GCM encrypt / decrypt ───────────────────────────────────────────
|
||||||
|
|
||||||
/// Encrypt plaintext bytes with AES-256-GCM.
|
/// Encrypt plaintext bytes with AES-256-GCM.
|
||||||
@@ -84,20 +55,43 @@ pub fn decrypt_json(master_key: &[u8; 32], data: &[u8]) -> Result<Value> {
|
|||||||
serde_json::from_slice(&bytes).context("deserialize decrypted JSON")
|
serde_json::from_slice(&bytes).context("deserialize decrypted JSON")
|
||||||
}
|
}
|
||||||
|
|
||||||
// ─── OS Keychain ──────────────────────────────────────────────────────────────
|
// ─── Per-user key management (DEPRECATED — kept only for migration) ───────────
|
||||||
|
|
||||||
/// Load the Master Key from the OS Keychain.
|
/// Generate a new random 32-byte per-user encryption key.
|
||||||
/// Returns an error with a helpful message if it hasn't been initialized.
|
#[allow(dead_code)]
|
||||||
pub fn load_master_key() -> Result<[u8; 32]> {
|
pub fn generate_user_key() -> [u8; 32] {
|
||||||
let entry =
|
use aes_gcm::aead::rand_core::RngCore;
|
||||||
keyring::Entry::new(KEYRING_SERVICE, KEYRING_USER).context("create keychain entry")?;
|
let mut key = [0u8; 32];
|
||||||
let hex = entry.get_password().map_err(|_| {
|
OsRng.fill_bytes(&mut key);
|
||||||
anyhow::anyhow!("Master key not found in keychain. Run `secrets init` first.")
|
key
|
||||||
})?;
|
}
|
||||||
let bytes = hex::decode_hex(&hex)?;
|
|
||||||
|
/// Wrap a per-user key with the server master key using AES-256-GCM.
|
||||||
|
#[allow(dead_code)]
|
||||||
|
pub fn wrap_user_key(server_master_key: &[u8; 32], user_key: &[u8; 32]) -> Result<Vec<u8>> {
|
||||||
|
encrypt(server_master_key, user_key.as_ref())
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Unwrap a per-user key using the server master key.
|
||||||
|
#[allow(dead_code)]
|
||||||
|
pub fn unwrap_user_key(server_master_key: &[u8; 32], wrapped: &[u8]) -> Result<[u8; 32]> {
|
||||||
|
let bytes = decrypt(server_master_key, wrapped)?;
|
||||||
|
if bytes.len() != 32 {
|
||||||
|
bail!("unwrapped user key has unexpected length {}", bytes.len());
|
||||||
|
}
|
||||||
|
let mut key = [0u8; 32];
|
||||||
|
key.copy_from_slice(&bytes);
|
||||||
|
Ok(key)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ─── Client-supplied key extraction ──────────────────────────────────────────
|
||||||
|
|
||||||
|
/// Parse a 64-char hex string (from X-Encryption-Key header) into a 32-byte key.
|
||||||
|
pub fn extract_key_from_hex(hex_str: &str) -> Result<[u8; 32]> {
|
||||||
|
let bytes = hex::decode_hex(hex_str.trim())?;
|
||||||
if bytes.len() != 32 {
|
if bytes.len() != 32 {
|
||||||
bail!(
|
bail!(
|
||||||
"stored master key has unexpected length {}; re-run `secrets init`",
|
"X-Encryption-Key must be 64 hex chars (32 bytes), got {} bytes",
|
||||||
bytes.len()
|
bytes.len()
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
@@ -106,20 +100,36 @@ pub fn load_master_key() -> Result<[u8; 32]> {
|
|||||||
Ok(key)
|
Ok(key)
|
||||||
}
|
}
|
||||||
|
|
||||||
/// Store the Master Key in the OS Keychain (overwrites any existing value).
|
// ─── Server master key ────────────────────────────────────────────────────────
|
||||||
pub fn store_master_key(key: &[u8; 32]) -> Result<()> {
|
|
||||||
let entry =
|
/// Load the server master key from `SERVER_MASTER_KEY` environment variable (64 hex chars).
|
||||||
keyring::Entry::new(KEYRING_SERVICE, KEYRING_USER).context("create keychain entry")?;
|
pub fn load_master_key_auto() -> Result<[u8; 32]> {
|
||||||
let hex = hex::encode_hex(key);
|
let hex_str = std::env::var("SERVER_MASTER_KEY").map_err(|_| {
|
||||||
entry
|
anyhow::anyhow!(
|
||||||
.set_password(&hex)
|
"SERVER_MASTER_KEY is not set. \
|
||||||
.map_err(|e| anyhow::anyhow!("keychain write failed: {}", e))?;
|
Generate one with: openssl rand -hex 32"
|
||||||
Ok(())
|
)
|
||||||
|
})?;
|
||||||
|
|
||||||
|
if hex_str.is_empty() {
|
||||||
|
bail!("SERVER_MASTER_KEY is set but empty");
|
||||||
|
}
|
||||||
|
|
||||||
|
let bytes = hex::decode_hex(hex_str.trim())?;
|
||||||
|
if bytes.len() != 32 {
|
||||||
|
bail!(
|
||||||
|
"SERVER_MASTER_KEY must be 64 hex chars (32 bytes), got {} bytes",
|
||||||
|
bytes.len()
|
||||||
|
);
|
||||||
|
}
|
||||||
|
let mut key = [0u8; 32];
|
||||||
|
key.copy_from_slice(&bytes);
|
||||||
|
Ok(key)
|
||||||
}
|
}
|
||||||
|
|
||||||
// ─── Minimal hex helpers (avoid extra dep) ────────────────────────────────────
|
// ─── Public hex helpers ───────────────────────────────────────────────────────
|
||||||
|
|
||||||
mod hex {
|
pub mod hex {
|
||||||
use anyhow::{Result, bail};
|
use anyhow::{Result, bail};
|
||||||
|
|
||||||
pub fn encode_hex(bytes: &[u8]) -> String {
|
pub fn encode_hex(bytes: &[u8]) -> String {
|
||||||
@@ -127,6 +137,7 @@ mod hex {
|
|||||||
}
|
}
|
||||||
|
|
||||||
pub fn decode_hex(s: &str) -> Result<Vec<u8>> {
|
pub fn decode_hex(s: &str) -> Result<Vec<u8>> {
|
||||||
|
let s = s.trim();
|
||||||
if !s.len().is_multiple_of(2) {
|
if !s.len().is_multiple_of(2) {
|
||||||
bail!("hex string has odd length");
|
bail!("hex string has odd length");
|
||||||
}
|
}
|
||||||
@@ -156,7 +167,6 @@ mod tests {
|
|||||||
let plaintext = b"hello world";
|
let plaintext = b"hello world";
|
||||||
let enc1 = encrypt(&key, plaintext).unwrap();
|
let enc1 = encrypt(&key, plaintext).unwrap();
|
||||||
let enc2 = encrypt(&key, plaintext).unwrap();
|
let enc2 = encrypt(&key, plaintext).unwrap();
|
||||||
// Different nonces → different ciphertexts
|
|
||||||
assert_ne!(enc1, enc2);
|
assert_ne!(enc1, enc2);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -178,18 +188,20 @@ mod tests {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn derive_master_key_deterministic() {
|
fn user_key_wrap_unwrap_roundtrip() {
|
||||||
let salt = b"fixed_test_salt_";
|
let server_key = [0xABu8; 32];
|
||||||
let k1 = derive_master_key("password", salt).unwrap();
|
let user_key = [0xCDu8; 32];
|
||||||
let k2 = derive_master_key("password", salt).unwrap();
|
let wrapped = wrap_user_key(&server_key, &user_key).unwrap();
|
||||||
assert_eq!(k1, k2);
|
let unwrapped = unwrap_user_key(&server_key, &wrapped).unwrap();
|
||||||
|
assert_eq!(unwrapped, user_key);
|
||||||
}
|
}
|
||||||
|
|
||||||
#[test]
|
#[test]
|
||||||
fn derive_master_key_different_passwords() {
|
fn user_key_wrap_wrong_server_key_fails() {
|
||||||
let salt = b"fixed_test_salt_";
|
let server_key1 = [0xABu8; 32];
|
||||||
let k1 = derive_master_key("password1", salt).unwrap();
|
let server_key2 = [0xEFu8; 32];
|
||||||
let k2 = derive_master_key("password2", salt).unwrap();
|
let user_key = [0xCDu8; 32];
|
||||||
assert_ne!(k1, k2);
|
let wrapped = wrap_user_key(&server_key1, &user_key).unwrap();
|
||||||
|
assert!(unwrap_user_key(&server_key2, &wrapped).is_err());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -8,7 +8,7 @@ use crate::audit::current_actor;
|
|||||||
pub async fn create_pool(database_url: &str) -> Result<PgPool> {
|
pub async fn create_pool(database_url: &str) -> Result<PgPool> {
|
||||||
tracing::debug!("connecting to database");
|
tracing::debug!("connecting to database");
|
||||||
let pool = PgPoolOptions::new()
|
let pool = PgPoolOptions::new()
|
||||||
.max_connections(5)
|
.max_connections(10)
|
||||||
.acquire_timeout(std::time::Duration::from_secs(5))
|
.acquire_timeout(std::time::Duration::from_secs(5))
|
||||||
.connect(database_url)
|
.connect(database_url)
|
||||||
.await?;
|
.await?;
|
||||||
@@ -20,9 +20,10 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
tracing::debug!("running migrations");
|
tracing::debug!("running migrations");
|
||||||
sqlx::raw_sql(
|
sqlx::raw_sql(
|
||||||
r#"
|
r#"
|
||||||
-- ── entries: top-level entities (server, service, key, …) ──────────────
|
-- ── entries: top-level entities ─────────────────────────────────────────
|
||||||
CREATE TABLE IF NOT EXISTS entries (
|
CREATE TABLE IF NOT EXISTS entries (
|
||||||
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
|
user_id UUID,
|
||||||
namespace VARCHAR(64) NOT NULL,
|
namespace VARCHAR(64) NOT NULL,
|
||||||
kind VARCHAR(64) NOT NULL,
|
kind VARCHAR(64) NOT NULL,
|
||||||
name VARCHAR(256) NOT NULL,
|
name VARCHAR(256) NOT NULL,
|
||||||
@@ -30,16 +31,26 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
metadata JSONB NOT NULL DEFAULT '{}',
|
metadata JSONB NOT NULL DEFAULT '{}',
|
||||||
version BIGINT NOT NULL DEFAULT 1,
|
version BIGINT NOT NULL DEFAULT 1,
|
||||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||||
UNIQUE(namespace, kind, name)
|
|
||||||
);
|
);
|
||||||
|
|
||||||
|
-- Legacy unique constraint without user_id (single-user mode)
|
||||||
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_unique_legacy
|
||||||
|
ON entries(namespace, kind, name)
|
||||||
|
WHERE user_id IS NULL;
|
||||||
|
|
||||||
|
-- Multi-user unique constraint
|
||||||
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_unique_user
|
||||||
|
ON entries(user_id, namespace, kind, name)
|
||||||
|
WHERE user_id IS NOT NULL;
|
||||||
|
|
||||||
CREATE INDEX IF NOT EXISTS idx_entries_namespace ON entries(namespace);
|
CREATE INDEX IF NOT EXISTS idx_entries_namespace ON entries(namespace);
|
||||||
CREATE INDEX IF NOT EXISTS idx_entries_kind ON entries(kind);
|
CREATE INDEX IF NOT EXISTS idx_entries_kind ON entries(kind);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_entries_user_id ON entries(user_id) WHERE user_id IS NOT NULL;
|
||||||
CREATE INDEX IF NOT EXISTS idx_entries_tags ON entries USING GIN(tags);
|
CREATE INDEX IF NOT EXISTS idx_entries_tags ON entries USING GIN(tags);
|
||||||
CREATE INDEX IF NOT EXISTS idx_entries_metadata ON entries USING GIN(metadata jsonb_path_ops);
|
CREATE INDEX IF NOT EXISTS idx_entries_metadata ON entries USING GIN(metadata jsonb_path_ops);
|
||||||
|
|
||||||
-- ── secrets: one row per encrypted field, plaintext schema metadata ────
|
-- ── secrets: one row per encrypted field ─────────────────────────────────
|
||||||
CREATE TABLE IF NOT EXISTS secrets (
|
CREATE TABLE IF NOT EXISTS secrets (
|
||||||
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
entry_id UUID NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
|
entry_id UUID NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
|
||||||
@@ -53,13 +64,7 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
|
|
||||||
CREATE INDEX IF NOT EXISTS idx_secrets_entry_id ON secrets(entry_id);
|
CREATE INDEX IF NOT EXISTS idx_secrets_entry_id ON secrets(entry_id);
|
||||||
|
|
||||||
-- ── kv_config: global key-value store (Argon2id salt, etc.) ────────────
|
-- ── audit_log: append-only operation log ─────────────────────────────────
|
||||||
CREATE TABLE IF NOT EXISTS kv_config (
|
|
||||||
key TEXT PRIMARY KEY,
|
|
||||||
value BYTEA NOT NULL
|
|
||||||
);
|
|
||||||
|
|
||||||
-- ── audit_log: append-only operation log ────────────────────────────────
|
|
||||||
CREATE TABLE IF NOT EXISTS audit_log (
|
CREATE TABLE IF NOT EXISTS audit_log (
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
||||||
action VARCHAR(32) NOT NULL,
|
action VARCHAR(32) NOT NULL,
|
||||||
@@ -74,7 +79,7 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at DESC);
|
CREATE INDEX IF NOT EXISTS idx_audit_log_created ON audit_log(created_at DESC);
|
||||||
CREATE INDEX IF NOT EXISTS idx_audit_log_ns_kind ON audit_log(namespace, kind);
|
CREATE INDEX IF NOT EXISTS idx_audit_log_ns_kind ON audit_log(namespace, kind);
|
||||||
|
|
||||||
-- ── entries_history: entry-level snapshot (tags + metadata) ─────────────
|
-- ── entries_history ───────────────────────────────────────────────────────
|
||||||
CREATE TABLE IF NOT EXISTS entries_history (
|
CREATE TABLE IF NOT EXISTS entries_history (
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
||||||
entry_id UUID NOT NULL,
|
entry_id UUID NOT NULL,
|
||||||
@@ -94,7 +99,7 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
CREATE INDEX IF NOT EXISTS idx_entries_history_ns_kind_name
|
CREATE INDEX IF NOT EXISTS idx_entries_history_ns_kind_name
|
||||||
ON entries_history(namespace, kind, name, version DESC);
|
ON entries_history(namespace, kind, name, version DESC);
|
||||||
|
|
||||||
-- ── secrets_history: field-level snapshot ───────────────────────────────
|
-- ── secrets_history: field-level snapshot ────────────────────────────────
|
||||||
CREATE TABLE IF NOT EXISTS secrets_history (
|
CREATE TABLE IF NOT EXISTS secrets_history (
|
||||||
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
|
||||||
entry_id UUID NOT NULL,
|
entry_id UUID NOT NULL,
|
||||||
@@ -111,6 +116,37 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
ON secrets_history(entry_id, entry_version DESC);
|
ON secrets_history(entry_id, entry_version DESC);
|
||||||
CREATE INDEX IF NOT EXISTS idx_secrets_history_secret_id
|
CREATE INDEX IF NOT EXISTS idx_secrets_history_secret_id
|
||||||
ON secrets_history(secret_id);
|
ON secrets_history(secret_id);
|
||||||
|
|
||||||
|
-- ── users ─────────────────────────────────────────────────────────────────
|
||||||
|
CREATE TABLE IF NOT EXISTS users (
|
||||||
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
|
email VARCHAR(256),
|
||||||
|
name VARCHAR(256) NOT NULL DEFAULT '',
|
||||||
|
avatar_url TEXT,
|
||||||
|
key_salt BYTEA,
|
||||||
|
key_check BYTEA,
|
||||||
|
key_params JSONB,
|
||||||
|
api_key TEXT UNIQUE,
|
||||||
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||||
|
);
|
||||||
|
|
||||||
|
-- ── oauth_accounts: per-provider identity links ───────────────────────────
|
||||||
|
CREATE TABLE IF NOT EXISTS oauth_accounts (
|
||||||
|
id UUID PRIMARY KEY DEFAULT uuidv7(),
|
||||||
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||||
|
provider VARCHAR(32) NOT NULL,
|
||||||
|
provider_id VARCHAR(256) NOT NULL,
|
||||||
|
email VARCHAR(256),
|
||||||
|
name VARCHAR(256),
|
||||||
|
avatar_url TEXT,
|
||||||
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||||
|
UNIQUE(provider, provider_id)
|
||||||
|
);
|
||||||
|
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_oauth_accounts_user ON oauth_accounts(user_id);
|
||||||
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_accounts_user_provider
|
||||||
|
ON oauth_accounts(user_id, provider);
|
||||||
"#,
|
"#,
|
||||||
)
|
)
|
||||||
.execute(pool)
|
.execute(pool)
|
||||||
@@ -119,7 +155,7 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Entry-level history snapshot ────────────────────────────────────────────
|
// ── Entry-level history snapshot ─────────────────────────────────────────────
|
||||||
|
|
||||||
pub struct EntrySnapshotParams<'a> {
|
pub struct EntrySnapshotParams<'a> {
|
||||||
pub entry_id: uuid::Uuid,
|
pub entry_id: uuid::Uuid,
|
||||||
@@ -132,7 +168,6 @@ pub struct EntrySnapshotParams<'a> {
|
|||||||
pub metadata: &'a Value,
|
pub metadata: &'a Value,
|
||||||
}
|
}
|
||||||
|
|
||||||
/// Snapshot an entry row into `entries_history` before a write operation.
|
|
||||||
pub async fn snapshot_entry_history(
|
pub async fn snapshot_entry_history(
|
||||||
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
||||||
p: EntrySnapshotParams<'_>,
|
p: EntrySnapshotParams<'_>,
|
||||||
@@ -157,7 +192,7 @@ pub async fn snapshot_entry_history(
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Secret field-level history snapshot ─────────────────────────────────────
|
// ── Secret field-level history snapshot ──────────────────────────────────────
|
||||||
|
|
||||||
pub struct SecretSnapshotParams<'a> {
|
pub struct SecretSnapshotParams<'a> {
|
||||||
pub entry_id: uuid::Uuid,
|
pub entry_id: uuid::Uuid,
|
||||||
@@ -168,7 +203,6 @@ pub struct SecretSnapshotParams<'a> {
|
|||||||
pub action: &'a str,
|
pub action: &'a str,
|
||||||
}
|
}
|
||||||
|
|
||||||
/// Snapshot a single secret field into `secrets_history`.
|
|
||||||
pub async fn snapshot_secret_history(
|
pub async fn snapshot_secret_history(
|
||||||
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
||||||
p: SecretSnapshotParams<'_>,
|
p: SecretSnapshotParams<'_>,
|
||||||
@@ -191,25 +225,4 @@ pub async fn snapshot_secret_history(
|
|||||||
Ok(())
|
Ok(())
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Argon2 salt helpers ──────────────────────────────────────────────────────
|
// ── DB helpers ────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
/// Load the Argon2id salt from the database.
|
|
||||||
pub async fn load_argon2_salt(pool: &PgPool) -> Result<Option<Vec<u8>>> {
|
|
||||||
let row: Option<(Vec<u8>,)> =
|
|
||||||
sqlx::query_as("SELECT value FROM kv_config WHERE key = 'argon2_salt'")
|
|
||||||
.fetch_optional(pool)
|
|
||||||
.await?;
|
|
||||||
Ok(row.map(|(v,)| v))
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Store the Argon2id salt in the database (only called once on first device init).
|
|
||||||
pub async fn store_argon2_salt(pool: &PgPool, salt: &[u8]) -> Result<()> {
|
|
||||||
sqlx::query(
|
|
||||||
"INSERT INTO kv_config (key, value) VALUES ('argon2_salt', $1) \
|
|
||||||
ON CONFLICT (key) DO NOTHING",
|
|
||||||
)
|
|
||||||
.bind(salt)
|
|
||||||
.execute(pool)
|
|
||||||
.await?;
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
6
crates/secrets-core/src/lib.rs
Normal file
6
crates/secrets-core/src/lib.rs
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
pub mod audit;
|
||||||
|
pub mod config;
|
||||||
|
pub mod crypto;
|
||||||
|
pub mod db;
|
||||||
|
pub mod models;
|
||||||
|
pub mod service;
|
||||||
@@ -61,20 +61,10 @@ pub enum ExportFormat {
|
|||||||
Yaml,
|
Yaml,
|
||||||
}
|
}
|
||||||
|
|
||||||
impl ExportFormat {
|
impl std::str::FromStr for ExportFormat {
|
||||||
/// Infer format from file extension (.json / .toml / .yaml / .yml).
|
type Err = anyhow::Error;
|
||||||
pub fn from_extension(path: &str) -> anyhow::Result<Self> {
|
|
||||||
let ext = path.rsplit('.').next().unwrap_or("").to_lowercase();
|
|
||||||
Self::from_str(&ext).map_err(|_| {
|
|
||||||
anyhow::anyhow!(
|
|
||||||
"Cannot infer format from extension '.{}'. Use --format json|toml|yaml",
|
|
||||||
ext
|
|
||||||
)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Parse from --format CLI value.
|
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||||
pub fn from_str(s: &str) -> anyhow::Result<Self> {
|
|
||||||
match s.to_lowercase().as_str() {
|
match s.to_lowercase().as_str() {
|
||||||
"json" => Ok(Self::Json),
|
"json" => Ok(Self::Json),
|
||||||
"toml" => Ok(Self::Toml),
|
"toml" => Ok(Self::Toml),
|
||||||
@@ -82,6 +72,19 @@ impl ExportFormat {
|
|||||||
other => anyhow::bail!("Unknown format '{}'. Expected: json, toml, or yaml", other),
|
other => anyhow::bail!("Unknown format '{}'. Expected: json, toml, or yaml", other),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
impl ExportFormat {
|
||||||
|
/// Infer format from file extension (.json / .toml / .yaml / .yml).
|
||||||
|
pub fn from_extension(path: &str) -> anyhow::Result<Self> {
|
||||||
|
let ext = path.rsplit('.').next().unwrap_or("").to_lowercase();
|
||||||
|
ext.parse().map_err(|_| {
|
||||||
|
anyhow::anyhow!(
|
||||||
|
"Cannot infer format from extension '.{}'. Use --format json|toml|yaml",
|
||||||
|
ext
|
||||||
|
)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
/// Serialize ExportData to a string in this format.
|
/// Serialize ExportData to a string in this format.
|
||||||
pub fn serialize(&self, data: &ExportData) -> anyhow::Result<String> {
|
pub fn serialize(&self, data: &ExportData) -> anyhow::Result<String> {
|
||||||
@@ -136,6 +139,41 @@ pub struct ExportEntry {
|
|||||||
pub secrets: Option<BTreeMap<String, Value>>,
|
pub secrets: Option<BTreeMap<String, Value>>,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// ── Multi-user models ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
/// A registered user (created on first OAuth login).
|
||||||
|
#[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
|
||||||
|
pub struct User {
|
||||||
|
pub id: Uuid,
|
||||||
|
pub email: Option<String>,
|
||||||
|
pub name: String,
|
||||||
|
pub avatar_url: Option<String>,
|
||||||
|
/// PBKDF2 salt (32 B). NULL until user sets up passphrase.
|
||||||
|
pub key_salt: Option<Vec<u8>>,
|
||||||
|
/// AES-256-GCM encryption of the known constant "secrets-mcp-key-check".
|
||||||
|
/// Used to verify the passphrase without storing the key itself.
|
||||||
|
pub key_check: Option<Vec<u8>>,
|
||||||
|
/// Key derivation parameters, e.g. {"alg":"pbkdf2-sha256","iterations":600000}.
|
||||||
|
pub key_params: Option<serde_json::Value>,
|
||||||
|
/// Plaintext API key for MCP Bearer authentication. Auto-created on first login.
|
||||||
|
pub api_key: Option<String>,
|
||||||
|
pub created_at: DateTime<Utc>,
|
||||||
|
pub updated_at: DateTime<Utc>,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// An OAuth account linked to a user.
|
||||||
|
#[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
|
||||||
|
pub struct OauthAccount {
|
||||||
|
pub id: Uuid,
|
||||||
|
pub user_id: Uuid,
|
||||||
|
pub provider: String,
|
||||||
|
pub provider_id: String,
|
||||||
|
pub email: Option<String>,
|
||||||
|
pub name: Option<String>,
|
||||||
|
pub avatar_url: Option<String>,
|
||||||
|
pub created_at: DateTime<Utc>,
|
||||||
|
}
|
||||||
|
|
||||||
// ── TOML ↔ JSON value conversion ──────────────────────────────────────────────
|
// ── TOML ↔ JSON value conversion ──────────────────────────────────────────────
|
||||||
|
|
||||||
/// Convert a serde_json Value to a toml Value.
|
/// Convert a serde_json Value to a toml Value.
|
||||||
383
crates/secrets-core/src/service/add.rs
Normal file
383
crates/secrets-core/src/service/add.rs
Normal file
@@ -0,0 +1,383 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::{Map, Value};
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use std::fs;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::crypto;
|
||||||
|
use crate::db;
|
||||||
|
use crate::models::EntryRow;
|
||||||
|
|
||||||
|
// ── Key/value parsing helpers ─────────────────────────────────────────────────
|
||||||
|
|
||||||
|
pub fn parse_kv(entry: &str) -> Result<(Vec<String>, Value)> {
|
||||||
|
if let Some((key, json_str)) = entry.split_once(":=") {
|
||||||
|
let val: Value = serde_json::from_str(json_str).map_err(|e| {
|
||||||
|
anyhow::anyhow!(
|
||||||
|
"Invalid JSON value for key '{}': {} (use key=value for plain strings)",
|
||||||
|
key,
|
||||||
|
e
|
||||||
|
)
|
||||||
|
})?;
|
||||||
|
return Ok((parse_key_path(key)?, val));
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Some((key, raw_val)) = entry.split_once('=') {
|
||||||
|
let value = if let Some(path) = raw_val.strip_prefix('@') {
|
||||||
|
fs::read_to_string(path)
|
||||||
|
.map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", path, e))?
|
||||||
|
} else {
|
||||||
|
raw_val.to_string()
|
||||||
|
};
|
||||||
|
return Ok((parse_key_path(key)?, Value::String(value)));
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Some((key, path)) = entry.split_once('@') {
|
||||||
|
let value = fs::read_to_string(path)
|
||||||
|
.map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", path, e))?;
|
||||||
|
return Ok((parse_key_path(key)?, Value::String(value)));
|
||||||
|
}
|
||||||
|
|
||||||
|
anyhow::bail!(
|
||||||
|
"Invalid format '{}'. Expected: key=value, key=@file, nested:key@file, or key:=<json>",
|
||||||
|
entry
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn build_json(entries: &[String]) -> Result<Value> {
|
||||||
|
let mut map = Map::new();
|
||||||
|
for entry in entries {
|
||||||
|
let (path, value) = parse_kv(entry)?;
|
||||||
|
insert_path(&mut map, &path, value)?;
|
||||||
|
}
|
||||||
|
Ok(Value::Object(map))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn key_path_to_string(path: &[String]) -> String {
|
||||||
|
path.join(":")
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn collect_key_paths(entries: &[String]) -> Result<Vec<String>> {
|
||||||
|
entries
|
||||||
|
.iter()
|
||||||
|
.map(|entry| parse_kv(entry).map(|(path, _)| key_path_to_string(&path)))
|
||||||
|
.collect()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn collect_field_paths(entries: &[String]) -> Result<Vec<String>> {
|
||||||
|
entries
|
||||||
|
.iter()
|
||||||
|
.map(|entry| parse_key_path(entry).map(|path| key_path_to_string(&path)))
|
||||||
|
.collect()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn parse_key_path(key: &str) -> Result<Vec<String>> {
|
||||||
|
let path: Vec<String> = key
|
||||||
|
.split(':')
|
||||||
|
.map(str::trim)
|
||||||
|
.map(ToOwned::to_owned)
|
||||||
|
.collect();
|
||||||
|
|
||||||
|
if path.is_empty() || path.iter().any(|part| part.is_empty()) {
|
||||||
|
anyhow::bail!(
|
||||||
|
"Invalid key path '{}'. Use non-empty segments like 'credentials:content'.",
|
||||||
|
key
|
||||||
|
);
|
||||||
|
}
|
||||||
|
Ok(path)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn insert_path(map: &mut Map<String, Value>, path: &[String], value: Value) -> Result<()> {
|
||||||
|
if path.is_empty() {
|
||||||
|
anyhow::bail!("Key path cannot be empty");
|
||||||
|
}
|
||||||
|
if path.len() == 1 {
|
||||||
|
map.insert(path[0].clone(), value);
|
||||||
|
return Ok(());
|
||||||
|
}
|
||||||
|
let head = path[0].clone();
|
||||||
|
let tail = &path[1..];
|
||||||
|
match map.entry(head.clone()) {
|
||||||
|
serde_json::map::Entry::Vacant(entry) => {
|
||||||
|
let mut child = Map::new();
|
||||||
|
insert_path(&mut child, tail, value)?;
|
||||||
|
entry.insert(Value::Object(child));
|
||||||
|
}
|
||||||
|
serde_json::map::Entry::Occupied(mut entry) => match entry.get_mut() {
|
||||||
|
Value::Object(child) => insert_path(child, tail, value)?,
|
||||||
|
_ => {
|
||||||
|
anyhow::bail!(
|
||||||
|
"Cannot set nested key '{}' because '{}' is already a non-object value",
|
||||||
|
key_path_to_string(path),
|
||||||
|
head
|
||||||
|
);
|
||||||
|
}
|
||||||
|
},
|
||||||
|
}
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn remove_path(map: &mut Map<String, Value>, path: &[String]) -> Result<bool> {
|
||||||
|
if path.is_empty() {
|
||||||
|
anyhow::bail!("Key path cannot be empty");
|
||||||
|
}
|
||||||
|
if path.len() == 1 {
|
||||||
|
return Ok(map.remove(&path[0]).is_some());
|
||||||
|
}
|
||||||
|
let Some(value) = map.get_mut(&path[0]) else {
|
||||||
|
return Ok(false);
|
||||||
|
};
|
||||||
|
let Value::Object(child) = value else {
|
||||||
|
return Ok(false);
|
||||||
|
};
|
||||||
|
let removed = remove_path(child, &path[1..])?;
|
||||||
|
if child.is_empty() {
|
||||||
|
map.remove(&path[0]);
|
||||||
|
}
|
||||||
|
Ok(removed)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn flatten_json_fields(prefix: &str, value: &Value) -> Vec<(String, Value)> {
|
||||||
|
match value {
|
||||||
|
Value::Object(map) => {
|
||||||
|
let mut out = Vec::new();
|
||||||
|
for (k, v) in map {
|
||||||
|
let full_key = if prefix.is_empty() {
|
||||||
|
k.clone()
|
||||||
|
} else {
|
||||||
|
format!("{}.{}", prefix, k)
|
||||||
|
};
|
||||||
|
out.extend(flatten_json_fields(&full_key, v));
|
||||||
|
}
|
||||||
|
out
|
||||||
|
}
|
||||||
|
other => vec![(prefix.to_string(), other.clone())],
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── AddResult ─────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct AddResult {
|
||||||
|
pub namespace: String,
|
||||||
|
pub kind: String,
|
||||||
|
pub name: String,
|
||||||
|
pub tags: Vec<String>,
|
||||||
|
pub meta_keys: Vec<String>,
|
||||||
|
pub secret_keys: Vec<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub struct AddParams<'a> {
|
||||||
|
pub namespace: &'a str,
|
||||||
|
pub kind: &'a str,
|
||||||
|
pub name: &'a str,
|
||||||
|
pub tags: &'a [String],
|
||||||
|
pub meta_entries: &'a [String],
|
||||||
|
pub secret_entries: &'a [String],
|
||||||
|
/// Optional user_id for multi-user isolation (None = single-user CLI mode)
|
||||||
|
pub user_id: Option<Uuid>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) -> Result<AddResult> {
|
||||||
|
let metadata = build_json(params.meta_entries)?;
|
||||||
|
let secret_json = build_json(params.secret_entries)?;
|
||||||
|
let meta_keys = collect_key_paths(params.meta_entries)?;
|
||||||
|
let secret_keys = collect_key_paths(params.secret_entries)?;
|
||||||
|
|
||||||
|
let mut tx = pool.begin().await?;
|
||||||
|
|
||||||
|
// Fetch existing entry (user-scoped or global depending on user_id)
|
||||||
|
let existing: Option<EntryRow> = if let Some(uid) = params.user_id {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
|
WHERE user_id = $1 AND namespace = $2 AND kind = $3 AND name = $4",
|
||||||
|
)
|
||||||
|
.bind(uid)
|
||||||
|
.bind(params.namespace)
|
||||||
|
.bind(params.kind)
|
||||||
|
.bind(params.name)
|
||||||
|
.fetch_optional(&mut *tx)
|
||||||
|
.await?
|
||||||
|
} else {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
|
WHERE user_id IS NULL AND namespace = $1 AND kind = $2 AND name = $3",
|
||||||
|
)
|
||||||
|
.bind(params.namespace)
|
||||||
|
.bind(params.kind)
|
||||||
|
.bind(params.name)
|
||||||
|
.fetch_optional(&mut *tx)
|
||||||
|
.await?
|
||||||
|
};
|
||||||
|
|
||||||
|
if let Some(ref ex) = existing
|
||||||
|
&& let Err(e) = db::snapshot_entry_history(
|
||||||
|
&mut tx,
|
||||||
|
db::EntrySnapshotParams {
|
||||||
|
entry_id: ex.id,
|
||||||
|
namespace: params.namespace,
|
||||||
|
kind: params.kind,
|
||||||
|
name: params.name,
|
||||||
|
version: ex.version,
|
||||||
|
action: "add",
|
||||||
|
tags: &ex.tags,
|
||||||
|
metadata: &ex.metadata,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
tracing::warn!(error = %e, "failed to snapshot entry history before upsert");
|
||||||
|
}
|
||||||
|
|
||||||
|
let entry_id: Uuid = if let Some(uid) = params.user_id {
|
||||||
|
sqlx::query_scalar(
|
||||||
|
r#"INSERT INTO entries (user_id, namespace, kind, name, tags, metadata, version, updated_at)
|
||||||
|
VALUES ($1, $2, $3, $4, $5, $6, 1, NOW())
|
||||||
|
ON CONFLICT (user_id, namespace, kind, name) WHERE user_id IS NOT NULL
|
||||||
|
DO UPDATE SET
|
||||||
|
tags = EXCLUDED.tags,
|
||||||
|
metadata = EXCLUDED.metadata,
|
||||||
|
version = entries.version + 1,
|
||||||
|
updated_at = NOW()
|
||||||
|
RETURNING id"#,
|
||||||
|
)
|
||||||
|
.bind(uid)
|
||||||
|
.bind(params.namespace)
|
||||||
|
.bind(params.kind)
|
||||||
|
.bind(params.name)
|
||||||
|
.bind(params.tags)
|
||||||
|
.bind(&metadata)
|
||||||
|
.fetch_one(&mut *tx)
|
||||||
|
.await?
|
||||||
|
} else {
|
||||||
|
sqlx::query_scalar(
|
||||||
|
r#"INSERT INTO entries (namespace, kind, name, tags, metadata, version, updated_at)
|
||||||
|
VALUES ($1, $2, $3, $4, $5, 1, NOW())
|
||||||
|
ON CONFLICT (namespace, kind, name) WHERE user_id IS NULL
|
||||||
|
DO UPDATE SET
|
||||||
|
tags = EXCLUDED.tags,
|
||||||
|
metadata = EXCLUDED.metadata,
|
||||||
|
version = entries.version + 1,
|
||||||
|
updated_at = NOW()
|
||||||
|
RETURNING id"#,
|
||||||
|
)
|
||||||
|
.bind(params.namespace)
|
||||||
|
.bind(params.kind)
|
||||||
|
.bind(params.name)
|
||||||
|
.bind(params.tags)
|
||||||
|
.bind(&metadata)
|
||||||
|
.fetch_one(&mut *tx)
|
||||||
|
.await?
|
||||||
|
};
|
||||||
|
|
||||||
|
let new_entry_version: i64 = sqlx::query_scalar("SELECT version FROM entries WHERE id = $1")
|
||||||
|
.bind(entry_id)
|
||||||
|
.fetch_one(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if existing.is_some() {
|
||||||
|
#[derive(sqlx::FromRow)]
|
||||||
|
struct ExistingField {
|
||||||
|
id: Uuid,
|
||||||
|
field_name: String,
|
||||||
|
encrypted: Vec<u8>,
|
||||||
|
}
|
||||||
|
let existing_fields: Vec<ExistingField> =
|
||||||
|
sqlx::query_as("SELECT id, field_name, encrypted FROM secrets WHERE entry_id = $1")
|
||||||
|
.bind(entry_id)
|
||||||
|
.fetch_all(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
for f in &existing_fields {
|
||||||
|
if let Err(e) = db::snapshot_secret_history(
|
||||||
|
&mut tx,
|
||||||
|
db::SecretSnapshotParams {
|
||||||
|
entry_id,
|
||||||
|
secret_id: f.id,
|
||||||
|
entry_version: new_entry_version - 1,
|
||||||
|
field_name: &f.field_name,
|
||||||
|
encrypted: &f.encrypted,
|
||||||
|
action: "add",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
tracing::warn!(error = %e, "failed to snapshot secret field history");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
sqlx::query("DELETE FROM secrets WHERE entry_id = $1")
|
||||||
|
.bind(entry_id)
|
||||||
|
.execute(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
}
|
||||||
|
|
||||||
|
let flat_fields = flatten_json_fields("", &secret_json);
|
||||||
|
for (field_name, field_value) in &flat_fields {
|
||||||
|
let encrypted = crypto::encrypt_json(master_key, field_value)?;
|
||||||
|
sqlx::query("INSERT INTO secrets (entry_id, field_name, encrypted) VALUES ($1, $2, $3)")
|
||||||
|
.bind(entry_id)
|
||||||
|
.bind(field_name)
|
||||||
|
.bind(&encrypted)
|
||||||
|
.execute(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
}
|
||||||
|
|
||||||
|
crate::audit::log_tx(
|
||||||
|
&mut tx,
|
||||||
|
"add",
|
||||||
|
params.namespace,
|
||||||
|
params.kind,
|
||||||
|
params.name,
|
||||||
|
serde_json::json!({
|
||||||
|
"tags": params.tags,
|
||||||
|
"meta_keys": meta_keys,
|
||||||
|
"secret_keys": secret_keys,
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
|
||||||
|
tx.commit().await?;
|
||||||
|
|
||||||
|
Ok(AddResult {
|
||||||
|
namespace: params.namespace.to_string(),
|
||||||
|
kind: params.kind.to_string(),
|
||||||
|
name: params.name.to_string(),
|
||||||
|
tags: params.tags.to_vec(),
|
||||||
|
meta_keys,
|
||||||
|
secret_keys,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
#[cfg(test)]
|
||||||
|
mod tests {
|
||||||
|
use super::*;
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn parse_nested_file_shorthand() {
|
||||||
|
use std::io::Write;
|
||||||
|
let mut f = tempfile::NamedTempFile::new().unwrap();
|
||||||
|
writeln!(f, "line1\nline2").unwrap();
|
||||||
|
let path = f.path().to_str().unwrap().to_string();
|
||||||
|
let entry = format!("credentials:content@{}", path);
|
||||||
|
let (path_parts, value) = parse_kv(&entry).unwrap();
|
||||||
|
assert_eq!(key_path_to_string(&path_parts), "credentials:content");
|
||||||
|
assert!(matches!(value, Value::String(_)));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn flatten_json_fields_nested() {
|
||||||
|
let v = serde_json::json!({
|
||||||
|
"username": "root",
|
||||||
|
"credentials": {
|
||||||
|
"type": "ssh",
|
||||||
|
"content": "pem"
|
||||||
|
}
|
||||||
|
});
|
||||||
|
let mut fields = flatten_json_fields("", &v);
|
||||||
|
fields.sort_by(|a, b| a.0.cmp(&b.0));
|
||||||
|
assert_eq!(fields[0].0, "credentials.content");
|
||||||
|
assert_eq!(fields[1].0, "credentials.type");
|
||||||
|
assert_eq!(fields[2].0, "username");
|
||||||
|
}
|
||||||
|
}
|
||||||
55
crates/secrets-core/src/service/api_key.rs
Normal file
55
crates/secrets-core/src/service/api_key.rs
Normal file
@@ -0,0 +1,55 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
const KEY_PREFIX: &str = "sk_";
|
||||||
|
|
||||||
|
/// Generate a new API key: `sk_<64 hex chars>` = 67 characters total.
|
||||||
|
pub fn generate_api_key() -> String {
|
||||||
|
use rand::RngExt;
|
||||||
|
let mut bytes = [0u8; 32];
|
||||||
|
rand::rng().fill(&mut bytes);
|
||||||
|
let hex: String = bytes.iter().map(|b| format!("{:02x}", b)).collect();
|
||||||
|
format!("{}{}", KEY_PREFIX, hex)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Return the user's existing API key, or generate and store a new one if NULL.
|
||||||
|
pub async fn ensure_api_key(pool: &PgPool, user_id: Uuid) -> Result<String> {
|
||||||
|
let existing: Option<(Option<String>,)> =
|
||||||
|
sqlx::query_as("SELECT api_key FROM users WHERE id = $1")
|
||||||
|
.bind(user_id)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if let Some((Some(key),)) = existing {
|
||||||
|
return Ok(key);
|
||||||
|
}
|
||||||
|
|
||||||
|
let new_key = generate_api_key();
|
||||||
|
sqlx::query("UPDATE users SET api_key = $1 WHERE id = $2")
|
||||||
|
.bind(&new_key)
|
||||||
|
.bind(user_id)
|
||||||
|
.execute(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(new_key)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Generate a fresh API key for the user, replacing the old one.
|
||||||
|
pub async fn regenerate_api_key(pool: &PgPool, user_id: Uuid) -> Result<String> {
|
||||||
|
let new_key = generate_api_key();
|
||||||
|
sqlx::query("UPDATE users SET api_key = $1 WHERE id = $2")
|
||||||
|
.bind(&new_key)
|
||||||
|
.bind(user_id)
|
||||||
|
.execute(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(new_key)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Validate a Bearer token. Returns the `user_id` if the key matches.
|
||||||
|
pub async fn validate_api_key(pool: &PgPool, raw_key: &str) -> Result<Option<Uuid>> {
|
||||||
|
let row: Option<(Uuid,)> = sqlx::query_as("SELECT id FROM users WHERE api_key = $1")
|
||||||
|
.bind(raw_key)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(row.map(|(id,)| id))
|
||||||
|
}
|
||||||
268
crates/secrets-core/src/service/delete.rs
Normal file
268
crates/secrets-core/src/service/delete.rs
Normal file
@@ -0,0 +1,268 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::json;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::db;
|
||||||
|
use crate::models::{EntryRow, SecretFieldRow};
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct DeletedEntry {
|
||||||
|
pub namespace: String,
|
||||||
|
pub kind: String,
|
||||||
|
pub name: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct DeleteResult {
|
||||||
|
pub deleted: Vec<DeletedEntry>,
|
||||||
|
pub dry_run: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub struct DeleteParams<'a> {
|
||||||
|
pub namespace: &'a str,
|
||||||
|
pub kind: Option<&'a str>,
|
||||||
|
pub name: Option<&'a str>,
|
||||||
|
pub dry_run: bool,
|
||||||
|
pub user_id: Option<Uuid>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run(pool: &PgPool, params: DeleteParams<'_>) -> Result<DeleteResult> {
|
||||||
|
match params.name {
|
||||||
|
Some(name) => {
|
||||||
|
let kind = params
|
||||||
|
.kind
|
||||||
|
.ok_or_else(|| anyhow::anyhow!("--kind is required when --name is specified"))?;
|
||||||
|
delete_one(pool, params.namespace, kind, name, params.user_id).await
|
||||||
|
}
|
||||||
|
None => {
|
||||||
|
delete_bulk(
|
||||||
|
pool,
|
||||||
|
params.namespace,
|
||||||
|
params.kind,
|
||||||
|
params.dry_run,
|
||||||
|
params.user_id,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn delete_one(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<DeleteResult> {
|
||||||
|
let mut tx = pool.begin().await?;
|
||||||
|
|
||||||
|
let row: Option<EntryRow> = if let Some(uid) = user_id {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
|
WHERE user_id = $1 AND namespace = $2 AND kind = $3 AND name = $4 FOR UPDATE",
|
||||||
|
)
|
||||||
|
.bind(uid)
|
||||||
|
.bind(namespace)
|
||||||
|
.bind(kind)
|
||||||
|
.bind(name)
|
||||||
|
.fetch_optional(&mut *tx)
|
||||||
|
.await?
|
||||||
|
} else {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
|
WHERE user_id IS NULL AND namespace = $1 AND kind = $2 AND name = $3 FOR UPDATE",
|
||||||
|
)
|
||||||
|
.bind(namespace)
|
||||||
|
.bind(kind)
|
||||||
|
.bind(name)
|
||||||
|
.fetch_optional(&mut *tx)
|
||||||
|
.await?
|
||||||
|
};
|
||||||
|
|
||||||
|
let Some(row) = row else {
|
||||||
|
tx.rollback().await?;
|
||||||
|
return Ok(DeleteResult {
|
||||||
|
deleted: vec![],
|
||||||
|
dry_run: false,
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
snapshot_and_delete(&mut tx, namespace, kind, name, &row).await?;
|
||||||
|
crate::audit::log_tx(&mut tx, "delete", namespace, kind, name, json!({})).await;
|
||||||
|
tx.commit().await?;
|
||||||
|
|
||||||
|
Ok(DeleteResult {
|
||||||
|
deleted: vec![DeletedEntry {
|
||||||
|
namespace: namespace.to_string(),
|
||||||
|
kind: kind.to_string(),
|
||||||
|
name: name.to_string(),
|
||||||
|
}],
|
||||||
|
dry_run: false,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn delete_bulk(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: Option<&str>,
|
||||||
|
dry_run: bool,
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<DeleteResult> {
|
||||||
|
#[derive(Debug, sqlx::FromRow)]
|
||||||
|
struct FullEntryRow {
|
||||||
|
id: Uuid,
|
||||||
|
version: i64,
|
||||||
|
kind: String,
|
||||||
|
name: String,
|
||||||
|
metadata: serde_json::Value,
|
||||||
|
tags: Vec<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
let rows: Vec<FullEntryRow> = match (user_id, kind) {
|
||||||
|
(Some(uid), Some(k)) => {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
||||||
|
WHERE user_id = $1 AND namespace = $2 AND kind = $3 ORDER BY name",
|
||||||
|
)
|
||||||
|
.bind(uid)
|
||||||
|
.bind(namespace)
|
||||||
|
.bind(k)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?
|
||||||
|
}
|
||||||
|
(Some(uid), None) => {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
||||||
|
WHERE user_id = $1 AND namespace = $2 ORDER BY kind, name",
|
||||||
|
)
|
||||||
|
.bind(uid)
|
||||||
|
.bind(namespace)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?
|
||||||
|
}
|
||||||
|
(None, Some(k)) => {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
||||||
|
WHERE user_id IS NULL AND namespace = $1 AND kind = $2 ORDER BY name",
|
||||||
|
)
|
||||||
|
.bind(namespace)
|
||||||
|
.bind(k)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?
|
||||||
|
}
|
||||||
|
(None, None) => {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
||||||
|
WHERE user_id IS NULL AND namespace = $1 ORDER BY kind, name",
|
||||||
|
)
|
||||||
|
.bind(namespace)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
if dry_run {
|
||||||
|
let deleted = rows
|
||||||
|
.iter()
|
||||||
|
.map(|r| DeletedEntry {
|
||||||
|
namespace: namespace.to_string(),
|
||||||
|
kind: r.kind.clone(),
|
||||||
|
name: r.name.clone(),
|
||||||
|
})
|
||||||
|
.collect();
|
||||||
|
return Ok(DeleteResult {
|
||||||
|
deleted,
|
||||||
|
dry_run: true,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
let mut deleted = Vec::with_capacity(rows.len());
|
||||||
|
for row in &rows {
|
||||||
|
let entry_row = EntryRow {
|
||||||
|
id: row.id,
|
||||||
|
version: row.version,
|
||||||
|
tags: row.tags.clone(),
|
||||||
|
metadata: row.metadata.clone(),
|
||||||
|
};
|
||||||
|
let mut tx = pool.begin().await?;
|
||||||
|
snapshot_and_delete(&mut tx, namespace, &row.kind, &row.name, &entry_row).await?;
|
||||||
|
crate::audit::log_tx(
|
||||||
|
&mut tx,
|
||||||
|
"delete",
|
||||||
|
namespace,
|
||||||
|
&row.kind,
|
||||||
|
&row.name,
|
||||||
|
json!({"bulk": true}),
|
||||||
|
)
|
||||||
|
.await;
|
||||||
|
tx.commit().await?;
|
||||||
|
deleted.push(DeletedEntry {
|
||||||
|
namespace: namespace.to_string(),
|
||||||
|
kind: row.kind.clone(),
|
||||||
|
name: row.name.clone(),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(DeleteResult {
|
||||||
|
deleted,
|
||||||
|
dry_run: false,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn snapshot_and_delete(
|
||||||
|
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
row: &EntryRow,
|
||||||
|
) -> Result<()> {
|
||||||
|
if let Err(e) = db::snapshot_entry_history(
|
||||||
|
tx,
|
||||||
|
db::EntrySnapshotParams {
|
||||||
|
entry_id: row.id,
|
||||||
|
namespace,
|
||||||
|
kind,
|
||||||
|
name,
|
||||||
|
version: row.version,
|
||||||
|
action: "delete",
|
||||||
|
tags: &row.tags,
|
||||||
|
metadata: &row.metadata,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
tracing::warn!(error = %e, "failed to snapshot entry history before delete");
|
||||||
|
}
|
||||||
|
|
||||||
|
let fields: Vec<SecretFieldRow> =
|
||||||
|
sqlx::query_as("SELECT id, field_name, encrypted FROM secrets WHERE entry_id = $1")
|
||||||
|
.bind(row.id)
|
||||||
|
.fetch_all(&mut **tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
for f in &fields {
|
||||||
|
if let Err(e) = db::snapshot_secret_history(
|
||||||
|
tx,
|
||||||
|
db::SecretSnapshotParams {
|
||||||
|
entry_id: row.id,
|
||||||
|
secret_id: f.id,
|
||||||
|
entry_version: row.version,
|
||||||
|
field_name: &f.field_name,
|
||||||
|
encrypted: &f.encrypted,
|
||||||
|
action: "delete",
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
tracing::warn!(error = %e, "failed to snapshot secret history before delete");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
sqlx::query("DELETE FROM entries WHERE id = $1")
|
||||||
|
.bind(row.id)
|
||||||
|
.execute(&mut **tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
124
crates/secrets-core/src/service/env_map.rs
Normal file
124
crates/secrets-core/src/service/env_map.rs
Normal file
@@ -0,0 +1,124 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use std::collections::HashMap;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::crypto;
|
||||||
|
use crate::models::Entry;
|
||||||
|
use crate::service::search::{fetch_entries, fetch_secrets_for_entries};
|
||||||
|
|
||||||
|
/// Build an env variable map from entry secrets (for dry-run preview or injection).
|
||||||
|
#[allow(clippy::too_many_arguments)]
|
||||||
|
pub async fn build_env_map(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: Option<&str>,
|
||||||
|
kind: Option<&str>,
|
||||||
|
name: Option<&str>,
|
||||||
|
tags: &[String],
|
||||||
|
only_fields: &[String],
|
||||||
|
prefix: &str,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<HashMap<String, String>> {
|
||||||
|
let entries = fetch_entries(pool, namespace, kind, name, tags, None, user_id).await?;
|
||||||
|
|
||||||
|
let mut combined: HashMap<String, String> = HashMap::new();
|
||||||
|
|
||||||
|
for entry in &entries {
|
||||||
|
let entry_map = build_entry_env_map(pool, entry, only_fields, prefix, master_key).await?;
|
||||||
|
combined.extend(entry_map);
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(combined)
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn build_entry_env_map(
|
||||||
|
pool: &PgPool,
|
||||||
|
entry: &Entry,
|
||||||
|
only_fields: &[String],
|
||||||
|
prefix: &str,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
) -> Result<HashMap<String, String>> {
|
||||||
|
let entry_ids = vec![entry.id];
|
||||||
|
let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
|
||||||
|
let all_fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
|
||||||
|
|
||||||
|
let fields: Vec<_> = if only_fields.is_empty() {
|
||||||
|
all_fields.iter().collect()
|
||||||
|
} else {
|
||||||
|
all_fields
|
||||||
|
.iter()
|
||||||
|
.filter(|f| only_fields.contains(&f.field_name))
|
||||||
|
.collect()
|
||||||
|
};
|
||||||
|
|
||||||
|
let effective_prefix = env_prefix(entry, prefix);
|
||||||
|
let mut map = HashMap::new();
|
||||||
|
|
||||||
|
for f in fields {
|
||||||
|
let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
|
||||||
|
let key = format!(
|
||||||
|
"{}_{}",
|
||||||
|
effective_prefix,
|
||||||
|
f.field_name.to_uppercase().replace(['-', '.'], "_")
|
||||||
|
);
|
||||||
|
map.insert(key, json_to_env_string(&decrypted));
|
||||||
|
}
|
||||||
|
|
||||||
|
// Resolve key_ref
|
||||||
|
if let Some(key_ref) = entry.metadata.get("key_ref").and_then(|v| v.as_str()) {
|
||||||
|
let key_entries = fetch_entries(
|
||||||
|
pool,
|
||||||
|
Some(&entry.namespace),
|
||||||
|
Some("key"),
|
||||||
|
Some(key_ref),
|
||||||
|
&[],
|
||||||
|
None,
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if let Some(key_entry) = key_entries.first() {
|
||||||
|
let key_ids = vec![key_entry.id];
|
||||||
|
let key_fields_map = fetch_secrets_for_entries(pool, &key_ids).await?;
|
||||||
|
let empty = vec![];
|
||||||
|
let key_fields = key_fields_map.get(&key_entry.id).unwrap_or(&empty);
|
||||||
|
let key_prefix = env_prefix(key_entry, prefix);
|
||||||
|
for f in key_fields {
|
||||||
|
let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
|
||||||
|
let key_var = format!(
|
||||||
|
"{}_{}",
|
||||||
|
key_prefix,
|
||||||
|
f.field_name.to_uppercase().replace(['-', '.'], "_")
|
||||||
|
);
|
||||||
|
map.insert(key_var, json_to_env_string(&decrypted));
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
tracing::warn!(key_ref, "key_ref target not found");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(map)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn env_prefix(entry: &Entry, prefix: &str) -> String {
|
||||||
|
let name_part = entry.name.to_uppercase().replace(['-', '.', ' '], "_");
|
||||||
|
if prefix.is_empty() {
|
||||||
|
name_part
|
||||||
|
} else {
|
||||||
|
format!(
|
||||||
|
"{}_{}",
|
||||||
|
prefix.to_uppercase().replace(['-', '.', ' '], "_"),
|
||||||
|
name_part
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn json_to_env_string(v: &Value) -> String {
|
||||||
|
match v {
|
||||||
|
Value::String(s) => s.clone(),
|
||||||
|
Value::Null => String::new(),
|
||||||
|
other => other.to_string(),
|
||||||
|
}
|
||||||
|
}
|
||||||
139
crates/secrets-core/src/service/export.rs
Normal file
139
crates/secrets-core/src/service/export.rs
Normal file
@@ -0,0 +1,139 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use std::collections::{BTreeMap, HashMap};
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::crypto;
|
||||||
|
use crate::models::{ExportData, ExportEntry, ExportFormat};
|
||||||
|
use crate::service::search::{fetch_entries, fetch_secrets_for_entries};
|
||||||
|
|
||||||
|
pub struct ExportParams<'a> {
|
||||||
|
pub namespace: Option<&'a str>,
|
||||||
|
pub kind: Option<&'a str>,
|
||||||
|
pub name: Option<&'a str>,
|
||||||
|
pub tags: &'a [String],
|
||||||
|
pub query: Option<&'a str>,
|
||||||
|
pub no_secrets: bool,
|
||||||
|
pub user_id: Option<Uuid>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn export(
|
||||||
|
pool: &PgPool,
|
||||||
|
params: ExportParams<'_>,
|
||||||
|
master_key: Option<&[u8; 32]>,
|
||||||
|
) -> Result<ExportData> {
|
||||||
|
let entries = fetch_entries(
|
||||||
|
pool,
|
||||||
|
params.namespace,
|
||||||
|
params.kind,
|
||||||
|
params.name,
|
||||||
|
params.tags,
|
||||||
|
params.query,
|
||||||
|
params.user_id,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
let entry_ids: Vec<Uuid> = entries.iter().map(|e| e.id).collect();
|
||||||
|
let secrets_map: HashMap<Uuid, Vec<_>> = if !params.no_secrets && !entry_ids.is_empty() {
|
||||||
|
fetch_secrets_for_entries(pool, &entry_ids).await?
|
||||||
|
} else {
|
||||||
|
HashMap::new()
|
||||||
|
};
|
||||||
|
|
||||||
|
let mut export_entries: Vec<ExportEntry> = Vec::with_capacity(entries.len());
|
||||||
|
for entry in &entries {
|
||||||
|
let secrets = if params.no_secrets {
|
||||||
|
None
|
||||||
|
} else {
|
||||||
|
let fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
|
||||||
|
if fields.is_empty() {
|
||||||
|
Some(BTreeMap::new())
|
||||||
|
} else {
|
||||||
|
let mk = master_key
|
||||||
|
.ok_or_else(|| anyhow::anyhow!("master key required to decrypt secrets"))?;
|
||||||
|
let mut map = BTreeMap::new();
|
||||||
|
for f in fields {
|
||||||
|
let decrypted = crypto::decrypt_json(mk, &f.encrypted)?;
|
||||||
|
map.insert(f.field_name.clone(), decrypted);
|
||||||
|
}
|
||||||
|
Some(map)
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
export_entries.push(ExportEntry {
|
||||||
|
namespace: entry.namespace.clone(),
|
||||||
|
kind: entry.kind.clone(),
|
||||||
|
name: entry.name.clone(),
|
||||||
|
tags: entry.tags.clone(),
|
||||||
|
metadata: entry.metadata.clone(),
|
||||||
|
secrets,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(ExportData {
|
||||||
|
version: 1,
|
||||||
|
exported_at: chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
||||||
|
entries: export_entries,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn export_to_file(
|
||||||
|
pool: &PgPool,
|
||||||
|
params: ExportParams<'_>,
|
||||||
|
master_key: Option<&[u8; 32]>,
|
||||||
|
file_path: &str,
|
||||||
|
format_override: Option<&str>,
|
||||||
|
) -> Result<usize> {
|
||||||
|
let format = if let Some(f) = format_override {
|
||||||
|
f.parse::<ExportFormat>()?
|
||||||
|
} else {
|
||||||
|
ExportFormat::from_extension(file_path).unwrap_or(ExportFormat::Json)
|
||||||
|
};
|
||||||
|
|
||||||
|
let data = export(pool, params, master_key).await?;
|
||||||
|
let count = data.entries.len();
|
||||||
|
let serialized = format.serialize(&data)?;
|
||||||
|
std::fs::write(file_path, &serialized)?;
|
||||||
|
Ok(count)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn export_to_string(
|
||||||
|
pool: &PgPool,
|
||||||
|
params: ExportParams<'_>,
|
||||||
|
master_key: Option<&[u8; 32]>,
|
||||||
|
format: &str,
|
||||||
|
) -> Result<String> {
|
||||||
|
let fmt = format.parse::<ExportFormat>()?;
|
||||||
|
let data = export(pool, params, master_key).await?;
|
||||||
|
fmt.serialize(&data)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Build helpers for re-encoding values as CLI-style entries ─────────────────
|
||||||
|
|
||||||
|
pub fn build_meta_entries(metadata: &Value) -> Vec<String> {
|
||||||
|
let mut entries = Vec::new();
|
||||||
|
if let Some(obj) = metadata.as_object() {
|
||||||
|
for (k, v) in obj {
|
||||||
|
entries.push(value_to_kv_entry(k, v));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
entries
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn build_secret_entries(secrets: Option<&BTreeMap<String, Value>>) -> Vec<String> {
|
||||||
|
let mut entries = Vec::new();
|
||||||
|
if let Some(map) = secrets {
|
||||||
|
for (k, v) in map {
|
||||||
|
entries.push(value_to_kv_entry(k, v));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
entries
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn value_to_kv_entry(key: &str, value: &Value) -> String {
|
||||||
|
match value {
|
||||||
|
Value::String(s) => format!("{}={}", key, s),
|
||||||
|
other => format!("{}:={}", key, other),
|
||||||
|
}
|
||||||
|
}
|
||||||
79
crates/secrets-core/src/service/get_secret.rs
Normal file
79
crates/secrets-core/src/service/get_secret.rs
Normal file
@@ -0,0 +1,79 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use std::collections::HashMap;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::crypto;
|
||||||
|
use crate::service::search::{fetch_entries, fetch_secrets_for_entries};
|
||||||
|
|
||||||
|
/// Decrypt a single named field from an entry.
|
||||||
|
pub async fn get_secret_field(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
field_name: &str,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<Value> {
|
||||||
|
let entries = fetch_entries(
|
||||||
|
pool,
|
||||||
|
Some(namespace),
|
||||||
|
Some(kind),
|
||||||
|
Some(name),
|
||||||
|
&[],
|
||||||
|
None,
|
||||||
|
user_id,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let entry = entries
|
||||||
|
.first()
|
||||||
|
.ok_or_else(|| anyhow::anyhow!("Not found: [{}/{}] {}", namespace, kind, name))?;
|
||||||
|
|
||||||
|
let entry_ids = vec![entry.id];
|
||||||
|
let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
|
||||||
|
let fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
|
||||||
|
|
||||||
|
let field = fields
|
||||||
|
.iter()
|
||||||
|
.find(|f| f.field_name == field_name)
|
||||||
|
.ok_or_else(|| anyhow::anyhow!("Secret field '{}' not found", field_name))?;
|
||||||
|
|
||||||
|
crypto::decrypt_json(master_key, &field.encrypted)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Decrypt all secret fields from an entry. Returns a map field_name → decrypted Value.
|
||||||
|
pub async fn get_all_secrets(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<HashMap<String, Value>> {
|
||||||
|
let entries = fetch_entries(
|
||||||
|
pool,
|
||||||
|
Some(namespace),
|
||||||
|
Some(kind),
|
||||||
|
Some(name),
|
||||||
|
&[],
|
||||||
|
None,
|
||||||
|
user_id,
|
||||||
|
)
|
||||||
|
.await?;
|
||||||
|
let entry = entries
|
||||||
|
.first()
|
||||||
|
.ok_or_else(|| anyhow::anyhow!("Not found: [{}/{}] {}", namespace, kind, name))?;
|
||||||
|
|
||||||
|
let entry_ids = vec![entry.id];
|
||||||
|
let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
|
||||||
|
let fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
|
||||||
|
|
||||||
|
let mut map = HashMap::new();
|
||||||
|
for f in fields {
|
||||||
|
let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
|
||||||
|
map.insert(f.field_name.clone(), decrypted);
|
||||||
|
}
|
||||||
|
Ok(map)
|
||||||
|
}
|
||||||
63
crates/secrets-core/src/service/history.rs
Normal file
63
crates/secrets-core/src/service/history.rs
Normal file
@@ -0,0 +1,63 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct HistoryEntry {
|
||||||
|
pub version: i64,
|
||||||
|
pub action: String,
|
||||||
|
pub actor: String,
|
||||||
|
pub created_at: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
limit: u32,
|
||||||
|
_user_id: Option<Uuid>,
|
||||||
|
) -> Result<Vec<HistoryEntry>> {
|
||||||
|
#[derive(sqlx::FromRow)]
|
||||||
|
struct Row {
|
||||||
|
version: i64,
|
||||||
|
action: String,
|
||||||
|
actor: String,
|
||||||
|
created_at: chrono::DateTime<chrono::Utc>,
|
||||||
|
}
|
||||||
|
|
||||||
|
let rows: Vec<Row> = sqlx::query_as(
|
||||||
|
"SELECT version, action, actor, created_at FROM entries_history \
|
||||||
|
WHERE namespace = $1 AND kind = $2 AND name = $3 \
|
||||||
|
ORDER BY id DESC LIMIT $4",
|
||||||
|
)
|
||||||
|
.bind(namespace)
|
||||||
|
.bind(kind)
|
||||||
|
.bind(name)
|
||||||
|
.bind(limit as i64)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
Ok(rows
|
||||||
|
.into_iter()
|
||||||
|
.map(|r| HistoryEntry {
|
||||||
|
version: r.version,
|
||||||
|
action: r.action,
|
||||||
|
actor: r.actor,
|
||||||
|
created_at: r.created_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
||||||
|
})
|
||||||
|
.collect())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run_json(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
limit: u32,
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<Value> {
|
||||||
|
let entries = run(pool, namespace, kind, name, limit, user_id).await?;
|
||||||
|
Ok(serde_json::to_value(entries)?)
|
||||||
|
}
|
||||||
123
crates/secrets-core/src/service/import.rs
Normal file
123
crates/secrets-core/src/service/import.rs
Normal file
@@ -0,0 +1,123 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::models::ExportFormat;
|
||||||
|
use crate::service::add::{AddParams, run as add_run};
|
||||||
|
use crate::service::export::{build_meta_entries, build_secret_entries};
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct ImportSummary {
|
||||||
|
pub total: usize,
|
||||||
|
pub inserted: usize,
|
||||||
|
pub skipped: usize,
|
||||||
|
pub failed: usize,
|
||||||
|
pub dry_run: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub struct ImportParams<'a> {
|
||||||
|
pub file: &'a str,
|
||||||
|
pub force: bool,
|
||||||
|
pub dry_run: bool,
|
||||||
|
pub user_id: Option<Uuid>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run(
|
||||||
|
pool: &PgPool,
|
||||||
|
params: ImportParams<'_>,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
) -> Result<ImportSummary> {
|
||||||
|
let format = ExportFormat::from_extension(params.file)?;
|
||||||
|
let content = std::fs::read_to_string(params.file)
|
||||||
|
.map_err(|e| anyhow::anyhow!("Cannot read file '{}': {}", params.file, e))?;
|
||||||
|
let data = format.deserialize(&content)?;
|
||||||
|
|
||||||
|
if data.version != 1 {
|
||||||
|
anyhow::bail!(
|
||||||
|
"Unsupported export version {}. Only version 1 is supported.",
|
||||||
|
data.version
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let total = data.entries.len();
|
||||||
|
let mut inserted = 0usize;
|
||||||
|
let mut skipped = 0usize;
|
||||||
|
let mut failed = 0usize;
|
||||||
|
|
||||||
|
for entry in &data.entries {
|
||||||
|
let exists: bool = sqlx::query_scalar(
|
||||||
|
"SELECT EXISTS(SELECT 1 FROM entries \
|
||||||
|
WHERE namespace = $1 AND kind = $2 AND name = $3 AND user_id IS NOT DISTINCT FROM $4)",
|
||||||
|
)
|
||||||
|
.bind(&entry.namespace)
|
||||||
|
.bind(&entry.kind)
|
||||||
|
.bind(&entry.name)
|
||||||
|
.bind(params.user_id)
|
||||||
|
.fetch_one(pool)
|
||||||
|
.await
|
||||||
|
.unwrap_or(false);
|
||||||
|
|
||||||
|
if exists && !params.force {
|
||||||
|
return Err(anyhow::anyhow!(
|
||||||
|
"Import aborted: conflict on [{}/{}/{}]",
|
||||||
|
entry.namespace,
|
||||||
|
entry.kind,
|
||||||
|
entry.name
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.dry_run {
|
||||||
|
if exists {
|
||||||
|
skipped += 1;
|
||||||
|
} else {
|
||||||
|
inserted += 1;
|
||||||
|
}
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
let secret_entries = build_secret_entries(entry.secrets.as_ref());
|
||||||
|
let meta_entries = build_meta_entries(&entry.metadata);
|
||||||
|
|
||||||
|
match add_run(
|
||||||
|
pool,
|
||||||
|
AddParams {
|
||||||
|
namespace: &entry.namespace,
|
||||||
|
kind: &entry.kind,
|
||||||
|
name: &entry.name,
|
||||||
|
tags: &entry.tags,
|
||||||
|
meta_entries: &meta_entries,
|
||||||
|
secret_entries: &secret_entries,
|
||||||
|
user_id: params.user_id,
|
||||||
|
},
|
||||||
|
master_key,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
{
|
||||||
|
Ok(_) => {
|
||||||
|
inserted += 1;
|
||||||
|
}
|
||||||
|
Err(e) => {
|
||||||
|
tracing::error!(
|
||||||
|
namespace = entry.namespace,
|
||||||
|
kind = entry.kind,
|
||||||
|
name = entry.name,
|
||||||
|
error = %e,
|
||||||
|
"failed to import entry"
|
||||||
|
);
|
||||||
|
failed += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if failed > 0 {
|
||||||
|
return Err(anyhow::anyhow!("{} record(s) failed to import", failed));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(ImportSummary {
|
||||||
|
total,
|
||||||
|
inserted,
|
||||||
|
skipped,
|
||||||
|
failed,
|
||||||
|
dry_run: params.dry_run,
|
||||||
|
})
|
||||||
|
}
|
||||||
12
crates/secrets-core/src/service/mod.rs
Normal file
12
crates/secrets-core/src/service/mod.rs
Normal file
@@ -0,0 +1,12 @@
|
|||||||
|
pub mod add;
|
||||||
|
pub mod api_key;
|
||||||
|
pub mod delete;
|
||||||
|
pub mod env_map;
|
||||||
|
pub mod export;
|
||||||
|
pub mod get_secret;
|
||||||
|
pub mod history;
|
||||||
|
pub mod import;
|
||||||
|
pub mod rollback;
|
||||||
|
pub mod search;
|
||||||
|
pub mod update;
|
||||||
|
pub mod user;
|
||||||
@@ -1,24 +1,29 @@
|
|||||||
use anyhow::Result;
|
use anyhow::Result;
|
||||||
use serde_json::{Value, json};
|
use serde_json::Value;
|
||||||
use sqlx::{FromRow, PgPool};
|
use sqlx::PgPool;
|
||||||
use uuid::Uuid;
|
use uuid::Uuid;
|
||||||
|
|
||||||
use crate::crypto;
|
use crate::crypto;
|
||||||
use crate::db;
|
use crate::db;
|
||||||
use crate::output::{OutputMode, print_json};
|
|
||||||
|
|
||||||
pub struct RollbackArgs<'a> {
|
#[derive(Debug, serde::Serialize)]
|
||||||
pub namespace: &'a str,
|
pub struct RollbackResult {
|
||||||
pub kind: &'a str,
|
pub namespace: String,
|
||||||
pub name: &'a str,
|
pub kind: String,
|
||||||
/// Target entry version to restore. None → restore the most recent history entry.
|
pub name: String,
|
||||||
pub to_version: Option<i64>,
|
pub restored_version: i64,
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
|
pub async fn run(
|
||||||
// ── Find the target entry history snapshot ────────────────────────────────
|
pool: &PgPool,
|
||||||
#[derive(FromRow)]
|
namespace: &str,
|
||||||
|
kind: &str,
|
||||||
|
name: &str,
|
||||||
|
to_version: Option<i64>,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
_user_id: Option<Uuid>,
|
||||||
|
) -> Result<RollbackResult> {
|
||||||
|
#[derive(sqlx::FromRow)]
|
||||||
struct EntryHistoryRow {
|
struct EntryHistoryRow {
|
||||||
entry_id: Uuid,
|
entry_id: Uuid,
|
||||||
version: i64,
|
version: i64,
|
||||||
@@ -27,29 +32,26 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
metadata: Value,
|
metadata: Value,
|
||||||
}
|
}
|
||||||
|
|
||||||
let snap: Option<EntryHistoryRow> = if let Some(ver) = args.to_version {
|
let snap: Option<EntryHistoryRow> = if let Some(ver) = to_version {
|
||||||
sqlx::query_as(
|
sqlx::query_as(
|
||||||
"SELECT entry_id, version, action, tags, metadata \
|
"SELECT entry_id, version, action, tags, metadata FROM entries_history \
|
||||||
FROM entries_history \
|
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 AND version = $4 \
|
WHERE namespace = $1 AND kind = $2 AND name = $3 AND version = $4 \
|
||||||
ORDER BY id DESC LIMIT 1",
|
ORDER BY id DESC LIMIT 1",
|
||||||
)
|
)
|
||||||
.bind(args.namespace)
|
.bind(namespace)
|
||||||
.bind(args.kind)
|
.bind(kind)
|
||||||
.bind(args.name)
|
.bind(name)
|
||||||
.bind(ver)
|
.bind(ver)
|
||||||
.fetch_optional(pool)
|
.fetch_optional(pool)
|
||||||
.await?
|
.await?
|
||||||
} else {
|
} else {
|
||||||
sqlx::query_as(
|
sqlx::query_as(
|
||||||
"SELECT entry_id, version, action, tags, metadata \
|
"SELECT entry_id, version, action, tags, metadata FROM entries_history \
|
||||||
FROM entries_history \
|
WHERE namespace = $1 AND kind = $2 AND name = $3 ORDER BY id DESC LIMIT 1",
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 \
|
|
||||||
ORDER BY id DESC LIMIT 1",
|
|
||||||
)
|
)
|
||||||
.bind(args.namespace)
|
.bind(namespace)
|
||||||
.bind(args.kind)
|
.bind(kind)
|
||||||
.bind(args.name)
|
.bind(name)
|
||||||
.fetch_optional(pool)
|
.fetch_optional(pool)
|
||||||
.await?
|
.await?
|
||||||
};
|
};
|
||||||
@@ -57,17 +59,16 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
let snap = snap.ok_or_else(|| {
|
let snap = snap.ok_or_else(|| {
|
||||||
anyhow::anyhow!(
|
anyhow::anyhow!(
|
||||||
"No history found for [{}/{}] {}{}.",
|
"No history found for [{}/{}] {}{}.",
|
||||||
args.namespace,
|
namespace,
|
||||||
args.kind,
|
kind,
|
||||||
args.name,
|
name,
|
||||||
args.to_version
|
to_version
|
||||||
.map(|v| format!(" at version {}", v))
|
.map(|v| format!(" at version {}", v))
|
||||||
.unwrap_or_default()
|
.unwrap_or_default()
|
||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
|
|
||||||
// ── Find the matching secret field snapshots ──────────────────────────────
|
#[derive(sqlx::FromRow)]
|
||||||
#[derive(FromRow)]
|
|
||||||
struct SecretHistoryRow {
|
struct SecretHistoryRow {
|
||||||
secret_id: Uuid,
|
secret_id: Uuid,
|
||||||
field_name: String,
|
field_name: String,
|
||||||
@@ -76,17 +77,14 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
}
|
}
|
||||||
|
|
||||||
let field_snaps: Vec<SecretHistoryRow> = sqlx::query_as(
|
let field_snaps: Vec<SecretHistoryRow> = sqlx::query_as(
|
||||||
"SELECT secret_id, field_name, encrypted, action \
|
"SELECT secret_id, field_name, encrypted, action FROM secrets_history \
|
||||||
FROM secrets_history \
|
WHERE entry_id = $1 AND entry_version = $2 ORDER BY field_name",
|
||||||
WHERE entry_id = $1 AND entry_version = $2 \
|
|
||||||
ORDER BY field_name",
|
|
||||||
)
|
)
|
||||||
.bind(snap.entry_id)
|
.bind(snap.entry_id)
|
||||||
.bind(snap.version)
|
.bind(snap.version)
|
||||||
.fetch_all(pool)
|
.fetch_all(pool)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
// Validate: try decrypting all encrypted fields before writing anything.
|
|
||||||
for f in &field_snaps {
|
for f in &field_snaps {
|
||||||
if f.action != "delete" && !f.encrypted.is_empty() {
|
if f.action != "delete" && !f.encrypted.is_empty() {
|
||||||
crypto::decrypt_json(master_key, &f.encrypted).map_err(|e| {
|
crypto::decrypt_json(master_key, &f.encrypted).map_err(|e| {
|
||||||
@@ -101,7 +99,6 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
|
|
||||||
let mut tx = pool.begin().await?;
|
let mut tx = pool.begin().await?;
|
||||||
|
|
||||||
// ── Snapshot the current live state before overwriting ────────────────────
|
|
||||||
#[derive(sqlx::FromRow)]
|
#[derive(sqlx::FromRow)]
|
||||||
struct LiveEntry {
|
struct LiveEntry {
|
||||||
id: Uuid,
|
id: Uuid,
|
||||||
@@ -113,9 +110,9 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
"SELECT id, version, tags, metadata FROM entries \
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 FOR UPDATE",
|
WHERE namespace = $1 AND kind = $2 AND name = $3 FOR UPDATE",
|
||||||
)
|
)
|
||||||
.bind(args.namespace)
|
.bind(namespace)
|
||||||
.bind(args.kind)
|
.bind(kind)
|
||||||
.bind(args.name)
|
.bind(name)
|
||||||
.fetch_optional(&mut *tx)
|
.fetch_optional(&mut *tx)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
@@ -124,9 +121,9 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
&mut tx,
|
&mut tx,
|
||||||
db::EntrySnapshotParams {
|
db::EntrySnapshotParams {
|
||||||
entry_id: lr.id,
|
entry_id: lr.id,
|
||||||
namespace: args.namespace,
|
namespace,
|
||||||
kind: args.kind,
|
kind,
|
||||||
name: args.name,
|
name,
|
||||||
version: lr.version,
|
version: lr.version,
|
||||||
action: "rollback",
|
action: "rollback",
|
||||||
tags: &lr.tags,
|
tags: &lr.tags,
|
||||||
@@ -138,20 +135,17 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
tracing::warn!(error = %e, "failed to snapshot entry before rollback");
|
tracing::warn!(error = %e, "failed to snapshot entry before rollback");
|
||||||
}
|
}
|
||||||
|
|
||||||
// Snapshot existing secret fields.
|
|
||||||
#[derive(sqlx::FromRow)]
|
#[derive(sqlx::FromRow)]
|
||||||
struct LiveField {
|
struct LiveField {
|
||||||
id: Uuid,
|
id: Uuid,
|
||||||
field_name: String,
|
field_name: String,
|
||||||
encrypted: Vec<u8>,
|
encrypted: Vec<u8>,
|
||||||
}
|
}
|
||||||
let live_fields: Vec<LiveField> = sqlx::query_as(
|
let live_fields: Vec<LiveField> =
|
||||||
"SELECT id, field_name, encrypted \
|
sqlx::query_as("SELECT id, field_name, encrypted FROM secrets WHERE entry_id = $1")
|
||||||
FROM secrets WHERE entry_id = $1",
|
.bind(lr.id)
|
||||||
)
|
.fetch_all(&mut *tx)
|
||||||
.bind(lr.id)
|
.await?;
|
||||||
.fetch_all(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
for f in &live_fields {
|
for f in &live_fields {
|
||||||
if let Err(e) = db::snapshot_secret_history(
|
if let Err(e) = db::snapshot_secret_history(
|
||||||
@@ -172,29 +166,23 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Restore entry row ─────────────────────────────────────────────────────
|
|
||||||
sqlx::query(
|
sqlx::query(
|
||||||
"INSERT INTO entries (id, namespace, kind, name, tags, metadata, version, updated_at) \
|
"INSERT INTO entries (id, namespace, kind, name, tags, metadata, version, updated_at) \
|
||||||
VALUES ($1, $2, $3, $4, $5, $6, $7, NOW()) \
|
VALUES ($1, $2, $3, $4, $5, $6, $7, NOW()) \
|
||||||
ON CONFLICT (namespace, kind, name) DO UPDATE SET \
|
ON CONFLICT (namespace, kind, name) WHERE user_id IS NULL DO UPDATE SET \
|
||||||
tags = EXCLUDED.tags, \
|
tags = EXCLUDED.tags, metadata = EXCLUDED.metadata, \
|
||||||
metadata = EXCLUDED.metadata, \
|
version = entries.version + 1, updated_at = NOW()",
|
||||||
version = entries.version + 1, \
|
|
||||||
updated_at = NOW()",
|
|
||||||
)
|
)
|
||||||
.bind(snap.entry_id)
|
.bind(snap.entry_id)
|
||||||
.bind(args.namespace)
|
.bind(namespace)
|
||||||
.bind(args.kind)
|
.bind(kind)
|
||||||
.bind(args.name)
|
.bind(name)
|
||||||
.bind(&snap.tags)
|
.bind(&snap.tags)
|
||||||
.bind(&snap.metadata)
|
.bind(&snap.metadata)
|
||||||
.bind(snap.version)
|
.bind(snap.version)
|
||||||
.execute(&mut *tx)
|
.execute(&mut *tx)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
// ── Restore secret fields ─────────────────────────────────────────────────
|
|
||||||
// Delete all current fields and re-insert from snapshot
|
|
||||||
// (only non-deleted fields from the snapshot are restored).
|
|
||||||
sqlx::query("DELETE FROM secrets WHERE entry_id = $1")
|
sqlx::query("DELETE FROM secrets WHERE entry_id = $1")
|
||||||
.bind(snap.entry_id)
|
.bind(snap.entry_id)
|
||||||
.execute(&mut *tx)
|
.execute(&mut *tx)
|
||||||
@@ -202,16 +190,12 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
|
|
||||||
for f in &field_snaps {
|
for f in &field_snaps {
|
||||||
if f.action == "delete" {
|
if f.action == "delete" {
|
||||||
// Field was deleted at this snapshot point — don't restore it.
|
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
sqlx::query(
|
sqlx::query(
|
||||||
"INSERT INTO secrets (id, entry_id, field_name, encrypted) \
|
"INSERT INTO secrets (id, entry_id, field_name, encrypted) VALUES ($1, $2, $3, $4) \
|
||||||
VALUES ($1, $2, $3, $4) \
|
|
||||||
ON CONFLICT (entry_id, field_name) DO UPDATE SET \
|
ON CONFLICT (entry_id, field_name) DO UPDATE SET \
|
||||||
encrypted = EXCLUDED.encrypted, \
|
encrypted = EXCLUDED.encrypted, version = secrets.version + 1, updated_at = NOW()",
|
||||||
version = secrets.version + 1, \
|
|
||||||
updated_at = NOW()",
|
|
||||||
)
|
)
|
||||||
.bind(f.secret_id)
|
.bind(f.secret_id)
|
||||||
.bind(snap.entry_id)
|
.bind(snap.entry_id)
|
||||||
@@ -224,10 +208,10 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
crate::audit::log_tx(
|
crate::audit::log_tx(
|
||||||
&mut tx,
|
&mut tx,
|
||||||
"rollback",
|
"rollback",
|
||||||
args.namespace,
|
namespace,
|
||||||
args.kind,
|
kind,
|
||||||
args.name,
|
name,
|
||||||
json!({
|
serde_json::json!({
|
||||||
"restored_version": snap.version,
|
"restored_version": snap.version,
|
||||||
"original_action": snap.action,
|
"original_action": snap.action,
|
||||||
}),
|
}),
|
||||||
@@ -236,21 +220,10 @@ pub async fn run(pool: &PgPool, args: RollbackArgs<'_>, master_key: &[u8; 32]) -
|
|||||||
|
|
||||||
tx.commit().await?;
|
tx.commit().await?;
|
||||||
|
|
||||||
let result_json = json!({
|
Ok(RollbackResult {
|
||||||
"action": "rolled_back",
|
namespace: namespace.to_string(),
|
||||||
"namespace": args.namespace,
|
kind: kind.to_string(),
|
||||||
"kind": args.kind,
|
name: name.to_string(),
|
||||||
"name": args.name,
|
restored_version: snap.version,
|
||||||
"restored_version": snap.version,
|
})
|
||||||
});
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => println!(
|
|
||||||
"Rolled back: [{}/{}] {} → version {}",
|
|
||||||
args.namespace, args.kind, args.name, snap.version
|
|
||||||
),
|
|
||||||
ref mode => print_json(&result_json, mode)?,
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
}
|
||||||
241
crates/secrets-core/src/service/search.rs
Normal file
241
crates/secrets-core/src/service/search.rs
Normal file
@@ -0,0 +1,241 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use std::collections::HashMap;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::models::{Entry, SecretField};
|
||||||
|
|
||||||
|
pub const FETCH_ALL_LIMIT: u32 = 100_000;
|
||||||
|
|
||||||
|
pub struct SearchParams<'a> {
|
||||||
|
pub namespace: Option<&'a str>,
|
||||||
|
pub kind: Option<&'a str>,
|
||||||
|
pub name: Option<&'a str>,
|
||||||
|
pub tags: &'a [String],
|
||||||
|
pub query: Option<&'a str>,
|
||||||
|
pub sort: &'a str,
|
||||||
|
pub limit: u32,
|
||||||
|
pub offset: u32,
|
||||||
|
/// Multi-user: filter by this user_id. None = single-user / no filter.
|
||||||
|
pub user_id: Option<Uuid>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct SearchResult {
|
||||||
|
pub entries: Vec<Entry>,
|
||||||
|
pub secret_schemas: HashMap<Uuid, Vec<SecretField>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub async fn run(pool: &PgPool, params: SearchParams<'_>) -> Result<SearchResult> {
|
||||||
|
let entries = fetch_entries_paged(pool, ¶ms).await?;
|
||||||
|
let entry_ids: Vec<Uuid> = entries.iter().map(|e| e.id).collect();
|
||||||
|
let secret_schemas = if !entry_ids.is_empty() {
|
||||||
|
fetch_secret_schemas(pool, &entry_ids).await?
|
||||||
|
} else {
|
||||||
|
HashMap::new()
|
||||||
|
};
|
||||||
|
Ok(SearchResult {
|
||||||
|
entries,
|
||||||
|
secret_schemas,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Fetch entries matching the given filters — returns all matching entries up to FETCH_ALL_LIMIT.
|
||||||
|
pub async fn fetch_entries(
|
||||||
|
pool: &PgPool,
|
||||||
|
namespace: Option<&str>,
|
||||||
|
kind: Option<&str>,
|
||||||
|
name: Option<&str>,
|
||||||
|
tags: &[String],
|
||||||
|
query: Option<&str>,
|
||||||
|
user_id: Option<Uuid>,
|
||||||
|
) -> Result<Vec<Entry>> {
|
||||||
|
let params = SearchParams {
|
||||||
|
namespace,
|
||||||
|
kind,
|
||||||
|
name,
|
||||||
|
tags,
|
||||||
|
query,
|
||||||
|
sort: "name",
|
||||||
|
limit: FETCH_ALL_LIMIT,
|
||||||
|
offset: 0,
|
||||||
|
user_id,
|
||||||
|
};
|
||||||
|
fetch_entries_paged(pool, ¶ms).await
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<Entry>> {
|
||||||
|
let mut conditions: Vec<String> = Vec::new();
|
||||||
|
let mut idx: i32 = 1;
|
||||||
|
|
||||||
|
// user_id filtering — always comes first when present
|
||||||
|
if a.user_id.is_some() {
|
||||||
|
conditions.push(format!("user_id = ${}", idx));
|
||||||
|
idx += 1;
|
||||||
|
} else {
|
||||||
|
conditions.push("user_id IS NULL".to_string());
|
||||||
|
}
|
||||||
|
|
||||||
|
if a.namespace.is_some() {
|
||||||
|
conditions.push(format!("namespace = ${}", idx));
|
||||||
|
idx += 1;
|
||||||
|
}
|
||||||
|
if a.kind.is_some() {
|
||||||
|
conditions.push(format!("kind = ${}", idx));
|
||||||
|
idx += 1;
|
||||||
|
}
|
||||||
|
if a.name.is_some() {
|
||||||
|
conditions.push(format!("name = ${}", idx));
|
||||||
|
idx += 1;
|
||||||
|
}
|
||||||
|
if !a.tags.is_empty() {
|
||||||
|
let placeholders: Vec<String> = a
|
||||||
|
.tags
|
||||||
|
.iter()
|
||||||
|
.map(|_| {
|
||||||
|
let p = format!("${}", idx);
|
||||||
|
idx += 1;
|
||||||
|
p
|
||||||
|
})
|
||||||
|
.collect();
|
||||||
|
conditions.push(format!(
|
||||||
|
"tags @> ARRAY[{}]::text[]",
|
||||||
|
placeholders.join(", ")
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if a.query.is_some() {
|
||||||
|
conditions.push(format!(
|
||||||
|
"(name ILIKE ${i} ESCAPE '\\' OR namespace ILIKE ${i} ESCAPE '\\' \
|
||||||
|
OR kind ILIKE ${i} ESCAPE '\\' OR metadata::text ILIKE ${i} ESCAPE '\\' \
|
||||||
|
OR EXISTS (SELECT 1 FROM unnest(tags) t WHERE t ILIKE ${i} ESCAPE '\\'))",
|
||||||
|
i = idx
|
||||||
|
));
|
||||||
|
idx += 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
let order = match a.sort {
|
||||||
|
"updated" => "updated_at DESC",
|
||||||
|
"created" => "created_at DESC",
|
||||||
|
_ => "name ASC",
|
||||||
|
};
|
||||||
|
|
||||||
|
let limit_idx = idx;
|
||||||
|
idx += 1;
|
||||||
|
let offset_idx = idx;
|
||||||
|
|
||||||
|
let where_clause = if conditions.is_empty() {
|
||||||
|
String::new()
|
||||||
|
} else {
|
||||||
|
format!("WHERE {}", conditions.join(" AND "))
|
||||||
|
};
|
||||||
|
|
||||||
|
let sql = format!(
|
||||||
|
"SELECT id, COALESCE(user_id, '00000000-0000-0000-0000-000000000000'::uuid) AS user_id, \
|
||||||
|
namespace, kind, name, tags, metadata, version, created_at, updated_at \
|
||||||
|
FROM entries {where_clause} ORDER BY {order} LIMIT ${limit_idx} OFFSET ${offset_idx}"
|
||||||
|
);
|
||||||
|
|
||||||
|
let mut q = sqlx::query_as::<_, EntryRaw>(&sql);
|
||||||
|
|
||||||
|
if let Some(uid) = a.user_id {
|
||||||
|
q = q.bind(uid);
|
||||||
|
}
|
||||||
|
if let Some(v) = a.namespace {
|
||||||
|
q = q.bind(v);
|
||||||
|
}
|
||||||
|
if let Some(v) = a.kind {
|
||||||
|
q = q.bind(v);
|
||||||
|
}
|
||||||
|
if let Some(v) = a.name {
|
||||||
|
q = q.bind(v);
|
||||||
|
}
|
||||||
|
for tag in a.tags {
|
||||||
|
q = q.bind(tag);
|
||||||
|
}
|
||||||
|
if let Some(v) = a.query {
|
||||||
|
let pattern = format!("%{}%", v.replace('%', "\\%").replace('_', "\\_"));
|
||||||
|
q = q.bind(pattern);
|
||||||
|
}
|
||||||
|
q = q.bind(a.limit as i64).bind(a.offset as i64);
|
||||||
|
|
||||||
|
let rows = q.fetch_all(pool).await?;
|
||||||
|
Ok(rows.into_iter().map(Entry::from).collect())
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Fetch secret field names for a set of entry ids (no decryption).
|
||||||
|
pub async fn fetch_secret_schemas(
|
||||||
|
pool: &PgPool,
|
||||||
|
entry_ids: &[Uuid],
|
||||||
|
) -> Result<HashMap<Uuid, Vec<SecretField>>> {
|
||||||
|
if entry_ids.is_empty() {
|
||||||
|
return Ok(HashMap::new());
|
||||||
|
}
|
||||||
|
let fields: Vec<SecretField> = sqlx::query_as(
|
||||||
|
"SELECT * FROM secrets WHERE entry_id = ANY($1) ORDER BY entry_id, field_name",
|
||||||
|
)
|
||||||
|
.bind(entry_ids)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
let mut map: HashMap<Uuid, Vec<SecretField>> = HashMap::new();
|
||||||
|
for f in fields {
|
||||||
|
map.entry(f.entry_id).or_default().push(f);
|
||||||
|
}
|
||||||
|
Ok(map)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Fetch all secret fields (including encrypted bytes) for a set of entry ids.
|
||||||
|
pub async fn fetch_secrets_for_entries(
|
||||||
|
pool: &PgPool,
|
||||||
|
entry_ids: &[Uuid],
|
||||||
|
) -> Result<HashMap<Uuid, Vec<SecretField>>> {
|
||||||
|
if entry_ids.is_empty() {
|
||||||
|
return Ok(HashMap::new());
|
||||||
|
}
|
||||||
|
let fields: Vec<SecretField> = sqlx::query_as(
|
||||||
|
"SELECT * FROM secrets WHERE entry_id = ANY($1) ORDER BY entry_id, field_name",
|
||||||
|
)
|
||||||
|
.bind(entry_ids)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
let mut map: HashMap<Uuid, Vec<SecretField>> = HashMap::new();
|
||||||
|
for f in fields {
|
||||||
|
map.entry(f.entry_id).or_default().push(f);
|
||||||
|
}
|
||||||
|
Ok(map)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Internal raw row (because user_id is nullable in DB) ─────────────────────
|
||||||
|
|
||||||
|
#[derive(sqlx::FromRow)]
|
||||||
|
struct EntryRaw {
|
||||||
|
id: Uuid,
|
||||||
|
#[allow(dead_code)] // Selected for row shape; Entry model has no user_id field
|
||||||
|
user_id: Uuid,
|
||||||
|
namespace: String,
|
||||||
|
kind: String,
|
||||||
|
name: String,
|
||||||
|
tags: Vec<String>,
|
||||||
|
metadata: Value,
|
||||||
|
version: i64,
|
||||||
|
created_at: chrono::DateTime<chrono::Utc>,
|
||||||
|
updated_at: chrono::DateTime<chrono::Utc>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl From<EntryRaw> for Entry {
|
||||||
|
fn from(r: EntryRaw) -> Self {
|
||||||
|
Entry {
|
||||||
|
id: r.id,
|
||||||
|
namespace: r.namespace,
|
||||||
|
kind: r.kind,
|
||||||
|
name: r.name,
|
||||||
|
tags: r.tags,
|
||||||
|
metadata: r.metadata,
|
||||||
|
version: r.version,
|
||||||
|
created_at: r.created_at,
|
||||||
|
updated_at: r.updated_at,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -1,18 +1,30 @@
|
|||||||
use anyhow::Result;
|
use anyhow::Result;
|
||||||
use serde_json::{Map, Value, json};
|
use serde_json::{Map, Value};
|
||||||
use sqlx::PgPool;
|
use sqlx::PgPool;
|
||||||
use uuid::Uuid;
|
use uuid::Uuid;
|
||||||
|
|
||||||
use super::add::{
|
|
||||||
collect_field_paths, collect_key_paths, flatten_json_fields, insert_path, parse_key_path,
|
|
||||||
parse_kv, remove_path,
|
|
||||||
};
|
|
||||||
use crate::crypto;
|
use crate::crypto;
|
||||||
use crate::db;
|
use crate::db;
|
||||||
use crate::models::EntryRow;
|
use crate::models::EntryRow;
|
||||||
use crate::output::{OutputMode, print_json};
|
use crate::service::add::{
|
||||||
|
collect_field_paths, collect_key_paths, flatten_json_fields, insert_path, parse_key_path,
|
||||||
|
parse_kv, remove_path,
|
||||||
|
};
|
||||||
|
|
||||||
pub struct UpdateArgs<'a> {
|
#[derive(Debug, serde::Serialize)]
|
||||||
|
pub struct UpdateResult {
|
||||||
|
pub namespace: String,
|
||||||
|
pub kind: String,
|
||||||
|
pub name: String,
|
||||||
|
pub add_tags: Vec<String>,
|
||||||
|
pub remove_tags: Vec<String>,
|
||||||
|
pub meta_keys: Vec<String>,
|
||||||
|
pub remove_meta: Vec<String>,
|
||||||
|
pub secret_keys: Vec<String>,
|
||||||
|
pub remove_secrets: Vec<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
pub struct UpdateParams<'a> {
|
||||||
pub namespace: &'a str,
|
pub namespace: &'a str,
|
||||||
pub kind: &'a str,
|
pub kind: &'a str,
|
||||||
pub name: &'a str,
|
pub name: &'a str,
|
||||||
@@ -22,41 +34,55 @@ pub struct UpdateArgs<'a> {
|
|||||||
pub remove_meta: &'a [String],
|
pub remove_meta: &'a [String],
|
||||||
pub secret_entries: &'a [String],
|
pub secret_entries: &'a [String],
|
||||||
pub remove_secrets: &'a [String],
|
pub remove_secrets: &'a [String],
|
||||||
pub output: OutputMode,
|
pub user_id: Option<Uuid>,
|
||||||
}
|
}
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
|
pub async fn run(
|
||||||
|
pool: &PgPool,
|
||||||
|
params: UpdateParams<'_>,
|
||||||
|
master_key: &[u8; 32],
|
||||||
|
) -> Result<UpdateResult> {
|
||||||
let mut tx = pool.begin().await?;
|
let mut tx = pool.begin().await?;
|
||||||
|
|
||||||
let row: Option<EntryRow> = sqlx::query_as(
|
let row: Option<EntryRow> = if let Some(uid) = params.user_id {
|
||||||
"SELECT id, version, tags, metadata \
|
sqlx::query_as(
|
||||||
FROM entries \
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 \
|
WHERE user_id = $1 AND namespace = $2 AND kind = $3 AND name = $4 FOR UPDATE",
|
||||||
FOR UPDATE",
|
)
|
||||||
)
|
.bind(uid)
|
||||||
.bind(args.namespace)
|
.bind(params.namespace)
|
||||||
.bind(args.kind)
|
.bind(params.kind)
|
||||||
.bind(args.name)
|
.bind(params.name)
|
||||||
.fetch_optional(&mut *tx)
|
.fetch_optional(&mut *tx)
|
||||||
.await?;
|
.await?
|
||||||
|
} else {
|
||||||
|
sqlx::query_as(
|
||||||
|
"SELECT id, version, tags, metadata FROM entries \
|
||||||
|
WHERE user_id IS NULL AND namespace = $1 AND kind = $2 AND name = $3 FOR UPDATE",
|
||||||
|
)
|
||||||
|
.bind(params.namespace)
|
||||||
|
.bind(params.kind)
|
||||||
|
.bind(params.name)
|
||||||
|
.fetch_optional(&mut *tx)
|
||||||
|
.await?
|
||||||
|
};
|
||||||
|
|
||||||
let row = row.ok_or_else(|| {
|
let row = row.ok_or_else(|| {
|
||||||
anyhow::anyhow!(
|
anyhow::anyhow!(
|
||||||
"Not found: [{}/{}] {}. Use `add` to create it first.",
|
"Not found: [{}/{}] {}. Use `add` to create it first.",
|
||||||
args.namespace,
|
params.namespace,
|
||||||
args.kind,
|
params.kind,
|
||||||
args.name
|
params.name
|
||||||
)
|
)
|
||||||
})?;
|
})?;
|
||||||
|
|
||||||
// Snapshot current entry state before modifying.
|
|
||||||
if let Err(e) = db::snapshot_entry_history(
|
if let Err(e) = db::snapshot_entry_history(
|
||||||
&mut tx,
|
&mut tx,
|
||||||
db::EntrySnapshotParams {
|
db::EntrySnapshotParams {
|
||||||
entry_id: row.id,
|
entry_id: row.id,
|
||||||
namespace: args.namespace,
|
namespace: params.namespace,
|
||||||
kind: args.kind,
|
kind: params.kind,
|
||||||
name: args.name,
|
name: params.name,
|
||||||
version: row.version,
|
version: row.version,
|
||||||
action: "update",
|
action: "update",
|
||||||
tags: &row.tags,
|
tags: &row.tags,
|
||||||
@@ -68,34 +94,30 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
tracing::warn!(error = %e, "failed to snapshot entry history before update");
|
tracing::warn!(error = %e, "failed to snapshot entry history before update");
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Merge tags ────────────────────────────────────────────────────────────
|
let mut tags: Vec<String> = row.tags.clone();
|
||||||
let mut tags: Vec<String> = row.tags;
|
for t in params.add_tags {
|
||||||
for t in args.add_tags {
|
|
||||||
if !tags.contains(t) {
|
if !tags.contains(t) {
|
||||||
tags.push(t.clone());
|
tags.push(t.clone());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
tags.retain(|t| !args.remove_tags.contains(t));
|
tags.retain(|t| !params.remove_tags.contains(t));
|
||||||
|
|
||||||
// ── Merge metadata ────────────────────────────────────────────────────────
|
let mut meta_map: Map<String, Value> = match row.metadata.clone() {
|
||||||
let mut meta_map: Map<String, Value> = match row.metadata {
|
|
||||||
Value::Object(m) => m,
|
Value::Object(m) => m,
|
||||||
_ => Map::new(),
|
_ => Map::new(),
|
||||||
};
|
};
|
||||||
for entry in args.meta_entries {
|
for entry in params.meta_entries {
|
||||||
let (path, value) = parse_kv(entry)?;
|
let (path, value) = parse_kv(entry)?;
|
||||||
insert_path(&mut meta_map, &path, value)?;
|
insert_path(&mut meta_map, &path, value)?;
|
||||||
}
|
}
|
||||||
for key in args.remove_meta {
|
for key in params.remove_meta {
|
||||||
let path = parse_key_path(key)?;
|
let path = parse_key_path(key)?;
|
||||||
remove_path(&mut meta_map, &path)?;
|
remove_path(&mut meta_map, &path)?;
|
||||||
}
|
}
|
||||||
let metadata = Value::Object(meta_map);
|
let metadata = Value::Object(meta_map);
|
||||||
|
|
||||||
// CAS update of the entry row.
|
|
||||||
let result = sqlx::query(
|
let result = sqlx::query(
|
||||||
"UPDATE entries \
|
"UPDATE entries SET tags = $1, metadata = $2, version = version + 1, updated_at = NOW() \
|
||||||
SET tags = $1, metadata = $2, version = version + 1, updated_at = NOW() \
|
|
||||||
WHERE id = $3 AND version = $4",
|
WHERE id = $3 AND version = $4",
|
||||||
)
|
)
|
||||||
.bind(&tags)
|
.bind(&tags)
|
||||||
@@ -109,20 +131,16 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
tx.rollback().await?;
|
tx.rollback().await?;
|
||||||
anyhow::bail!(
|
anyhow::bail!(
|
||||||
"Concurrent modification detected for [{}/{}] {}. Please retry.",
|
"Concurrent modification detected for [{}/{}] {}. Please retry.",
|
||||||
args.namespace,
|
params.namespace,
|
||||||
args.kind,
|
params.kind,
|
||||||
args.name
|
params.name
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
let new_version = row.version + 1;
|
let new_version = row.version + 1;
|
||||||
|
|
||||||
// ── Update secret fields ──────────────────────────────────────────────────
|
for entry in params.secret_entries {
|
||||||
for entry in args.secret_entries {
|
|
||||||
let (path, field_value) = parse_kv(entry)?;
|
let (path, field_value) = parse_kv(entry)?;
|
||||||
|
|
||||||
// For nested paths (e.g. credentials:type), flatten into dot-separated names
|
|
||||||
// and treat the sub-value as the individual field to store.
|
|
||||||
let flat = flatten_json_fields("", &{
|
let flat = flatten_json_fields("", &{
|
||||||
let mut m = Map::new();
|
let mut m = Map::new();
|
||||||
insert_path(&mut m, &path, field_value)?;
|
insert_path(&mut m, &path, field_value)?;
|
||||||
@@ -132,22 +150,20 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
for (field_name, fv) in &flat {
|
for (field_name, fv) in &flat {
|
||||||
let encrypted = crypto::encrypt_json(master_key, fv)?;
|
let encrypted = crypto::encrypt_json(master_key, fv)?;
|
||||||
|
|
||||||
// Snapshot existing field before replacing.
|
|
||||||
#[derive(sqlx::FromRow)]
|
#[derive(sqlx::FromRow)]
|
||||||
struct ExistingField {
|
struct ExistingField {
|
||||||
id: Uuid,
|
id: Uuid,
|
||||||
encrypted: Vec<u8>,
|
encrypted: Vec<u8>,
|
||||||
}
|
}
|
||||||
let existing_field: Option<ExistingField> = sqlx::query_as(
|
let ef: Option<ExistingField> = sqlx::query_as(
|
||||||
"SELECT id, encrypted \
|
"SELECT id, encrypted FROM secrets WHERE entry_id = $1 AND field_name = $2",
|
||||||
FROM secrets WHERE entry_id = $1 AND field_name = $2",
|
|
||||||
)
|
)
|
||||||
.bind(row.id)
|
.bind(row.id)
|
||||||
.bind(field_name)
|
.bind(field_name)
|
||||||
.fetch_optional(&mut *tx)
|
.fetch_optional(&mut *tx)
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
if let Some(ef) = &existing_field
|
if let Some(ef) = &ef
|
||||||
&& let Err(e) = db::snapshot_secret_history(
|
&& let Err(e) = db::snapshot_secret_history(
|
||||||
&mut tx,
|
&mut tx,
|
||||||
db::SecretSnapshotParams {
|
db::SecretSnapshotParams {
|
||||||
@@ -165,12 +181,9 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
}
|
}
|
||||||
|
|
||||||
sqlx::query(
|
sqlx::query(
|
||||||
"INSERT INTO secrets (entry_id, field_name, encrypted) \
|
"INSERT INTO secrets (entry_id, field_name, encrypted) VALUES ($1, $2, $3) \
|
||||||
VALUES ($1, $2, $3) \
|
|
||||||
ON CONFLICT (entry_id, field_name) DO UPDATE SET \
|
ON CONFLICT (entry_id, field_name) DO UPDATE SET \
|
||||||
encrypted = EXCLUDED.encrypted, \
|
encrypted = EXCLUDED.encrypted, version = secrets.version + 1, updated_at = NOW()",
|
||||||
version = secrets.version + 1, \
|
|
||||||
updated_at = NOW()",
|
|
||||||
)
|
)
|
||||||
.bind(row.id)
|
.bind(row.id)
|
||||||
.bind(field_name)
|
.bind(field_name)
|
||||||
@@ -180,21 +193,17 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// ── Remove secret fields ──────────────────────────────────────────────────
|
for key in params.remove_secrets {
|
||||||
for key in args.remove_secrets {
|
|
||||||
let path = parse_key_path(key)?;
|
let path = parse_key_path(key)?;
|
||||||
// Dot-join the path to match flattened field_name storage.
|
|
||||||
let field_name = path.join(".");
|
let field_name = path.join(".");
|
||||||
|
|
||||||
// Snapshot before delete.
|
|
||||||
#[derive(sqlx::FromRow)]
|
#[derive(sqlx::FromRow)]
|
||||||
struct FieldToDelete {
|
struct FieldToDelete {
|
||||||
id: Uuid,
|
id: Uuid,
|
||||||
encrypted: Vec<u8>,
|
encrypted: Vec<u8>,
|
||||||
}
|
}
|
||||||
let field: Option<FieldToDelete> = sqlx::query_as(
|
let field: Option<FieldToDelete> = sqlx::query_as(
|
||||||
"SELECT id, encrypted \
|
"SELECT id, encrypted FROM secrets WHERE entry_id = $1 AND field_name = $2",
|
||||||
FROM secrets WHERE entry_id = $1 AND field_name = $2",
|
|
||||||
)
|
)
|
||||||
.bind(row.id)
|
.bind(row.id)
|
||||||
.bind(&field_name)
|
.bind(&field_name)
|
||||||
@@ -217,7 +226,6 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
{
|
{
|
||||||
tracing::warn!(error = %e, "failed to snapshot secret field history before delete");
|
tracing::warn!(error = %e, "failed to snapshot secret field history before delete");
|
||||||
}
|
}
|
||||||
|
|
||||||
sqlx::query("DELETE FROM secrets WHERE id = $1")
|
sqlx::query("DELETE FROM secrets WHERE id = $1")
|
||||||
.bind(f.id)
|
.bind(f.id)
|
||||||
.execute(&mut *tx)
|
.execute(&mut *tx)
|
||||||
@@ -225,20 +233,20 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
let meta_keys = collect_key_paths(args.meta_entries)?;
|
let meta_keys = collect_key_paths(params.meta_entries)?;
|
||||||
let remove_meta_keys = collect_field_paths(args.remove_meta)?;
|
let remove_meta_keys = collect_field_paths(params.remove_meta)?;
|
||||||
let secret_keys = collect_key_paths(args.secret_entries)?;
|
let secret_keys = collect_key_paths(params.secret_entries)?;
|
||||||
let remove_secret_keys = collect_field_paths(args.remove_secrets)?;
|
let remove_secret_keys = collect_field_paths(params.remove_secrets)?;
|
||||||
|
|
||||||
crate::audit::log_tx(
|
crate::audit::log_tx(
|
||||||
&mut tx,
|
&mut tx,
|
||||||
"update",
|
"update",
|
||||||
args.namespace,
|
params.namespace,
|
||||||
args.kind,
|
params.kind,
|
||||||
args.name,
|
params.name,
|
||||||
json!({
|
serde_json::json!({
|
||||||
"add_tags": args.add_tags,
|
"add_tags": params.add_tags,
|
||||||
"remove_tags": args.remove_tags,
|
"remove_tags": params.remove_tags,
|
||||||
"meta_keys": meta_keys,
|
"meta_keys": meta_keys,
|
||||||
"remove_meta": remove_meta_keys,
|
"remove_meta": remove_meta_keys,
|
||||||
"secret_keys": secret_keys,
|
"secret_keys": secret_keys,
|
||||||
@@ -249,45 +257,15 @@ pub async fn run(pool: &PgPool, args: UpdateArgs<'_>, master_key: &[u8; 32]) ->
|
|||||||
|
|
||||||
tx.commit().await?;
|
tx.commit().await?;
|
||||||
|
|
||||||
let result_json = json!({
|
Ok(UpdateResult {
|
||||||
"action": "updated",
|
namespace: params.namespace.to_string(),
|
||||||
"namespace": args.namespace,
|
kind: params.kind.to_string(),
|
||||||
"kind": args.kind,
|
name: params.name.to_string(),
|
||||||
"name": args.name,
|
add_tags: params.add_tags.to_vec(),
|
||||||
"add_tags": args.add_tags,
|
remove_tags: params.remove_tags.to_vec(),
|
||||||
"remove_tags": args.remove_tags,
|
meta_keys,
|
||||||
"meta_keys": meta_keys,
|
remove_meta: remove_meta_keys,
|
||||||
"remove_meta": remove_meta_keys,
|
secret_keys,
|
||||||
"secret_keys": secret_keys,
|
remove_secrets: remove_secret_keys,
|
||||||
"remove_secrets": remove_secret_keys,
|
})
|
||||||
});
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Json | OutputMode::JsonCompact => {
|
|
||||||
print_json(&result_json, &args.output)?;
|
|
||||||
}
|
|
||||||
_ => {
|
|
||||||
println!("Updated: [{}/{}] {}", args.namespace, args.kind, args.name);
|
|
||||||
if !args.add_tags.is_empty() {
|
|
||||||
println!(" +tags: {}", args.add_tags.join(", "));
|
|
||||||
}
|
|
||||||
if !args.remove_tags.is_empty() {
|
|
||||||
println!(" -tags: {}", args.remove_tags.join(", "));
|
|
||||||
}
|
|
||||||
if !args.meta_entries.is_empty() {
|
|
||||||
println!(" +metadata: {}", meta_keys.join(", "));
|
|
||||||
}
|
|
||||||
if !args.remove_meta.is_empty() {
|
|
||||||
println!(" -metadata: {}", remove_meta_keys.join(", "));
|
|
||||||
}
|
|
||||||
if !args.secret_entries.is_empty() {
|
|
||||||
println!(" +secrets: {}", secret_keys.join(", "));
|
|
||||||
}
|
|
||||||
if !args.remove_secrets.is_empty() {
|
|
||||||
println!(" -secrets: {}", remove_secret_keys.join(", "));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
}
|
||||||
213
crates/secrets-core/src/service/user.rs
Normal file
213
crates/secrets-core/src/service/user.rs
Normal file
@@ -0,0 +1,213 @@
|
|||||||
|
use anyhow::Result;
|
||||||
|
use serde_json::Value;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use crate::models::{OauthAccount, User};
|
||||||
|
|
||||||
|
pub struct OAuthProfile {
|
||||||
|
pub provider: String,
|
||||||
|
pub provider_id: String,
|
||||||
|
pub email: Option<String>,
|
||||||
|
pub name: Option<String>,
|
||||||
|
pub avatar_url: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Find or create a user from an OAuth profile.
|
||||||
|
/// Returns (user, is_new) where is_new indicates first-time registration.
|
||||||
|
pub async fn find_or_create_user(pool: &PgPool, profile: OAuthProfile) -> Result<(User, bool)> {
|
||||||
|
// Check if this OAuth account already exists
|
||||||
|
let existing: Option<OauthAccount> = sqlx::query_as(
|
||||||
|
"SELECT id, user_id, provider, provider_id, email, name, avatar_url, created_at \
|
||||||
|
FROM oauth_accounts WHERE provider = $1 AND provider_id = $2",
|
||||||
|
)
|
||||||
|
.bind(&profile.provider)
|
||||||
|
.bind(&profile.provider_id)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if let Some(oa) = existing {
|
||||||
|
let user: User = sqlx::query_as(
|
||||||
|
"SELECT id, email, name, avatar_url, key_salt, key_check, key_params, api_key, created_at, updated_at \
|
||||||
|
FROM users WHERE id = $1",
|
||||||
|
)
|
||||||
|
.bind(oa.user_id)
|
||||||
|
.fetch_one(pool)
|
||||||
|
.await?;
|
||||||
|
return Ok((user, false));
|
||||||
|
}
|
||||||
|
|
||||||
|
// New user — create records (no key yet; user sets passphrase on dashboard)
|
||||||
|
let display_name = profile
|
||||||
|
.name
|
||||||
|
.clone()
|
||||||
|
.unwrap_or_else(|| profile.email.clone().unwrap_or_else(|| "User".to_string()));
|
||||||
|
|
||||||
|
let mut tx = pool.begin().await?;
|
||||||
|
|
||||||
|
let user: User = sqlx::query_as(
|
||||||
|
"INSERT INTO users (email, name, avatar_url) \
|
||||||
|
VALUES ($1, $2, $3) \
|
||||||
|
RETURNING id, email, name, avatar_url, key_salt, key_check, key_params, api_key, created_at, updated_at",
|
||||||
|
)
|
||||||
|
.bind(&profile.email)
|
||||||
|
.bind(&display_name)
|
||||||
|
.bind(&profile.avatar_url)
|
||||||
|
.fetch_one(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
sqlx::query(
|
||||||
|
"INSERT INTO oauth_accounts (user_id, provider, provider_id, email, name, avatar_url) \
|
||||||
|
VALUES ($1, $2, $3, $4, $5, $6)",
|
||||||
|
)
|
||||||
|
.bind(user.id)
|
||||||
|
.bind(&profile.provider)
|
||||||
|
.bind(&profile.provider_id)
|
||||||
|
.bind(&profile.email)
|
||||||
|
.bind(&profile.name)
|
||||||
|
.bind(&profile.avatar_url)
|
||||||
|
.execute(&mut *tx)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
tx.commit().await?;
|
||||||
|
|
||||||
|
Ok((user, true))
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Store the PBKDF2 salt, key_check, and params for a user's passphrase setup.
|
||||||
|
pub async fn update_user_key_setup(
|
||||||
|
pool: &PgPool,
|
||||||
|
user_id: Uuid,
|
||||||
|
key_salt: &[u8],
|
||||||
|
key_check: &[u8],
|
||||||
|
key_params: &Value,
|
||||||
|
) -> Result<()> {
|
||||||
|
sqlx::query(
|
||||||
|
"UPDATE users SET key_salt = $1, key_check = $2, key_params = $3, updated_at = NOW() \
|
||||||
|
WHERE id = $4",
|
||||||
|
)
|
||||||
|
.bind(key_salt)
|
||||||
|
.bind(key_check)
|
||||||
|
.bind(key_params)
|
||||||
|
.bind(user_id)
|
||||||
|
.execute(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Fetch a user by ID.
|
||||||
|
pub async fn get_user_by_id(pool: &PgPool, user_id: Uuid) -> Result<Option<User>> {
|
||||||
|
let user = sqlx::query_as(
|
||||||
|
"SELECT id, email, name, avatar_url, key_salt, key_check, key_params, api_key, created_at, updated_at \
|
||||||
|
FROM users WHERE id = $1",
|
||||||
|
)
|
||||||
|
.bind(user_id)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(user)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// List all OAuth accounts linked to a user.
|
||||||
|
pub async fn list_oauth_accounts(pool: &PgPool, user_id: Uuid) -> Result<Vec<OauthAccount>> {
|
||||||
|
let accounts = sqlx::query_as(
|
||||||
|
"SELECT id, user_id, provider, provider_id, email, name, avatar_url, created_at \
|
||||||
|
FROM oauth_accounts WHERE user_id = $1 ORDER BY created_at",
|
||||||
|
)
|
||||||
|
.bind(user_id)
|
||||||
|
.fetch_all(pool)
|
||||||
|
.await?;
|
||||||
|
Ok(accounts)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Bind an additional OAuth account to an existing user.
|
||||||
|
pub async fn bind_oauth_account(
|
||||||
|
pool: &PgPool,
|
||||||
|
user_id: Uuid,
|
||||||
|
profile: OAuthProfile,
|
||||||
|
) -> Result<OauthAccount> {
|
||||||
|
// Check if this provider_id is already linked to someone else
|
||||||
|
let conflict: Option<(Uuid,)> = sqlx::query_as(
|
||||||
|
"SELECT user_id FROM oauth_accounts WHERE provider = $1 AND provider_id = $2",
|
||||||
|
)
|
||||||
|
.bind(&profile.provider)
|
||||||
|
.bind(&profile.provider_id)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if let Some((existing_user_id,)) = conflict {
|
||||||
|
if existing_user_id != user_id {
|
||||||
|
anyhow::bail!(
|
||||||
|
"This {} account is already linked to a different user",
|
||||||
|
profile.provider
|
||||||
|
);
|
||||||
|
}
|
||||||
|
anyhow::bail!(
|
||||||
|
"This {} account is already linked to your account",
|
||||||
|
profile.provider
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let existing_provider_for_user: Option<(String,)> = sqlx::query_as(
|
||||||
|
"SELECT provider_id FROM oauth_accounts WHERE user_id = $1 AND provider = $2",
|
||||||
|
)
|
||||||
|
.bind(user_id)
|
||||||
|
.bind(&profile.provider)
|
||||||
|
.fetch_optional(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if existing_provider_for_user.is_some() {
|
||||||
|
anyhow::bail!(
|
||||||
|
"You already linked a {} account. Unlink the other provider instead of binding multiple {} accounts.",
|
||||||
|
profile.provider,
|
||||||
|
profile.provider
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let account: OauthAccount = sqlx::query_as(
|
||||||
|
"INSERT INTO oauth_accounts (user_id, provider, provider_id, email, name, avatar_url) \
|
||||||
|
VALUES ($1, $2, $3, $4, $5, $6) \
|
||||||
|
RETURNING id, user_id, provider, provider_id, email, name, avatar_url, created_at",
|
||||||
|
)
|
||||||
|
.bind(user_id)
|
||||||
|
.bind(&profile.provider)
|
||||||
|
.bind(&profile.provider_id)
|
||||||
|
.bind(&profile.email)
|
||||||
|
.bind(&profile.name)
|
||||||
|
.bind(&profile.avatar_url)
|
||||||
|
.fetch_one(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
Ok(account)
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Unbind an OAuth account. Ensures at least one remains and blocks unlinking the current login provider.
|
||||||
|
pub async fn unbind_oauth_account(
|
||||||
|
pool: &PgPool,
|
||||||
|
user_id: Uuid,
|
||||||
|
provider: &str,
|
||||||
|
current_login_provider: Option<&str>,
|
||||||
|
) -> Result<()> {
|
||||||
|
if current_login_provider == Some(provider) {
|
||||||
|
anyhow::bail!(
|
||||||
|
"Cannot unlink the {} account you are currently using to sign in",
|
||||||
|
provider
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM oauth_accounts WHERE user_id = $1")
|
||||||
|
.bind(user_id)
|
||||||
|
.fetch_one(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
if count <= 1 {
|
||||||
|
anyhow::bail!("Cannot unbind the last OAuth account. Please link another account first.");
|
||||||
|
}
|
||||||
|
|
||||||
|
sqlx::query("DELETE FROM oauth_accounts WHERE user_id = $1 AND provider = $2")
|
||||||
|
.bind(user_id)
|
||||||
|
.bind(provider)
|
||||||
|
.execute(pool)
|
||||||
|
.await?;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
44
crates/secrets-mcp/Cargo.toml
Normal file
44
crates/secrets-mcp/Cargo.toml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
[package]
|
||||||
|
name = "secrets-mcp"
|
||||||
|
version = "0.1.0"
|
||||||
|
edition.workspace = true
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "secrets-mcp"
|
||||||
|
path = "src/main.rs"
|
||||||
|
|
||||||
|
[dependencies]
|
||||||
|
secrets-core = { path = "../secrets-core" }
|
||||||
|
|
||||||
|
# MCP
|
||||||
|
rmcp = { version = "1", features = ["server", "macros", "transport-streamable-http-server", "schemars"] }
|
||||||
|
|
||||||
|
# Web framework
|
||||||
|
axum = "0.8"
|
||||||
|
axum-extra = { version = "0.10", features = ["typed-header"] }
|
||||||
|
tower = "0.5"
|
||||||
|
tower-http = { version = "0.6", features = ["cors"] }
|
||||||
|
tower-sessions = "0.14"
|
||||||
|
|
||||||
|
# OAuth (manual token exchange via reqwest)
|
||||||
|
reqwest.workspace = true
|
||||||
|
|
||||||
|
# Templating - render templates manually to avoid integration crate issues
|
||||||
|
askama = "0.13"
|
||||||
|
|
||||||
|
# Common
|
||||||
|
anyhow.workspace = true
|
||||||
|
chrono.workspace = true
|
||||||
|
serde.workspace = true
|
||||||
|
serde_json.workspace = true
|
||||||
|
sha2.workspace = true
|
||||||
|
rand.workspace = true
|
||||||
|
sqlx.workspace = true
|
||||||
|
tokio.workspace = true
|
||||||
|
tracing.workspace = true
|
||||||
|
tracing-subscriber.workspace = true
|
||||||
|
uuid.workspace = true
|
||||||
|
dotenvy.workspace = true
|
||||||
|
urlencoding = "2"
|
||||||
|
schemars = "1"
|
||||||
|
http = "1"
|
||||||
114
crates/secrets-mcp/src/auth.rs
Normal file
114
crates/secrets-mcp/src/auth.rs
Normal file
@@ -0,0 +1,114 @@
|
|||||||
|
use std::net::SocketAddr;
|
||||||
|
|
||||||
|
use axum::{
|
||||||
|
extract::{ConnectInfo, Request, State},
|
||||||
|
http::StatusCode,
|
||||||
|
middleware::Next,
|
||||||
|
response::Response,
|
||||||
|
};
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use secrets_core::service::api_key::validate_api_key;
|
||||||
|
|
||||||
|
/// Injected into request extensions after Bearer token validation.
|
||||||
|
#[derive(Clone, Debug)]
|
||||||
|
pub struct AuthUser {
|
||||||
|
pub user_id: Uuid,
|
||||||
|
}
|
||||||
|
|
||||||
|
fn log_client_ip(req: &Request) -> Option<String> {
|
||||||
|
if let Some(first) = req
|
||||||
|
.headers()
|
||||||
|
.get("x-forwarded-for")
|
||||||
|
.and_then(|v| v.to_str().ok())
|
||||||
|
.and_then(|s| s.split(',').next())
|
||||||
|
{
|
||||||
|
let s = first.trim();
|
||||||
|
if !s.is_empty() {
|
||||||
|
return Some(s.to_string());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
req.extensions()
|
||||||
|
.get::<ConnectInfo<SocketAddr>>()
|
||||||
|
.map(|c| c.ip().to_string())
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Axum middleware that validates Bearer API keys for the /mcp route.
|
||||||
|
/// Passes all non-MCP paths through without authentication.
|
||||||
|
pub async fn bearer_auth_middleware(
|
||||||
|
State(pool): State<PgPool>,
|
||||||
|
req: Request,
|
||||||
|
next: Next,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
let path = req.uri().path();
|
||||||
|
let method = req.method().as_str();
|
||||||
|
let client_ip = log_client_ip(&req);
|
||||||
|
|
||||||
|
// Only authenticate /mcp paths
|
||||||
|
if !path.starts_with("/mcp") {
|
||||||
|
return Ok(next.run(req).await);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Allow OPTIONS (CORS preflight) through
|
||||||
|
if req.method() == axum::http::Method::OPTIONS {
|
||||||
|
return Ok(next.run(req).await);
|
||||||
|
}
|
||||||
|
|
||||||
|
let auth_header = req
|
||||||
|
.headers()
|
||||||
|
.get(axum::http::header::AUTHORIZATION)
|
||||||
|
.and_then(|v| v.to_str().ok());
|
||||||
|
|
||||||
|
let raw_key = match auth_header {
|
||||||
|
Some(h) if h.starts_with("Bearer ") => h.trim_start_matches("Bearer ").trim(),
|
||||||
|
Some(_) => {
|
||||||
|
tracing::warn!(
|
||||||
|
method,
|
||||||
|
path,
|
||||||
|
client_ip = client_ip.as_deref(),
|
||||||
|
"invalid Authorization header format on /mcp (expected Bearer …)"
|
||||||
|
);
|
||||||
|
return Err(StatusCode::UNAUTHORIZED);
|
||||||
|
}
|
||||||
|
None => {
|
||||||
|
tracing::warn!(
|
||||||
|
method,
|
||||||
|
path,
|
||||||
|
client_ip = client_ip.as_deref(),
|
||||||
|
"missing Authorization header on /mcp"
|
||||||
|
);
|
||||||
|
return Err(StatusCode::UNAUTHORIZED);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
match validate_api_key(&pool, raw_key).await {
|
||||||
|
Ok(Some(user_id)) => {
|
||||||
|
tracing::debug!(?user_id, "api key authenticated");
|
||||||
|
let mut req = req;
|
||||||
|
req.extensions_mut().insert(AuthUser { user_id });
|
||||||
|
Ok(next.run(req).await)
|
||||||
|
}
|
||||||
|
Ok(None) => {
|
||||||
|
tracing::warn!(
|
||||||
|
method,
|
||||||
|
path,
|
||||||
|
client_ip = client_ip.as_deref(),
|
||||||
|
key_prefix = %&raw_key.chars().take(12).collect::<String>(),
|
||||||
|
key_len = raw_key.len(),
|
||||||
|
"invalid api key (not found in database — e.g. revoked key or DB was reset; update MCP client Bearer token)"
|
||||||
|
);
|
||||||
|
Err(StatusCode::UNAUTHORIZED)
|
||||||
|
}
|
||||||
|
Err(e) => {
|
||||||
|
tracing::error!(
|
||||||
|
method,
|
||||||
|
path,
|
||||||
|
client_ip = client_ip.as_deref(),
|
||||||
|
error = %e,
|
||||||
|
"api key validation error"
|
||||||
|
);
|
||||||
|
Err(StatusCode::INTERNAL_SERVER_ERROR)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
155
crates/secrets-mcp/src/main.rs
Normal file
155
crates/secrets-mcp/src/main.rs
Normal file
@@ -0,0 +1,155 @@
|
|||||||
|
mod auth;
|
||||||
|
mod oauth;
|
||||||
|
mod tools;
|
||||||
|
mod web;
|
||||||
|
|
||||||
|
use std::net::SocketAddr;
|
||||||
|
use std::sync::Arc;
|
||||||
|
|
||||||
|
use anyhow::{Context, Result};
|
||||||
|
use axum::Router;
|
||||||
|
use rmcp::transport::streamable_http_server::{
|
||||||
|
StreamableHttpService, session::local::LocalSessionManager,
|
||||||
|
};
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use tower_http::cors::{Any, CorsLayer};
|
||||||
|
use tower_sessions::cookie::SameSite;
|
||||||
|
use tower_sessions::{MemoryStore, SessionManagerLayer};
|
||||||
|
use tracing_subscriber::EnvFilter;
|
||||||
|
|
||||||
|
use secrets_core::config::resolve_db_url;
|
||||||
|
use secrets_core::db::{create_pool, migrate};
|
||||||
|
|
||||||
|
use crate::oauth::OAuthConfig;
|
||||||
|
use crate::tools::SecretsService;
|
||||||
|
|
||||||
|
/// Shared application state injected into web routes and middleware.
|
||||||
|
#[derive(Clone)]
|
||||||
|
pub struct AppState {
|
||||||
|
pub pool: PgPool,
|
||||||
|
pub google_config: Option<OAuthConfig>,
|
||||||
|
pub base_url: String,
|
||||||
|
pub http_client: reqwest::Client,
|
||||||
|
}
|
||||||
|
|
||||||
|
fn load_env_var(name: &str) -> Option<String> {
|
||||||
|
std::env::var(name).ok().filter(|s| !s.is_empty())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn load_oauth_config(prefix: &str, base_url: &str, path: &str) -> Option<OAuthConfig> {
|
||||||
|
let client_id = load_env_var(&format!("{}_CLIENT_ID", prefix))?;
|
||||||
|
let client_secret = load_env_var(&format!("{}_CLIENT_SECRET", prefix))?;
|
||||||
|
Some(OAuthConfig {
|
||||||
|
client_id,
|
||||||
|
client_secret,
|
||||||
|
redirect_uri: format!("{}{}", base_url, path),
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tokio::main]
|
||||||
|
async fn main() -> Result<()> {
|
||||||
|
// Load .env if present
|
||||||
|
let _ = dotenvy::dotenv();
|
||||||
|
|
||||||
|
tracing_subscriber::fmt()
|
||||||
|
.with_env_filter(
|
||||||
|
EnvFilter::try_from_default_env().unwrap_or_else(|_| "secrets_mcp=info".into()),
|
||||||
|
)
|
||||||
|
.init();
|
||||||
|
|
||||||
|
// ── Database ──────────────────────────────────────────────────────────────
|
||||||
|
let db_url = resolve_db_url("")
|
||||||
|
.context("Database not configured. Set SECRETS_DATABASE_URL environment variable.")?;
|
||||||
|
let pool = create_pool(&db_url)
|
||||||
|
.await
|
||||||
|
.context("failed to connect to database")?;
|
||||||
|
migrate(&pool)
|
||||||
|
.await
|
||||||
|
.context("failed to run database migrations")?;
|
||||||
|
tracing::info!("Database connected and migrated");
|
||||||
|
|
||||||
|
// ── Configuration ─────────────────────────────────────────────────────────
|
||||||
|
let base_url = load_env_var("BASE_URL").unwrap_or_else(|| "http://localhost:9315".to_string());
|
||||||
|
let bind_addr = load_env_var("SECRETS_MCP_BIND").unwrap_or_else(|| "0.0.0.0:9315".to_string());
|
||||||
|
|
||||||
|
// ── OAuth providers ───────────────────────────────────────────────────────
|
||||||
|
let google_config = load_oauth_config("GOOGLE", &base_url, "/auth/google/callback");
|
||||||
|
|
||||||
|
if google_config.is_none() {
|
||||||
|
tracing::warn!(
|
||||||
|
"No OAuth providers configured. Set GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET to enable login."
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Session store ─────────────────────────────────────────────────────────
|
||||||
|
let session_store = MemoryStore::default();
|
||||||
|
// Strict would drop the session cookie on redirect from Google → our origin (cross-site nav).
|
||||||
|
let session_layer = SessionManagerLayer::new(session_store)
|
||||||
|
.with_secure(base_url.starts_with("https://"))
|
||||||
|
.with_same_site(SameSite::Lax);
|
||||||
|
|
||||||
|
// ── App state ─────────────────────────────────────────────────────────────
|
||||||
|
let app_state = AppState {
|
||||||
|
pool: pool.clone(),
|
||||||
|
google_config,
|
||||||
|
base_url: base_url.clone(),
|
||||||
|
http_client: reqwest::Client::builder()
|
||||||
|
.timeout(std::time::Duration::from_secs(15))
|
||||||
|
.build()
|
||||||
|
.context("failed to build HTTP client")?,
|
||||||
|
};
|
||||||
|
|
||||||
|
// ── MCP service ───────────────────────────────────────────────────────────
|
||||||
|
let pool_arc = Arc::new(pool.clone());
|
||||||
|
|
||||||
|
let mcp_service = StreamableHttpService::new(
|
||||||
|
move || {
|
||||||
|
let p = pool_arc.clone();
|
||||||
|
Ok(SecretsService::new(p))
|
||||||
|
},
|
||||||
|
LocalSessionManager::default().into(),
|
||||||
|
Default::default(),
|
||||||
|
);
|
||||||
|
|
||||||
|
// ── Router ────────────────────────────────────────────────────────────────
|
||||||
|
let cors = CorsLayer::new()
|
||||||
|
.allow_origin(Any)
|
||||||
|
.allow_methods(Any)
|
||||||
|
.allow_headers(Any);
|
||||||
|
|
||||||
|
let router = Router::new()
|
||||||
|
.merge(web::web_router())
|
||||||
|
.nest_service("/mcp", mcp_service)
|
||||||
|
.layer(axum::middleware::from_fn_with_state(
|
||||||
|
pool,
|
||||||
|
auth::bearer_auth_middleware,
|
||||||
|
))
|
||||||
|
.layer(session_layer)
|
||||||
|
.layer(cors)
|
||||||
|
.with_state(app_state);
|
||||||
|
|
||||||
|
// ── Start server ──────────────────────────────────────────────────────────
|
||||||
|
let listener = tokio::net::TcpListener::bind(&bind_addr)
|
||||||
|
.await
|
||||||
|
.with_context(|| format!("failed to bind to {}", bind_addr))?;
|
||||||
|
|
||||||
|
tracing::info!("Secrets MCP Server listening on http://{}", bind_addr);
|
||||||
|
tracing::info!("MCP endpoint: {}/mcp", base_url);
|
||||||
|
|
||||||
|
axum::serve(
|
||||||
|
listener,
|
||||||
|
router.into_make_service_with_connect_info::<SocketAddr>(),
|
||||||
|
)
|
||||||
|
.with_graceful_shutdown(shutdown_signal())
|
||||||
|
.await
|
||||||
|
.context("server error")?;
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn shutdown_signal() {
|
||||||
|
tokio::signal::ctrl_c()
|
||||||
|
.await
|
||||||
|
.expect("failed to install CTRL+C signal handler");
|
||||||
|
tracing::info!("Shutting down gracefully...");
|
||||||
|
}
|
||||||
66
crates/secrets-mcp/src/oauth/google.rs
Normal file
66
crates/secrets-mcp/src/oauth/google.rs
Normal file
@@ -0,0 +1,66 @@
|
|||||||
|
use anyhow::{Context, Result};
|
||||||
|
use serde::Deserialize;
|
||||||
|
|
||||||
|
use super::{OAuthConfig, OAuthUserInfo};
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct TokenResponse {
|
||||||
|
access_token: String,
|
||||||
|
#[allow(dead_code)]
|
||||||
|
token_type: String,
|
||||||
|
#[allow(dead_code)]
|
||||||
|
id_token: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct UserInfo {
|
||||||
|
sub: String,
|
||||||
|
email: Option<String>,
|
||||||
|
name: Option<String>,
|
||||||
|
picture: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Exchange authorization code for tokens and fetch user profile.
|
||||||
|
pub async fn exchange_code(
|
||||||
|
client: &reqwest::Client,
|
||||||
|
config: &OAuthConfig,
|
||||||
|
code: &str,
|
||||||
|
) -> Result<OAuthUserInfo> {
|
||||||
|
let token_resp: TokenResponse = client
|
||||||
|
.post("https://oauth2.googleapis.com/token")
|
||||||
|
.form(&[
|
||||||
|
("code", code),
|
||||||
|
("client_id", &config.client_id),
|
||||||
|
("client_secret", &config.client_secret),
|
||||||
|
("redirect_uri", &config.redirect_uri),
|
||||||
|
("grant_type", "authorization_code"),
|
||||||
|
])
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.context("failed to exchange Google code")?
|
||||||
|
.error_for_status()
|
||||||
|
.context("Google token endpoint error")?
|
||||||
|
.json()
|
||||||
|
.await
|
||||||
|
.context("failed to parse Google token response")?;
|
||||||
|
|
||||||
|
let user: UserInfo = client
|
||||||
|
.get("https://openidconnect.googleapis.com/v1/userinfo")
|
||||||
|
.bearer_auth(&token_resp.access_token)
|
||||||
|
.send()
|
||||||
|
.await
|
||||||
|
.context("failed to fetch Google userinfo")?
|
||||||
|
.error_for_status()
|
||||||
|
.context("Google userinfo endpoint error")?
|
||||||
|
.json()
|
||||||
|
.await
|
||||||
|
.context("failed to parse Google userinfo")?;
|
||||||
|
|
||||||
|
Ok(OAuthUserInfo {
|
||||||
|
provider: "google".to_string(),
|
||||||
|
provider_id: user.sub,
|
||||||
|
email: user.email,
|
||||||
|
name: user.name,
|
||||||
|
avatar_url: user.picture,
|
||||||
|
})
|
||||||
|
}
|
||||||
45
crates/secrets-mcp/src/oauth/mod.rs
Normal file
45
crates/secrets-mcp/src/oauth/mod.rs
Normal file
@@ -0,0 +1,45 @@
|
|||||||
|
pub mod google;
|
||||||
|
pub mod wechat; // not yet implemented — placeholder for future WeChat integration
|
||||||
|
|
||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
|
||||||
|
/// Normalized OAuth user profile from any provider.
|
||||||
|
#[derive(Debug, Clone)]
|
||||||
|
pub struct OAuthUserInfo {
|
||||||
|
pub provider: String,
|
||||||
|
pub provider_id: String,
|
||||||
|
pub email: Option<String>,
|
||||||
|
pub name: Option<String>,
|
||||||
|
pub avatar_url: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// OAuth provider configuration.
|
||||||
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
||||||
|
pub struct OAuthConfig {
|
||||||
|
pub client_id: String,
|
||||||
|
pub client_secret: String,
|
||||||
|
pub redirect_uri: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Build the Google authorization URL.
|
||||||
|
pub fn google_auth_url(config: &OAuthConfig, state: &str) -> String {
|
||||||
|
format!(
|
||||||
|
"https://accounts.google.com/o/oauth2/v2/auth\
|
||||||
|
?client_id={}\
|
||||||
|
&redirect_uri={}\
|
||||||
|
&response_type=code\
|
||||||
|
&scope=openid%20email%20profile\
|
||||||
|
&state={}\
|
||||||
|
&access_type=offline",
|
||||||
|
urlencoding::encode(&config.client_id),
|
||||||
|
urlencoding::encode(&config.redirect_uri),
|
||||||
|
urlencoding::encode(state),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub fn random_state() -> String {
|
||||||
|
use rand::RngExt;
|
||||||
|
let mut bytes = [0u8; 16];
|
||||||
|
rand::rng().fill(&mut bytes);
|
||||||
|
bytes.iter().map(|b| format!("{:02x}", b)).collect()
|
||||||
|
}
|
||||||
18
crates/secrets-mcp/src/oauth/wechat.rs
Normal file
18
crates/secrets-mcp/src/oauth/wechat.rs
Normal file
@@ -0,0 +1,18 @@
|
|||||||
|
use super::{OAuthConfig, OAuthUserInfo};
|
||||||
|
/// WeChat OAuth — not yet implemented.
|
||||||
|
///
|
||||||
|
/// This module is a placeholder for future WeChat Open Platform integration.
|
||||||
|
/// When ready, implement `exchange_code` following the non-standard WeChat OAuth 2.0 flow:
|
||||||
|
/// - Token exchange uses a GET request (not POST)
|
||||||
|
/// - Preferred user identifier is `unionid` (cross-app), falling back to `openid`
|
||||||
|
/// - Docs: https://developers.weixin.qq.com/doc/oplatform/Website_App/WeChat_Login/Wechat_Login.html
|
||||||
|
use anyhow::{Result, bail};
|
||||||
|
|
||||||
|
#[allow(dead_code)]
|
||||||
|
pub async fn exchange_code(
|
||||||
|
_client: &reqwest::Client,
|
||||||
|
_config: &OAuthConfig,
|
||||||
|
_code: &str,
|
||||||
|
) -> Result<OAuthUserInfo> {
|
||||||
|
bail!("WeChat login is not yet implemented")
|
||||||
|
}
|
||||||
609
crates/secrets-mcp/src/tools.rs
Normal file
609
crates/secrets-mcp/src/tools.rs
Normal file
@@ -0,0 +1,609 @@
|
|||||||
|
use std::sync::Arc;
|
||||||
|
|
||||||
|
use anyhow::Result;
|
||||||
|
use rmcp::{
|
||||||
|
RoleServer, ServerHandler,
|
||||||
|
handler::server::wrapper::Parameters,
|
||||||
|
model::{
|
||||||
|
CallToolResult, Content, Implementation, InitializeResult, ProtocolVersion,
|
||||||
|
ServerCapabilities,
|
||||||
|
},
|
||||||
|
service::RequestContext,
|
||||||
|
tool, tool_handler, tool_router,
|
||||||
|
};
|
||||||
|
use schemars::JsonSchema;
|
||||||
|
use serde::Deserialize;
|
||||||
|
use sqlx::PgPool;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use secrets_core::service::{
|
||||||
|
add::{AddParams, run as svc_add},
|
||||||
|
delete::{DeleteParams, run as svc_delete},
|
||||||
|
export::{ExportParams, export as svc_export},
|
||||||
|
get_secret::{get_all_secrets, get_secret_field},
|
||||||
|
history::run as svc_history,
|
||||||
|
rollback::run as svc_rollback,
|
||||||
|
search::{SearchParams, run as svc_search},
|
||||||
|
update::{UpdateParams, run as svc_update},
|
||||||
|
};
|
||||||
|
|
||||||
|
use crate::auth::AuthUser;
|
||||||
|
|
||||||
|
// ── Shared state ──────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Clone)]
|
||||||
|
pub struct SecretsService {
|
||||||
|
pub pool: Arc<PgPool>,
|
||||||
|
pub tool_router: rmcp::handler::server::router::tool::ToolRouter<SecretsService>,
|
||||||
|
}
|
||||||
|
|
||||||
|
impl SecretsService {
|
||||||
|
pub fn new(pool: Arc<PgPool>) -> Self {
|
||||||
|
Self {
|
||||||
|
pool,
|
||||||
|
tool_router: Self::tool_router(),
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Extract user_id from the HTTP request parts injected by auth middleware.
|
||||||
|
fn user_id_from_ctx(ctx: &RequestContext<RoleServer>) -> Result<Option<Uuid>, rmcp::ErrorData> {
|
||||||
|
let parts = ctx
|
||||||
|
.extensions
|
||||||
|
.get::<http::request::Parts>()
|
||||||
|
.ok_or_else(|| rmcp::ErrorData::internal_error("Missing HTTP parts", None))?;
|
||||||
|
Ok(parts.extensions.get::<AuthUser>().map(|a| a.user_id))
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Get the authenticated user_id (returns error if not authenticated).
|
||||||
|
fn require_user_id(ctx: &RequestContext<RoleServer>) -> Result<Uuid, rmcp::ErrorData> {
|
||||||
|
let parts = ctx
|
||||||
|
.extensions
|
||||||
|
.get::<http::request::Parts>()
|
||||||
|
.ok_or_else(|| rmcp::ErrorData::internal_error("Missing HTTP parts", None))?;
|
||||||
|
parts
|
||||||
|
.extensions
|
||||||
|
.get::<AuthUser>()
|
||||||
|
.map(|a| a.user_id)
|
||||||
|
.ok_or_else(|| rmcp::ErrorData::invalid_request("Unauthorized: API key required", None))
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Extract the 32-byte encryption key from the X-Encryption-Key request header.
|
||||||
|
/// The header value must be 64 lowercase hex characters (PBKDF2-derived key).
|
||||||
|
fn extract_enc_key(ctx: &RequestContext<RoleServer>) -> Result<[u8; 32], rmcp::ErrorData> {
|
||||||
|
let parts = ctx
|
||||||
|
.extensions
|
||||||
|
.get::<http::request::Parts>()
|
||||||
|
.ok_or_else(|| rmcp::ErrorData::internal_error("Missing HTTP parts", None))?;
|
||||||
|
let hex_str = parts
|
||||||
|
.headers
|
||||||
|
.get("x-encryption-key")
|
||||||
|
.ok_or_else(|| {
|
||||||
|
rmcp::ErrorData::invalid_request(
|
||||||
|
"Missing X-Encryption-Key header. \
|
||||||
|
Set this to your 64-char hex encryption key derived from your passphrase.",
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
})?
|
||||||
|
.to_str()
|
||||||
|
.map_err(|_| {
|
||||||
|
rmcp::ErrorData::invalid_request("Invalid X-Encryption-Key header value", None)
|
||||||
|
})?;
|
||||||
|
secrets_core::crypto::extract_key_from_hex(hex_str)
|
||||||
|
.map_err(|e| rmcp::ErrorData::invalid_request(e.to_string(), None))
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Require both user_id and encryption key.
|
||||||
|
fn require_user_and_key(
|
||||||
|
ctx: &RequestContext<RoleServer>,
|
||||||
|
) -> Result<(Uuid, [u8; 32]), rmcp::ErrorData> {
|
||||||
|
let user_id = Self::require_user_id(ctx)?;
|
||||||
|
let key = Self::extract_enc_key(ctx)?;
|
||||||
|
Ok((user_id, key))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Tool parameter types ──────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct SearchInput {
|
||||||
|
#[schemars(description = "Namespace filter (e.g. 'refining', 'ricnsmart')")]
|
||||||
|
namespace: Option<String>,
|
||||||
|
#[schemars(description = "Kind filter (e.g. 'server', 'service', 'key')")]
|
||||||
|
kind: Option<String>,
|
||||||
|
#[schemars(description = "Exact record name")]
|
||||||
|
name: Option<String>,
|
||||||
|
#[schemars(description = "Tag filters (all must match)")]
|
||||||
|
tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Fuzzy search across name, namespace, kind, tags, metadata")]
|
||||||
|
query: Option<String>,
|
||||||
|
#[schemars(description = "Return only summary fields (name/tags/desc/updated_at)")]
|
||||||
|
summary: Option<bool>,
|
||||||
|
#[schemars(description = "Sort order: 'name' (default), 'updated', 'created'")]
|
||||||
|
sort: Option<String>,
|
||||||
|
#[schemars(description = "Max results (default 20)")]
|
||||||
|
limit: Option<u32>,
|
||||||
|
#[schemars(description = "Pagination offset (default 0)")]
|
||||||
|
offset: Option<u32>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct GetSecretInput {
|
||||||
|
#[schemars(description = "Namespace of the entry")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind of the entry (e.g. 'server', 'service')")]
|
||||||
|
kind: String,
|
||||||
|
#[schemars(description = "Name of the entry")]
|
||||||
|
name: String,
|
||||||
|
#[schemars(description = "Specific field to retrieve. If omitted, returns all fields.")]
|
||||||
|
field: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct AddInput {
|
||||||
|
#[schemars(description = "Namespace")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind (e.g. 'server', 'service', 'key')")]
|
||||||
|
kind: String,
|
||||||
|
#[schemars(description = "Unique name within namespace+kind")]
|
||||||
|
name: String,
|
||||||
|
#[schemars(description = "Tags for this entry")]
|
||||||
|
tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Metadata fields as 'key=value' or 'key:=json' strings")]
|
||||||
|
meta: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Secret fields as 'key=value' strings")]
|
||||||
|
secrets: Option<Vec<String>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct UpdateInput {
|
||||||
|
#[schemars(description = "Namespace")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind")]
|
||||||
|
kind: String,
|
||||||
|
#[schemars(description = "Name")]
|
||||||
|
name: String,
|
||||||
|
#[schemars(description = "Tags to add")]
|
||||||
|
add_tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Tags to remove")]
|
||||||
|
remove_tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Metadata fields to update/add as 'key=value' strings")]
|
||||||
|
meta: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Metadata field keys to remove")]
|
||||||
|
remove_meta: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Secret fields to update/add as 'key=value' strings")]
|
||||||
|
secrets: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Secret field keys to remove")]
|
||||||
|
remove_secrets: Option<Vec<String>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct DeleteInput {
|
||||||
|
#[schemars(description = "Namespace")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind filter (required for single delete)")]
|
||||||
|
kind: Option<String>,
|
||||||
|
#[schemars(description = "Exact name to delete. Omit for bulk delete by namespace+kind.")]
|
||||||
|
name: Option<String>,
|
||||||
|
#[schemars(description = "Preview deletions without writing")]
|
||||||
|
dry_run: Option<bool>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct HistoryInput {
|
||||||
|
#[schemars(description = "Namespace")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind")]
|
||||||
|
kind: String,
|
||||||
|
#[schemars(description = "Name")]
|
||||||
|
name: String,
|
||||||
|
#[schemars(description = "Max history entries to return (default 20)")]
|
||||||
|
limit: Option<u32>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct RollbackInput {
|
||||||
|
#[schemars(description = "Namespace")]
|
||||||
|
namespace: String,
|
||||||
|
#[schemars(description = "Kind")]
|
||||||
|
kind: String,
|
||||||
|
#[schemars(description = "Name")]
|
||||||
|
name: String,
|
||||||
|
#[schemars(description = "Target version number. Omit to restore the most recent snapshot.")]
|
||||||
|
to_version: Option<i64>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct ExportInput {
|
||||||
|
#[schemars(description = "Namespace filter")]
|
||||||
|
namespace: Option<String>,
|
||||||
|
#[schemars(description = "Kind filter")]
|
||||||
|
kind: Option<String>,
|
||||||
|
#[schemars(description = "Exact name filter")]
|
||||||
|
name: Option<String>,
|
||||||
|
#[schemars(description = "Tag filters")]
|
||||||
|
tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Fuzzy query")]
|
||||||
|
query: Option<String>,
|
||||||
|
#[schemars(description = "Export format: 'json' (default), 'toml', 'yaml'")]
|
||||||
|
format: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Deserialize, JsonSchema)]
|
||||||
|
struct EnvMapInput {
|
||||||
|
#[schemars(description = "Namespace filter")]
|
||||||
|
namespace: Option<String>,
|
||||||
|
#[schemars(description = "Kind filter")]
|
||||||
|
kind: Option<String>,
|
||||||
|
#[schemars(description = "Exact name filter")]
|
||||||
|
name: Option<String>,
|
||||||
|
#[schemars(description = "Tag filters")]
|
||||||
|
tags: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Only include these secret fields")]
|
||||||
|
only_fields: Option<Vec<String>>,
|
||||||
|
#[schemars(description = "Environment variable name prefix")]
|
||||||
|
prefix: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Tool implementations ──────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[tool_router]
|
||||||
|
impl SecretsService {
|
||||||
|
#[tool(
|
||||||
|
description = "Search entries in the secrets store. Returns entries with metadata and \
|
||||||
|
secret field names (not values). Use secrets_get to decrypt secret values."
|
||||||
|
)]
|
||||||
|
async fn secrets_search(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<SearchInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let user_id = Self::user_id_from_ctx(&ctx)?;
|
||||||
|
let tags = input.tags.unwrap_or_default();
|
||||||
|
let result = svc_search(
|
||||||
|
&self.pool,
|
||||||
|
SearchParams {
|
||||||
|
namespace: input.namespace.as_deref(),
|
||||||
|
kind: input.kind.as_deref(),
|
||||||
|
name: input.name.as_deref(),
|
||||||
|
tags: &tags,
|
||||||
|
query: input.query.as_deref(),
|
||||||
|
sort: input.sort.as_deref().unwrap_or("name"),
|
||||||
|
limit: input.limit.unwrap_or(20),
|
||||||
|
offset: input.offset.unwrap_or(0),
|
||||||
|
user_id,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let summary = input.summary.unwrap_or(false);
|
||||||
|
let entries: Vec<serde_json::Value> = result
|
||||||
|
.entries
|
||||||
|
.iter()
|
||||||
|
.map(|e| {
|
||||||
|
if summary {
|
||||||
|
serde_json::json!({
|
||||||
|
"namespace": e.namespace,
|
||||||
|
"kind": e.kind,
|
||||||
|
"name": e.name,
|
||||||
|
"tags": e.tags,
|
||||||
|
"desc": e.metadata.get("desc").or_else(|| e.metadata.get("url"))
|
||||||
|
.and_then(|v| v.as_str()).unwrap_or(""),
|
||||||
|
"updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
||||||
|
})
|
||||||
|
} else {
|
||||||
|
let schema: Vec<&str> = result
|
||||||
|
.secret_schemas
|
||||||
|
.get(&e.id)
|
||||||
|
.map(|f| f.iter().map(|s| s.field_name.as_str()).collect())
|
||||||
|
.unwrap_or_default();
|
||||||
|
serde_json::json!({
|
||||||
|
"id": e.id,
|
||||||
|
"namespace": e.namespace,
|
||||||
|
"kind": e.kind,
|
||||||
|
"name": e.name,
|
||||||
|
"tags": e.tags,
|
||||||
|
"metadata": e.metadata,
|
||||||
|
"secret_fields": schema,
|
||||||
|
"version": e.version,
|
||||||
|
"updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
||||||
|
})
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.collect();
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&entries).unwrap_or_else(|_| "[]".to_string());
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Get decrypted secret field values for an entry. Requires your \
|
||||||
|
encryption key via X-Encryption-Key header (64 hex chars, PBKDF2-derived). \
|
||||||
|
Returns all fields, or a specific field if 'field' is provided."
|
||||||
|
)]
|
||||||
|
async fn secrets_get(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<GetSecretInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
|
||||||
|
if let Some(field_name) = &input.field {
|
||||||
|
let value = get_secret_field(
|
||||||
|
&self.pool,
|
||||||
|
&input.namespace,
|
||||||
|
&input.kind,
|
||||||
|
&input.name,
|
||||||
|
field_name,
|
||||||
|
&user_key,
|
||||||
|
Some(user_id),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let result = serde_json::json!({ field_name: value });
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
} else {
|
||||||
|
let secrets = get_all_secrets(
|
||||||
|
&self.pool,
|
||||||
|
&input.namespace,
|
||||||
|
&input.kind,
|
||||||
|
&input.name,
|
||||||
|
&user_key,
|
||||||
|
Some(user_id),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&secrets).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Add or upsert an entry with metadata and encrypted secret fields. \
|
||||||
|
Requires X-Encryption-Key header. \
|
||||||
|
Meta and secret values use 'key=value', 'key=@file', or 'key:=<json>' format."
|
||||||
|
)]
|
||||||
|
async fn secrets_add(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<AddInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
|
||||||
|
let tags = input.tags.unwrap_or_default();
|
||||||
|
let meta = input.meta.unwrap_or_default();
|
||||||
|
let secrets = input.secrets.unwrap_or_default();
|
||||||
|
|
||||||
|
let result = svc_add(
|
||||||
|
&self.pool,
|
||||||
|
AddParams {
|
||||||
|
namespace: &input.namespace,
|
||||||
|
kind: &input.kind,
|
||||||
|
name: &input.name,
|
||||||
|
tags: &tags,
|
||||||
|
meta_entries: &meta,
|
||||||
|
secret_entries: &secrets,
|
||||||
|
user_id: Some(user_id),
|
||||||
|
},
|
||||||
|
&user_key,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Incrementally update an existing entry. Requires X-Encryption-Key header. \
|
||||||
|
Only the fields you specify are changed; everything else is preserved."
|
||||||
|
)]
|
||||||
|
async fn secrets_update(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<UpdateInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
|
||||||
|
let add_tags = input.add_tags.unwrap_or_default();
|
||||||
|
let remove_tags = input.remove_tags.unwrap_or_default();
|
||||||
|
let meta = input.meta.unwrap_or_default();
|
||||||
|
let remove_meta = input.remove_meta.unwrap_or_default();
|
||||||
|
let secrets = input.secrets.unwrap_or_default();
|
||||||
|
let remove_secrets = input.remove_secrets.unwrap_or_default();
|
||||||
|
|
||||||
|
let result = svc_update(
|
||||||
|
&self.pool,
|
||||||
|
UpdateParams {
|
||||||
|
namespace: &input.namespace,
|
||||||
|
kind: &input.kind,
|
||||||
|
name: &input.name,
|
||||||
|
add_tags: &add_tags,
|
||||||
|
remove_tags: &remove_tags,
|
||||||
|
meta_entries: &meta,
|
||||||
|
remove_meta: &remove_meta,
|
||||||
|
secret_entries: &secrets,
|
||||||
|
remove_secrets: &remove_secrets,
|
||||||
|
user_id: Some(user_id),
|
||||||
|
},
|
||||||
|
&user_key,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Delete one entry (specify namespace+kind+name) or bulk delete all \
|
||||||
|
entries matching namespace+kind. Use dry_run=true to preview."
|
||||||
|
)]
|
||||||
|
async fn secrets_delete(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<DeleteInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let user_id = Self::user_id_from_ctx(&ctx)?;
|
||||||
|
|
||||||
|
let result = svc_delete(
|
||||||
|
&self.pool,
|
||||||
|
DeleteParams {
|
||||||
|
namespace: &input.namespace,
|
||||||
|
kind: input.kind.as_deref(),
|
||||||
|
name: input.name.as_deref(),
|
||||||
|
dry_run: input.dry_run.unwrap_or(false),
|
||||||
|
user_id,
|
||||||
|
},
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "View change history for an entry. Returns a list of versions with \
|
||||||
|
actions and timestamps."
|
||||||
|
)]
|
||||||
|
async fn secrets_history(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<HistoryInput>,
|
||||||
|
_ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let result = svc_history(
|
||||||
|
&self.pool,
|
||||||
|
&input.namespace,
|
||||||
|
&input.kind,
|
||||||
|
&input.name,
|
||||||
|
input.limit.unwrap_or(20),
|
||||||
|
None,
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Rollback an entry to a previous version. Requires X-Encryption-Key header. \
|
||||||
|
Omit to_version to restore the most recent snapshot."
|
||||||
|
)]
|
||||||
|
async fn secrets_rollback(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<RollbackInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
|
||||||
|
let result = svc_rollback(
|
||||||
|
&self.pool,
|
||||||
|
&input.namespace,
|
||||||
|
&input.kind,
|
||||||
|
&input.name,
|
||||||
|
input.to_version,
|
||||||
|
&user_key,
|
||||||
|
Some(user_id),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&result).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Export matching entries with decrypted secrets as JSON/TOML/YAML string. \
|
||||||
|
Requires X-Encryption-Key header. Useful for backup or data migration."
|
||||||
|
)]
|
||||||
|
async fn secrets_export(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<ExportInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
let tags = input.tags.unwrap_or_default();
|
||||||
|
let format = input.format.as_deref().unwrap_or("json");
|
||||||
|
|
||||||
|
let data = svc_export(
|
||||||
|
&self.pool,
|
||||||
|
ExportParams {
|
||||||
|
namespace: input.namespace.as_deref(),
|
||||||
|
kind: input.kind.as_deref(),
|
||||||
|
name: input.name.as_deref(),
|
||||||
|
tags: &tags,
|
||||||
|
query: input.query.as_deref(),
|
||||||
|
no_secrets: false,
|
||||||
|
user_id: Some(user_id),
|
||||||
|
},
|
||||||
|
Some(&user_key),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let serialized = format
|
||||||
|
.parse::<secrets_core::models::ExportFormat>()
|
||||||
|
.and_then(|fmt| fmt.serialize(&data))
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(serialized)]))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[tool(
|
||||||
|
description = "Preview the environment variable mapping that would be injected when \
|
||||||
|
running a command. Requires X-Encryption-Key header. \
|
||||||
|
Shows variable names and sources, useful for debugging."
|
||||||
|
)]
|
||||||
|
async fn secrets_env_map(
|
||||||
|
&self,
|
||||||
|
Parameters(input): Parameters<EnvMapInput>,
|
||||||
|
ctx: RequestContext<RoleServer>,
|
||||||
|
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||||
|
let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
|
||||||
|
let tags = input.tags.unwrap_or_default();
|
||||||
|
let only_fields = input.only_fields.unwrap_or_default();
|
||||||
|
|
||||||
|
let env_map = secrets_core::service::env_map::build_env_map(
|
||||||
|
&self.pool,
|
||||||
|
input.namespace.as_deref(),
|
||||||
|
input.kind.as_deref(),
|
||||||
|
input.name.as_deref(),
|
||||||
|
&tags,
|
||||||
|
&only_fields,
|
||||||
|
input.prefix.as_deref().unwrap_or(""),
|
||||||
|
&user_key,
|
||||||
|
Some(user_id),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| rmcp::ErrorData::internal_error(e.to_string(), None))?;
|
||||||
|
|
||||||
|
let json = serde_json::to_string_pretty(&env_map).unwrap_or_default();
|
||||||
|
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── ServerHandler ─────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[tool_handler]
|
||||||
|
impl ServerHandler for SecretsService {
|
||||||
|
fn get_info(&self) -> InitializeResult {
|
||||||
|
let mut info = InitializeResult::new(ServerCapabilities::builder().enable_tools().build());
|
||||||
|
info.server_info = Implementation::new("secrets-mcp", env!("CARGO_PKG_VERSION"));
|
||||||
|
info.protocol_version = ProtocolVersion::V_2025_03_26;
|
||||||
|
info.instructions = Some(
|
||||||
|
"Manage cross-device secrets and configuration securely. \
|
||||||
|
Data is encrypted with your passphrase-derived key. \
|
||||||
|
Include your 64-char hex key in the X-Encryption-Key header for all read/write operations. \
|
||||||
|
Use secrets_search to discover entries (no key needed), \
|
||||||
|
secrets_get to decrypt secret values, \
|
||||||
|
and secrets_add/secrets_update to write encrypted secrets."
|
||||||
|
.to_string(),
|
||||||
|
);
|
||||||
|
info
|
||||||
|
}
|
||||||
|
}
|
||||||
494
crates/secrets-mcp/src/web.rs
Normal file
494
crates/secrets-mcp/src/web.rs
Normal file
@@ -0,0 +1,494 @@
|
|||||||
|
use askama::Template;
|
||||||
|
use axum::{
|
||||||
|
Json, Router,
|
||||||
|
extract::{Path, Query, State},
|
||||||
|
http::StatusCode,
|
||||||
|
response::{Html, IntoResponse, Redirect, Response},
|
||||||
|
routing::{get, post},
|
||||||
|
};
|
||||||
|
use serde::{Deserialize, Serialize};
|
||||||
|
use tower_sessions::Session;
|
||||||
|
use uuid::Uuid;
|
||||||
|
|
||||||
|
use secrets_core::crypto::hex;
|
||||||
|
use secrets_core::service::{
|
||||||
|
api_key::{ensure_api_key, regenerate_api_key},
|
||||||
|
user::{
|
||||||
|
OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
|
||||||
|
unbind_oauth_account, update_user_key_setup,
|
||||||
|
},
|
||||||
|
};
|
||||||
|
|
||||||
|
use crate::AppState;
|
||||||
|
use crate::oauth::{OAuthConfig, OAuthUserInfo, google_auth_url, random_state};
|
||||||
|
|
||||||
|
const SESSION_USER_ID: &str = "user_id";
|
||||||
|
const SESSION_OAUTH_STATE: &str = "oauth_state";
|
||||||
|
const SESSION_OAUTH_BIND_MODE: &str = "oauth_bind_mode";
|
||||||
|
const SESSION_LOGIN_PROVIDER: &str = "login_provider";
|
||||||
|
|
||||||
|
// ── Template types ────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Template)]
|
||||||
|
#[template(path = "login.html")]
|
||||||
|
struct LoginTemplate {
|
||||||
|
has_google: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Template)]
|
||||||
|
#[template(path = "dashboard.html")]
|
||||||
|
struct DashboardTemplate {
|
||||||
|
user_name: String,
|
||||||
|
user_email: String,
|
||||||
|
has_passphrase: bool,
|
||||||
|
base_url: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── App state helpers ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
fn google_cfg(state: &AppState) -> Option<&OAuthConfig> {
|
||||||
|
state.google_config.as_ref()
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn current_user_id(session: &Session) -> Option<Uuid> {
|
||||||
|
session
|
||||||
|
.get::<String>(SESSION_USER_ID)
|
||||||
|
.await
|
||||||
|
.ok()
|
||||||
|
.flatten()
|
||||||
|
.and_then(|s| Uuid::parse_str(&s).ok())
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Routes ────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
pub fn web_router() -> Router<AppState> {
|
||||||
|
Router::new()
|
||||||
|
.route("/", get(login_page))
|
||||||
|
.route("/auth/google", get(auth_google))
|
||||||
|
.route("/auth/google/callback", get(auth_google_callback))
|
||||||
|
.route("/auth/logout", post(auth_logout))
|
||||||
|
.route("/dashboard", get(dashboard))
|
||||||
|
.route("/account/bind/google", get(account_bind_google))
|
||||||
|
.route(
|
||||||
|
"/account/bind/google/callback",
|
||||||
|
get(account_bind_google_callback),
|
||||||
|
)
|
||||||
|
.route("/account/unbind/{provider}", post(account_unbind))
|
||||||
|
.route("/api/key-salt", get(api_key_salt))
|
||||||
|
.route("/api/key-setup", post(api_key_setup))
|
||||||
|
.route("/api/apikey", get(api_apikey_get))
|
||||||
|
.route("/api/apikey/regenerate", post(api_apikey_regenerate))
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Login page ────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn login_page(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
if let Some(_uid) = current_user_id(&session).await {
|
||||||
|
return Ok(Redirect::to("/dashboard").into_response());
|
||||||
|
}
|
||||||
|
|
||||||
|
let tmpl = LoginTemplate {
|
||||||
|
has_google: state.google_config.is_some(),
|
||||||
|
};
|
||||||
|
render_template(tmpl)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Google OAuth ──────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn auth_google(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
let config = google_cfg(&state).ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
|
||||||
|
|
||||||
|
let oauth_state = random_state();
|
||||||
|
session
|
||||||
|
.insert(SESSION_OAUTH_STATE, &oauth_state)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
let url = google_auth_url(config, &oauth_state);
|
||||||
|
Ok(Redirect::to(&url).into_response())
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct OAuthCallbackQuery {
|
||||||
|
code: Option<String>,
|
||||||
|
state: Option<String>,
|
||||||
|
error: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn auth_google_callback(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
Query(params): Query<OAuthCallbackQuery>,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
handle_oauth_callback(&state, &session, params, "google", |s, cfg, code| {
|
||||||
|
Box::pin(crate::oauth::google::exchange_code(
|
||||||
|
&s.http_client,
|
||||||
|
cfg,
|
||||||
|
code,
|
||||||
|
))
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Shared OAuth callback handler ─────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn handle_oauth_callback<F>(
|
||||||
|
state: &AppState,
|
||||||
|
session: &Session,
|
||||||
|
params: OAuthCallbackQuery,
|
||||||
|
provider: &str,
|
||||||
|
exchange_fn: F,
|
||||||
|
) -> Result<Response, StatusCode>
|
||||||
|
where
|
||||||
|
F: for<'a> Fn(
|
||||||
|
&'a AppState,
|
||||||
|
&'a OAuthConfig,
|
||||||
|
&'a str,
|
||||||
|
) -> std::pin::Pin<
|
||||||
|
Box<dyn std::future::Future<Output = anyhow::Result<OAuthUserInfo>> + Send + 'a>,
|
||||||
|
>,
|
||||||
|
{
|
||||||
|
if let Some(err) = params.error {
|
||||||
|
tracing::warn!(provider, error = %err, "OAuth error");
|
||||||
|
return Ok(Redirect::to("/?error=oauth_error").into_response());
|
||||||
|
}
|
||||||
|
|
||||||
|
let Some(code) = params.code else {
|
||||||
|
tracing::warn!(provider, "OAuth callback missing code");
|
||||||
|
return Ok(Redirect::to("/?error=oauth_missing_code").into_response());
|
||||||
|
};
|
||||||
|
let Some(returned_state) = params.state.as_deref() else {
|
||||||
|
tracing::warn!(provider, "OAuth callback missing state");
|
||||||
|
return Ok(Redirect::to("/?error=oauth_missing_state").into_response());
|
||||||
|
};
|
||||||
|
|
||||||
|
let expected_state: Option<String> = session
|
||||||
|
.get(SESSION_OAUTH_STATE)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
if expected_state.as_deref() != Some(returned_state) {
|
||||||
|
tracing::warn!(
|
||||||
|
provider,
|
||||||
|
expected_present = expected_state.is_some(),
|
||||||
|
"OAuth state mismatch (empty session often means SameSite=Strict or server restart)"
|
||||||
|
);
|
||||||
|
return Ok(Redirect::to("/?error=oauth_state").into_response());
|
||||||
|
}
|
||||||
|
session.remove::<String>(SESSION_OAUTH_STATE).await.ok();
|
||||||
|
|
||||||
|
let config = match provider {
|
||||||
|
"google" => state
|
||||||
|
.google_config
|
||||||
|
.as_ref()
|
||||||
|
.ok_or(StatusCode::SERVICE_UNAVAILABLE)?,
|
||||||
|
_ => return Err(StatusCode::BAD_REQUEST),
|
||||||
|
};
|
||||||
|
|
||||||
|
let user_info = exchange_fn(state, config, code.as_str())
|
||||||
|
.await
|
||||||
|
.map_err(|e| {
|
||||||
|
tracing::error!(provider, error = %e, "failed to exchange OAuth code");
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR
|
||||||
|
})?;
|
||||||
|
|
||||||
|
let bind_mode: bool = session
|
||||||
|
.get(SESSION_OAUTH_BIND_MODE)
|
||||||
|
.await
|
||||||
|
.unwrap_or(None)
|
||||||
|
.unwrap_or(false);
|
||||||
|
|
||||||
|
if bind_mode {
|
||||||
|
let user_id = current_user_id(session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
session.remove::<bool>(SESSION_OAUTH_BIND_MODE).await.ok();
|
||||||
|
|
||||||
|
let profile = OAuthProfile {
|
||||||
|
provider: user_info.provider,
|
||||||
|
provider_id: user_info.provider_id,
|
||||||
|
email: user_info.email,
|
||||||
|
name: user_info.name,
|
||||||
|
avatar_url: user_info.avatar_url,
|
||||||
|
};
|
||||||
|
|
||||||
|
bind_oauth_account(&state.pool, user_id, profile)
|
||||||
|
.await
|
||||||
|
.map_err(|e| {
|
||||||
|
tracing::error!(error = %e, "failed to bind OAuth account");
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR
|
||||||
|
})?;
|
||||||
|
|
||||||
|
return Ok(Redirect::to("/dashboard?bound=1").into_response());
|
||||||
|
}
|
||||||
|
|
||||||
|
let profile = OAuthProfile {
|
||||||
|
provider: user_info.provider,
|
||||||
|
provider_id: user_info.provider_id,
|
||||||
|
email: user_info.email,
|
||||||
|
name: user_info.name,
|
||||||
|
avatar_url: user_info.avatar_url,
|
||||||
|
};
|
||||||
|
|
||||||
|
let (user, _is_new) = find_or_create_user(&state.pool, profile)
|
||||||
|
.await
|
||||||
|
.map_err(|e| {
|
||||||
|
tracing::error!(error = %e, "failed to find or create user");
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR
|
||||||
|
})?;
|
||||||
|
|
||||||
|
// Ensure the user has an API key (auto-creates on first login).
|
||||||
|
if let Err(e) = ensure_api_key(&state.pool, user.id).await {
|
||||||
|
tracing::warn!(error = %e, "failed to ensure api key for user");
|
||||||
|
}
|
||||||
|
|
||||||
|
session
|
||||||
|
.insert(SESSION_USER_ID, user.id.to_string())
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
session
|
||||||
|
.insert(SESSION_LOGIN_PROVIDER, &provider)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
Ok(Redirect::to("/dashboard").into_response())
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Logout ────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn auth_logout(session: Session) -> impl IntoResponse {
|
||||||
|
session.flush().await.ok();
|
||||||
|
Redirect::to("/")
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Dashboard ─────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn dashboard(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let user = get_user_by_id(&state.pool, user_id)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let tmpl = DashboardTemplate {
|
||||||
|
user_name: user.name.clone(),
|
||||||
|
user_email: user.email.clone().unwrap_or_default(),
|
||||||
|
has_passphrase: user.key_salt.is_some(),
|
||||||
|
base_url: state.base_url.clone(),
|
||||||
|
};
|
||||||
|
|
||||||
|
render_template(tmpl)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Account bind/unbind ───────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async fn account_bind_google(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
let _ = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
session
|
||||||
|
.insert(SESSION_OAUTH_BIND_MODE, true)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
let redirect_uri = format!("{}/account/bind/google/callback", state.base_url);
|
||||||
|
let mut cfg = state
|
||||||
|
.google_config
|
||||||
|
.clone()
|
||||||
|
.ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
|
||||||
|
cfg.redirect_uri = redirect_uri;
|
||||||
|
let st = random_state();
|
||||||
|
session.insert(SESSION_OAUTH_STATE, &st).await.ok();
|
||||||
|
|
||||||
|
Ok(Redirect::to(&google_auth_url(&cfg, &st)).into_response())
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn account_bind_google_callback(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
Query(params): Query<OAuthCallbackQuery>,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
handle_oauth_callback(&state, &session, params, "google", |s, cfg, code| {
|
||||||
|
Box::pin(crate::oauth::google::exchange_code(
|
||||||
|
&s.http_client,
|
||||||
|
cfg,
|
||||||
|
code,
|
||||||
|
))
|
||||||
|
})
|
||||||
|
.await
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn account_unbind(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
Path(provider): Path<String>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Response, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let current_login_provider = session
|
||||||
|
.get::<String>(SESSION_LOGIN_PROVIDER)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
unbind_oauth_account(
|
||||||
|
&state.pool,
|
||||||
|
user_id,
|
||||||
|
&provider,
|
||||||
|
current_login_provider.as_deref(),
|
||||||
|
)
|
||||||
|
.await
|
||||||
|
.map_err(|e| {
|
||||||
|
tracing::warn!(error = %e, "failed to unbind oauth account");
|
||||||
|
StatusCode::BAD_REQUEST
|
||||||
|
})?;
|
||||||
|
|
||||||
|
Ok(Redirect::to("/dashboard?unbound=1").into_response())
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Passphrase / Key setup API ────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Serialize)]
|
||||||
|
struct KeySaltResponse {
|
||||||
|
has_passphrase: bool,
|
||||||
|
#[serde(skip_serializing_if = "Option::is_none")]
|
||||||
|
salt: Option<String>,
|
||||||
|
#[serde(skip_serializing_if = "Option::is_none")]
|
||||||
|
key_check: Option<String>,
|
||||||
|
#[serde(skip_serializing_if = "Option::is_none")]
|
||||||
|
params: Option<serde_json::Value>,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn api_key_salt(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Json<KeySaltResponse>, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let user = get_user_by_id(&state.pool, user_id)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
if user.key_salt.is_none() {
|
||||||
|
return Ok(Json(KeySaltResponse {
|
||||||
|
has_passphrase: false,
|
||||||
|
salt: None,
|
||||||
|
key_check: None,
|
||||||
|
params: None,
|
||||||
|
}));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(Json(KeySaltResponse {
|
||||||
|
has_passphrase: true,
|
||||||
|
salt: user.key_salt.as_deref().map(hex::encode_hex),
|
||||||
|
key_check: user.key_check.as_deref().map(hex::encode_hex),
|
||||||
|
params: user.key_params,
|
||||||
|
}))
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Deserialize)]
|
||||||
|
struct KeySetupRequest {
|
||||||
|
/// Hex-encoded 32-byte random salt
|
||||||
|
salt: String,
|
||||||
|
/// Hex-encoded AES-256-GCM encryption of "secrets-mcp-key-check" with the derived key
|
||||||
|
key_check: String,
|
||||||
|
/// Key derivation parameters, e.g. {"alg":"pbkdf2-sha256","iterations":600000}
|
||||||
|
params: serde_json::Value,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Serialize)]
|
||||||
|
struct KeySetupResponse {
|
||||||
|
ok: bool,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn api_key_setup(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
Json(body): Json<KeySetupRequest>,
|
||||||
|
) -> Result<Json<KeySetupResponse>, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let salt = hex::decode_hex(&body.salt).map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||||
|
let key_check = hex::decode_hex(&body.key_check).map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||||
|
|
||||||
|
if salt.len() != 32 {
|
||||||
|
return Err(StatusCode::BAD_REQUEST);
|
||||||
|
}
|
||||||
|
|
||||||
|
update_user_key_setup(&state.pool, user_id, &salt, &key_check, &body.params)
|
||||||
|
.await
|
||||||
|
.map_err(|e| {
|
||||||
|
tracing::error!(error = %e, "failed to update key setup");
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR
|
||||||
|
})?;
|
||||||
|
|
||||||
|
Ok(Json(KeySetupResponse { ok: true }))
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── API Key management ────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
#[derive(Serialize)]
|
||||||
|
struct ApiKeyResponse {
|
||||||
|
api_key: String,
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn api_apikey_get(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Json<ApiKeyResponse>, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let api_key = ensure_api_key(&state.pool, user_id)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
Ok(Json(ApiKeyResponse { api_key }))
|
||||||
|
}
|
||||||
|
|
||||||
|
async fn api_apikey_regenerate(
|
||||||
|
State(state): State<AppState>,
|
||||||
|
session: Session,
|
||||||
|
) -> Result<Json<ApiKeyResponse>, StatusCode> {
|
||||||
|
let user_id = current_user_id(&session)
|
||||||
|
.await
|
||||||
|
.ok_or(StatusCode::UNAUTHORIZED)?;
|
||||||
|
|
||||||
|
let api_key = regenerate_api_key(&state.pool, user_id)
|
||||||
|
.await
|
||||||
|
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||||
|
|
||||||
|
Ok(Json(ApiKeyResponse { api_key }))
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Helper ────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
fn render_template<T: Template>(tmpl: T) -> Result<Response, StatusCode> {
|
||||||
|
let html = tmpl.render().map_err(|e| {
|
||||||
|
tracing::error!(error = %e, "template render error");
|
||||||
|
StatusCode::INTERNAL_SERVER_ERROR
|
||||||
|
})?;
|
||||||
|
Ok(Html(html).into_response())
|
||||||
|
}
|
||||||
725
crates/secrets-mcp/templates/dashboard.html
Normal file
725
crates/secrets-mcp/templates/dashboard.html
Normal file
@@ -0,0 +1,725 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="zh-CN">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||||
|
<title>Secrets</title>
|
||||||
|
<style>
|
||||||
|
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
|
||||||
|
@import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600&family=Inter:wght@400;500;600&display=swap');
|
||||||
|
:root {
|
||||||
|
--bg: #0d1117; --surface: #161b22; --surface2: #21262d;
|
||||||
|
--border: #30363d; --text: #e6edf3; --text-muted: #8b949e;
|
||||||
|
--accent: #58a6ff; --accent-hover: #79b8ff;
|
||||||
|
--danger: #f85149; --success: #3fb950; --warn: #d29922;
|
||||||
|
}
|
||||||
|
body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }
|
||||||
|
|
||||||
|
/* Nav */
|
||||||
|
.nav { background: var(--surface); border-bottom: 1px solid var(--border);
|
||||||
|
padding: 0 24px; display: flex; align-items: center; gap: 12px; height: 52px; }
|
||||||
|
.nav-logo { font-family: 'JetBrains Mono', monospace; font-size: 15px; font-weight: 600;
|
||||||
|
color: var(--text); text-decoration: none; }
|
||||||
|
.nav-logo span { color: var(--accent); }
|
||||||
|
.nav-spacer { flex: 1; }
|
||||||
|
.nav-user { font-size: 13px; color: var(--text-muted); }
|
||||||
|
.lang-bar { display: flex; gap: 2px; background: var(--surface2); border-radius: 6px; padding: 2px; }
|
||||||
|
.lang-btn { padding: 3px 9px; border: none; background: none; color: var(--text-muted);
|
||||||
|
font-size: 12px; cursor: pointer; border-radius: 4px; }
|
||||||
|
.lang-btn.active { background: var(--border); color: var(--text); }
|
||||||
|
.btn-sign-out { padding: 5px 12px; border-radius: 6px; border: 1px solid var(--border);
|
||||||
|
background: none; color: var(--text); font-size: 12px; cursor: pointer; }
|
||||||
|
.btn-sign-out:hover { background: var(--surface2); }
|
||||||
|
|
||||||
|
/* Main */
|
||||||
|
.main { display: flex; justify-content: center; align-items: flex-start;
|
||||||
|
padding: 48px 24px; min-height: calc(100vh - 52px); }
|
||||||
|
.card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
|
||||||
|
padding: 32px; width: 100%; max-width: 980px; }
|
||||||
|
.card-title { font-size: 18px; font-weight: 600; margin-bottom: 6px; }
|
||||||
|
.card-sub { font-size: 13px; color: var(--text-muted); line-height: 1.6; margin-bottom: 24px; }
|
||||||
|
.info-box { background: var(--surface2); border: 1px solid var(--border); border-radius: 8px;
|
||||||
|
padding: 12px 14px; margin-bottom: 18px; }
|
||||||
|
.info-title { font-size: 12px; font-weight: 600; color: var(--text); margin-bottom: 8px; }
|
||||||
|
.info-line { font-size: 12px; color: var(--text-muted); line-height: 1.6; }
|
||||||
|
/* Form */
|
||||||
|
.field { margin-bottom: 12px; }
|
||||||
|
.field label { display: block; font-size: 12px; color: var(--text-muted); margin-bottom: 5px; }
|
||||||
|
.field input { width: 100%; background: var(--bg); border: 1px solid var(--border);
|
||||||
|
color: var(--text); padding: 9px 12px; border-radius: 6px;
|
||||||
|
font-size: 13px; outline: none; }
|
||||||
|
.field input:focus { border-color: var(--accent); }
|
||||||
|
.error-msg { color: var(--danger); font-size: 12px; margin-top: 6px; display: none; }
|
||||||
|
|
||||||
|
/* Buttons */
|
||||||
|
.btn-primary { display: inline-flex; align-items: center; gap: 6px; width: 100%;
|
||||||
|
justify-content: center; padding: 10px 20px; border-radius: 7px;
|
||||||
|
border: none; background: var(--accent); color: #0d1117;
|
||||||
|
font-size: 14px; font-weight: 600; cursor: pointer; transition: background 0.15s; }
|
||||||
|
.btn-primary:hover { background: var(--accent-hover); }
|
||||||
|
.btn-primary:disabled { opacity: 0.5; cursor: not-allowed; }
|
||||||
|
.btn-sm { display: inline-flex; align-items: center; gap: 4px; padding: 5px 12px;
|
||||||
|
border-radius: 5px; border: 1px solid var(--border); background: none;
|
||||||
|
color: var(--text-muted); font-size: 12px; cursor: pointer; }
|
||||||
|
.btn-sm:hover { color: var(--text); border-color: var(--text-muted); }
|
||||||
|
.btn-copy { display: flex; align-items: center; gap: 8px; width: 100%; justify-content: center;
|
||||||
|
padding: 11px 20px; border-radius: 7px; border: 1px solid var(--success);
|
||||||
|
background: rgba(63,185,80,0.1); color: var(--success);
|
||||||
|
font-size: 14px; font-weight: 600; cursor: pointer; transition: all 0.15s; }
|
||||||
|
.btn-copy:hover { background: rgba(63,185,80,0.2); }
|
||||||
|
.btn-copy.copied { background: var(--success); color: #0d1117; border-color: var(--success); }
|
||||||
|
|
||||||
|
.support-row { display: flex; gap: 8px; margin-bottom: 12px; flex-wrap: wrap; }
|
||||||
|
.support-chip { display: inline-flex; align-items: center; padding: 6px 10px; border-radius: 999px;
|
||||||
|
border: 1px solid var(--border); background: var(--surface2);
|
||||||
|
color: var(--text-muted); font-size: 12px; }
|
||||||
|
|
||||||
|
/* Config box */
|
||||||
|
.config-wrap { position: relative; margin-bottom: 14px; }
|
||||||
|
.config-box { background: var(--bg); border: 1px solid var(--border); border-radius: 8px;
|
||||||
|
padding: 16px; font-family: 'JetBrains Mono', monospace; font-size: 11px;
|
||||||
|
line-height: 1.7; color: var(--text); overflow-x: auto; white-space: pre; }
|
||||||
|
.config-box.locked { color: var(--text-muted); filter: blur(3px); user-select: none;
|
||||||
|
pointer-events: none; }
|
||||||
|
.config-key { color: #79c0ff; }
|
||||||
|
.config-str { color: #a5d6ff; }
|
||||||
|
.config-val { color: var(--accent); }
|
||||||
|
|
||||||
|
/* Divider */
|
||||||
|
.divider { border: none; border-top: 1px solid var(--border); margin: 20px 0; }
|
||||||
|
|
||||||
|
/* Actions row */
|
||||||
|
.actions-row { display: flex; gap: 8px; flex-wrap: wrap; justify-content: center; }
|
||||||
|
|
||||||
|
/* Spinner */
|
||||||
|
.spinner { display: inline-block; width: 14px; height: 14px; border: 2px solid rgba(13,17,23,0.3);
|
||||||
|
border-top-color: #0d1117; border-radius: 50%; animation: spin 0.7s linear infinite; }
|
||||||
|
@keyframes spin { to { transform: rotate(360deg); } }
|
||||||
|
|
||||||
|
/* Modal */
|
||||||
|
.modal-bd { display: none; position: fixed; inset: 0; background: rgba(0,0,0,0.75);
|
||||||
|
z-index: 100; align-items: center; justify-content: center; }
|
||||||
|
.modal-bd.open { display: flex; }
|
||||||
|
.modal { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
|
||||||
|
padding: 28px; width: 100%; max-width: 420px; }
|
||||||
|
.modal h3 { font-size: 16px; font-weight: 600; margin-bottom: 16px; }
|
||||||
|
.modal-actions { display: flex; gap: 8px; margin-top: 16px; }
|
||||||
|
.btn-modal-ok { flex: 1; padding: 8px; border-radius: 6px; border: none;
|
||||||
|
background: var(--accent); color: #0d1117; font-size: 13px;
|
||||||
|
font-weight: 600; cursor: pointer; }
|
||||||
|
.btn-modal-ok:hover { background: var(--accent-hover); }
|
||||||
|
.btn-modal-cancel { padding: 8px 16px; border-radius: 6px; border: 1px solid var(--border);
|
||||||
|
background: none; color: var(--text); font-size: 13px; cursor: pointer; }
|
||||||
|
.btn-modal-cancel:hover { background: var(--surface2); }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body data-has-passphrase="{{ has_passphrase }}" data-base-url="{{ base_url }}">
|
||||||
|
|
||||||
|
<nav class="nav">
|
||||||
|
<a href="/dashboard" class="nav-logo"><span>secrets</span></a>
|
||||||
|
<span class="nav-spacer"></span>
|
||||||
|
<span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
|
||||||
|
<div class="lang-bar">
|
||||||
|
<button class="lang-btn" onclick="setLang('zh-CN')">简</button>
|
||||||
|
<button class="lang-btn" onclick="setLang('zh-TW')">繁</button>
|
||||||
|
<button class="lang-btn" onclick="setLang('en')">EN</button>
|
||||||
|
</div>
|
||||||
|
<form action="/auth/logout" method="post" style="display:inline">
|
||||||
|
<button type="submit" class="btn-sign-out" data-i18n="signOut">退出</button>
|
||||||
|
</form>
|
||||||
|
</nav>
|
||||||
|
|
||||||
|
<div class="main">
|
||||||
|
<div class="card">
|
||||||
|
|
||||||
|
<!-- ── Locked state ──────────────────────────────────────────────────── -->
|
||||||
|
<div id="locked-view">
|
||||||
|
<div class="card-title" data-i18n="lockedTitle">获取 MCP 配置</div>
|
||||||
|
<div class="card-sub" data-i18n="lockedSub">输入加密密码，派生密钥后生成完整的 MCP 配置，可直接复制到 AI 客户端。</div>
|
||||||
|
<div class="info-box">
|
||||||
|
<div class="info-title" data-i18n="aboutTitle">说明</div>
|
||||||
|
<div class="info-line" data-i18n="aboutApiKey">API Key 用于身份认证，告诉服务端“你是谁”。</div>
|
||||||
|
</div>
|
||||||
|
<div class="support-row" aria-label="Supported clients">
|
||||||
|
<span class="support-chip">Cursor</span>
|
||||||
|
<span class="support-chip">Claude Code</span>
|
||||||
|
<span class="support-chip">Codex</span>
|
||||||
|
<span class="support-chip">Gemini CLI</span>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- placeholder config -->
|
||||||
|
<div class="config-wrap">
|
||||||
|
<div class="config-box locked" id="placeholder-config"></div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Setup form (no passphrase yet) -->
|
||||||
|
<div id="setup-form" style="display:none">
|
||||||
|
<div class="field">
|
||||||
|
<label data-i18n="labelPassphrase">加密密码</label>
|
||||||
|
<input type="password" id="setup-pass1" data-i18n-ph="phPassphrase">
|
||||||
|
</div>
|
||||||
|
<div class="field">
|
||||||
|
<label data-i18n="labelConfirm">确认密码</label>
|
||||||
|
<input type="password" id="setup-pass2" data-i18n-ph="phConfirm">
|
||||||
|
</div>
|
||||||
|
<div class="error-msg" id="setup-error"></div>
|
||||||
|
<button class="btn-primary" id="setup-btn" onclick="doSetup()">
|
||||||
|
<span data-i18n="btnSetup">设置并获取配置</span>
|
||||||
|
</button>
|
||||||
|
<p style="font-size:11px;color:var(--text-muted);text-align:center;margin-top:10px" data-i18n="setupNote">
|
||||||
|
密码不会上传服务器。遗忘后数据将无法恢复。
|
||||||
|
</p>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- Unlock form (passphrase already set) -->
|
||||||
|
<div id="unlock-form" style="display:none">
|
||||||
|
<div class="field">
|
||||||
|
<label data-i18n="labelPassphrase">加密密码</label>
|
||||||
|
<input type="password" id="unlock-pass" data-i18n-ph="phPassphrase">
|
||||||
|
</div>
|
||||||
|
<div class="error-msg" id="unlock-error"></div>
|
||||||
|
<button class="btn-primary" id="unlock-btn" onclick="doUnlock()">
|
||||||
|
<span data-i18n="btnUnlock">解锁并获取配置</span>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- ── Unlocked state ────────────────────────────────────────────────── -->
|
||||||
|
<div id="unlocked-view" style="display:none">
|
||||||
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:6px">
|
||||||
|
<div class="card-title" data-i18n="unlockedTitle">MCP 配置</div>
|
||||||
|
<span style="font-size:12px;color:var(--success)">✓ <span data-i18n="ready">已就绪</span></span>
|
||||||
|
</div>
|
||||||
|
<div class="card-sub" data-i18n="unlockedSub">复制以下配置到 AI 客户端的 mcp.json 文件。</div>
|
||||||
|
<div class="support-row" aria-label="Supported clients" style="margin-bottom:20px">
|
||||||
|
<span class="support-chip">Cursor</span>
|
||||||
|
<span class="support-chip">Claude Code</span>
|
||||||
|
<span class="support-chip">Codex</span>
|
||||||
|
<span class="support-chip">Gemini CLI</span>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="config-wrap">
|
||||||
|
<pre class="config-box" id="real-config"></pre>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div style="display:flex;gap:10px;flex-wrap:wrap">
|
||||||
|
<button class="btn-copy" id="copy-full-btn" onclick="copyFullConfig()" style="flex:1">
|
||||||
|
<span id="copy-full-text" data-i18n="btnCopyFull">复制全部 mcp.json</span>
|
||||||
|
</button>
|
||||||
|
<button class="btn-copy" id="copy-secrets-btn" onclick="copySecretsConfig()" style="flex:1">
|
||||||
|
<span id="copy-secrets-text" data-i18n="btnCopySecrets">复制 secrets 配置</span>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<hr class="divider">
|
||||||
|
|
||||||
|
<div class="actions-row">
|
||||||
|
<button class="btn-sm" onclick="clearAndLock()" data-i18n="btnClear">清除本地加密密钥</button>
|
||||||
|
<button class="btn-sm" onclick="openChangeModal()" data-i18n="btnChangePass">更换密码</button>
|
||||||
|
<button class="btn-sm" onclick="confirmRegenerate()" data-i18n="btnRegen">重新生成 API Key</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- ── Change passphrase modal ──────────────────────────────────────────────── -->
|
||||||
|
<div class="modal-bd" id="change-modal">
|
||||||
|
<div class="modal">
|
||||||
|
<h3 data-i18n="changeTitle">更换密码</h3>
|
||||||
|
<div class="field">
|
||||||
|
<label data-i18n="labelNew">新密码</label>
|
||||||
|
<input type="password" id="change-pass1" data-i18n-ph="phPassphrase">
|
||||||
|
</div>
|
||||||
|
<div class="field">
|
||||||
|
<label data-i18n="labelConfirm">确认</label>
|
||||||
|
<input type="password" id="change-pass2" data-i18n-ph="phConfirm">
|
||||||
|
</div>
|
||||||
|
<div class="error-msg" id="change-error"></div>
|
||||||
|
<div class="modal-actions">
|
||||||
|
<button class="btn-modal-ok" id="change-btn" onclick="doChange()" data-i18n="btnChange">确认更换</button>
|
||||||
|
<button class="btn-modal-cancel" onclick="closeChangeModal()" data-i18n="btnCancel">取消</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<script>
|
||||||
|
// ── i18n ───────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
const T = {
|
||||||
|
'zh-CN': {
|
||||||
|
signOut: '退出',
|
||||||
|
lockedTitle: '获取 MCP 配置',
|
||||||
|
lockedSub: '输入加密密码，派生密钥后生成完整的 MCP 配置，可用于 Cursor、Claude Code、Codex 和 Gemini CLI。',
|
||||||
|
aboutTitle: '说明',
|
||||||
|
aboutApiKey: 'API Key 用于身份认证，告诉服务端“你是谁”。',
|
||||||
|
labelPassphrase: '加密密码',
|
||||||
|
labelConfirm: '确认密码',
|
||||||
|
labelNew: '新密码',
|
||||||
|
phPassphrase: '输入密码…',
|
||||||
|
phConfirm: '再次输入…',
|
||||||
|
btnSetup: '设置并获取配置',
|
||||||
|
btnUnlock: '解锁并获取配置',
|
||||||
|
setupNote: '密码不会上传服务器。遗忘后数据将无法恢复。',
|
||||||
|
errEmpty: '密码不能为空。',
|
||||||
|
errShort: '密码至少需要 8 个字符。',
|
||||||
|
errMismatch: '两次输入不一致。',
|
||||||
|
errWrong: '密码错误，请重试。',
|
||||||
|
unlockedTitle: 'MCP 配置',
|
||||||
|
unlockedSub: '复制以下 `mcp.json` 风格配置，并按目标客户端需要自行调整字段名。',
|
||||||
|
ready: '已就绪',
|
||||||
|
btnCopyFull: '复制完整 mcp.json',
|
||||||
|
btnCopySecrets: '复制 secrets 条目',
|
||||||
|
btnCopied: '已复制！',
|
||||||
|
btnClear: '清除本地加密密钥',
|
||||||
|
btnChangePass: '更换密码',
|
||||||
|
btnRegen: '重新生成 API Key',
|
||||||
|
changeTitle: '更换密码',
|
||||||
|
btnChange: '确认更换',
|
||||||
|
btnCancel: '取消',
|
||||||
|
regenConfirm: '重新生成 API Key 后，当前 Key 立即失效，需同步更新 AI 客户端配置。确认继续？',
|
||||||
|
regenFailed: '重新生成失败，请刷新页面重试。',
|
||||||
|
},
|
||||||
|
'zh-TW': {
|
||||||
|
signOut: '登出',
|
||||||
|
lockedTitle: '取得 MCP 設定',
|
||||||
|
lockedSub: '輸入加密密碼，派生金鑰後生成完整的 MCP 設定，可用於 Cursor、Claude Code、Codex 與 Gemini CLI。',
|
||||||
|
aboutTitle: '說明',
|
||||||
|
aboutApiKey: 'API Key 用於身份驗證，告訴服務端「你是誰」。',
|
||||||
|
labelPassphrase: '加密密碼',
|
||||||
|
labelConfirm: '確認密碼',
|
||||||
|
labelNew: '新密碼',
|
||||||
|
phPassphrase: '輸入密碼…',
|
||||||
|
phConfirm: '再次輸入…',
|
||||||
|
btnSetup: '設定並取得設定',
|
||||||
|
btnUnlock: '解鎖並取得設定',
|
||||||
|
setupNote: '密碼不會上傳伺服器。遺忘後資料將無法復原。',
|
||||||
|
errEmpty: '密碼不能為空。',
|
||||||
|
errShort: '密碼至少需要 8 個字元。',
|
||||||
|
errMismatch: '兩次輸入不一致。',
|
||||||
|
errWrong: '密碼錯誤，請重試。',
|
||||||
|
unlockedTitle: 'MCP 設定',
|
||||||
|
unlockedSub: '複製以下 `mcp.json` 風格設定，並依目標用戶端需要自行調整欄位名稱。',
|
||||||
|
ready: '已就緒',
|
||||||
|
btnCopyFull: '複製完整 mcp.json',
|
||||||
|
btnCopySecrets: '複製 secrets 項目',
|
||||||
|
btnCopied: '已複製！',
|
||||||
|
btnClear: '清除本地加密金鑰',
|
||||||
|
btnChangePass: '更換密碼',
|
||||||
|
btnRegen: '重新產生 API Key',
|
||||||
|
changeTitle: '更換密碼',
|
||||||
|
btnChange: '確認更換',
|
||||||
|
btnCancel: '取消',
|
||||||
|
regenConfirm: '重新產生 API Key 後，目前 Key 立即失效，需同步更新 AI 用戶端設定。確認繼續？',
|
||||||
|
regenFailed: '重新產生失敗，請重新整理頁面再試。',
|
||||||
|
},
|
||||||
|
'en': {
|
||||||
|
signOut: 'Sign out',
|
||||||
|
lockedTitle: 'Get MCP Config',
|
||||||
|
lockedSub: 'Enter your encryption password to derive your key and generate an MCP config for Cursor, Claude Code, Codex, and Gemini CLI.',
|
||||||
|
aboutTitle: 'About',
|
||||||
|
aboutApiKey: 'The API key is used for authentication and tells the server who you are.',
|
||||||
|
labelPassphrase: 'Encryption password',
|
||||||
|
labelConfirm: 'Confirm password',
|
||||||
|
labelNew: 'New password',
|
||||||
|
phPassphrase: 'Enter password…',
|
||||||
|
phConfirm: 'Repeat password…',
|
||||||
|
btnSetup: 'Set up & get config',
|
||||||
|
btnUnlock: 'Unlock & get config',
|
||||||
|
setupNote: 'Your password never leaves this device. If forgotten, encrypted data cannot be recovered.',
|
||||||
|
errEmpty: 'Password cannot be empty.',
|
||||||
|
errShort: 'Password must be at least 8 characters.',
|
||||||
|
errMismatch: 'Passwords do not match.',
|
||||||
|
errWrong: 'Incorrect password, please try again.',
|
||||||
|
unlockedTitle: 'MCP Config',
|
||||||
|
unlockedSub: 'Copy the `mcp.json`-style config below and adapt field names if your client expects a different schema.',
|
||||||
|
ready: 'Ready',
|
||||||
|
btnCopyFull: 'Copy full mcp.json',
|
||||||
|
btnCopySecrets: 'Copy secrets entry',
|
||||||
|
btnCopied: 'Copied!',
|
||||||
|
btnClear: 'Clear local encryption key',
|
||||||
|
btnChangePass: 'Change password',
|
||||||
|
btnRegen: 'Regenerate API key',
|
||||||
|
changeTitle: 'Change password',
|
||||||
|
btnChange: 'Confirm',
|
||||||
|
btnCancel: 'Cancel',
|
||||||
|
regenConfirm: 'Regenerating will immediately invalidate your current API key. You will need to update your AI client config. Continue?',
|
||||||
|
regenFailed: 'Regeneration failed. Please refresh and try again.',
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
let currentLang = localStorage.getItem('lang') || 'zh-CN';
|
||||||
|
|
||||||
|
function t(key) { return T[currentLang][key] || T['en'][key] || key; }
|
||||||
|
|
||||||
|
function applyLang() {
|
||||||
|
document.documentElement.lang = currentLang;
|
||||||
|
document.querySelectorAll('[data-i18n]').forEach(el => {
|
||||||
|
const key = el.getAttribute('data-i18n');
|
||||||
|
el.textContent = t(key);
|
||||||
|
});
|
||||||
|
document.querySelectorAll('[data-i18n-ph]').forEach(el => {
|
||||||
|
el.placeholder = t(el.getAttribute('data-i18n-ph'));
|
||||||
|
});
|
||||||
|
document.querySelectorAll('.lang-btn').forEach(btn => {
|
||||||
|
const map = { 'zh-CN': '简', 'zh-TW': '繁', 'en': 'EN' };
|
||||||
|
btn.classList.toggle('active', btn.textContent === map[currentLang]);
|
||||||
|
});
|
||||||
|
// Rebuild placeholder config (language affects nothing but triggers re-render)
|
||||||
|
renderPlaceholderConfig();
|
||||||
|
// Rebuild real config if unlocked
|
||||||
|
if (currentEncKey && currentApiKey) renderRealConfig();
|
||||||
|
}
|
||||||
|
|
||||||
|
function setLang(lang) {
|
||||||
|
currentLang = lang;
|
||||||
|
localStorage.setItem('lang', lang);
|
||||||
|
applyLang();
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Constants ──────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
const HAS_PASSPHRASE = document.body.dataset.hasPassphrase === 'true';
|
||||||
|
const BASE_URL = document.body.dataset.baseUrl;
|
||||||
|
const KEY_CHECK_PLAINTEXT = 'secrets-mcp-key-check';
|
||||||
|
const PBKDF2_ITERATIONS = 600000;
|
||||||
|
const ENC = new TextEncoder();
|
||||||
|
let currentEncKey = null;
|
||||||
|
let currentApiKey = null;
|
||||||
|
|
||||||
|
// ── Placeholder config ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
function renderPlaceholderConfig() {
|
||||||
|
document.getElementById('placeholder-config').textContent =
|
||||||
|
buildConfigText('sk_' + '•'.repeat(64), '•'.repeat(64));
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildBaseServerConfig(apiKey, encKey) {
|
||||||
|
return {
|
||||||
|
url: BASE_URL + '/mcp',
|
||||||
|
headers: {
|
||||||
|
Authorization: 'Bearer ' + apiKey,
|
||||||
|
'X-Encryption-Key': encKey
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildSecretsEntryObject(apiKey, encKey) {
|
||||||
|
return buildBaseServerConfig(apiKey, encKey);
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildConfigText(apiKey, encKey) {
|
||||||
|
return JSON.stringify({ mcpServers: { secrets: buildSecretsEntryObject(apiKey, encKey) } }, null, 2);
|
||||||
|
}
|
||||||
|
|
||||||
|
function buildSecretsConfigText(apiKey, encKey) {
|
||||||
|
const wrapped = JSON.stringify({
|
||||||
|
secrets: buildSecretsEntryObject(apiKey, encKey)
|
||||||
|
}, null, 2);
|
||||||
|
const lines = wrapped.split('\n');
|
||||||
|
return lines.length < 3 ? wrapped : lines.slice(1, -1).join('\n');
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Unlock / Setup flow ───────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
function showLockedView() {
|
||||||
|
document.getElementById('locked-view').style.display = '';
|
||||||
|
document.getElementById('unlocked-view').style.display = 'none';
|
||||||
|
if (HAS_PASSPHRASE) {
|
||||||
|
document.getElementById('setup-form').style.display = 'none';
|
||||||
|
document.getElementById('unlock-form').style.display = '';
|
||||||
|
setTimeout(() => document.getElementById('unlock-pass').focus(), 50);
|
||||||
|
} else {
|
||||||
|
document.getElementById('setup-form').style.display = '';
|
||||||
|
document.getElementById('unlock-form').style.display = 'none';
|
||||||
|
setTimeout(() => document.getElementById('setup-pass1').focus(), 50);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async function showUnlockedView(encKeyHex, apiKey) {
|
||||||
|
currentEncKey = encKeyHex;
|
||||||
|
currentApiKey = apiKey;
|
||||||
|
sessionStorage.setItem('enc_key', encKeyHex);
|
||||||
|
renderRealConfig();
|
||||||
|
document.getElementById('locked-view').style.display = 'none';
|
||||||
|
document.getElementById('unlocked-view').style.display = '';
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderRealConfig() {
|
||||||
|
document.getElementById('real-config').textContent =
|
||||||
|
buildConfigText(currentApiKey, currentEncKey);
|
||||||
|
}
|
||||||
|
|
||||||
|
function clearAndLock() {
|
||||||
|
sessionStorage.removeItem('enc_key');
|
||||||
|
currentEncKey = null;
|
||||||
|
currentApiKey = null;
|
||||||
|
showLockedView();
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Web Crypto helpers ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async function deriveKey(passphrase, saltBytes, extractable = false) {
|
||||||
|
const km = await crypto.subtle.importKey('raw', ENC.encode(passphrase), 'PBKDF2', false, ['deriveKey']);
|
||||||
|
return crypto.subtle.deriveKey(
|
||||||
|
{ name: 'PBKDF2', salt: saltBytes, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' },
|
||||||
|
km, { name: 'AES-GCM', length: 256 }, extractable, ['encrypt', 'decrypt']
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function exportKeyHex(cryptoKey) {
|
||||||
|
const raw = await crypto.subtle.exportKey('raw', cryptoKey);
|
||||||
|
return Array.from(new Uint8Array(raw)).map(b => b.toString(16).padStart(2, '0')).join('');
|
||||||
|
}
|
||||||
|
|
||||||
|
function hexToBytes(hex) {
|
||||||
|
const b = new Uint8Array(hex.length / 2);
|
||||||
|
for (let i = 0; i < hex.length; i += 2) b[i / 2] = parseInt(hex.slice(i, i + 2), 16);
|
||||||
|
return b;
|
||||||
|
}
|
||||||
|
|
||||||
|
function bytesToHex(bytes) {
|
||||||
|
return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
|
||||||
|
}
|
||||||
|
|
||||||
|
async function encryptKeyCheck(cryptoKey) {
|
||||||
|
const nonce = crypto.getRandomValues(new Uint8Array(12));
|
||||||
|
const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, cryptoKey, ENC.encode(KEY_CHECK_PLAINTEXT));
|
||||||
|
const out = new Uint8Array(12 + ct.byteLength);
|
||||||
|
out.set(nonce); out.set(new Uint8Array(ct), 12);
|
||||||
|
return bytesToHex(out);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function verifyKeyCheck(cryptoKey, keyCheckHex) {
|
||||||
|
try {
|
||||||
|
const b = hexToBytes(keyCheckHex);
|
||||||
|
const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: b.slice(0, 12) }, cryptoKey, b.slice(12));
|
||||||
|
return new TextDecoder().decode(plain) === KEY_CHECK_PLAINTEXT;
|
||||||
|
} catch { return false; }
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Passphrase setup (first time) ─────────────────────────────────────────────
|
||||||
|
|
||||||
|
function setBtnLoading(id, loading, labelKey) {
|
||||||
|
const btn = document.getElementById(id);
|
||||||
|
btn.disabled = loading;
|
||||||
|
btn.innerHTML = loading
|
||||||
|
? '<span class="spinner"></span>'
|
||||||
|
: `<span data-i18n="${labelKey}">${t(labelKey)}</span>`;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function doSetup() {
|
||||||
|
const pass1 = document.getElementById('setup-pass1').value;
|
||||||
|
const pass2 = document.getElementById('setup-pass2').value;
|
||||||
|
const errEl = document.getElementById('setup-error');
|
||||||
|
errEl.style.display = 'none';
|
||||||
|
|
||||||
|
if (!pass1) { showErr(errEl, t('errEmpty')); return; }
|
||||||
|
if (pass1.length < 8) { showErr(errEl, t('errShort')); return; }
|
||||||
|
if (pass1 !== pass2) { showErr(errEl, t('errMismatch')); return; }
|
||||||
|
|
||||||
|
setBtnLoading('setup-btn', true, 'btnSetup');
|
||||||
|
try {
|
||||||
|
const salt = crypto.getRandomValues(new Uint8Array(32));
|
||||||
|
const cryptoKey = await deriveKey(pass1, salt, true);
|
||||||
|
const keyCheckHex = await encryptKeyCheck(cryptoKey);
|
||||||
|
const hexKey = await exportKeyHex(cryptoKey);
|
||||||
|
|
||||||
|
const resp = await fetch('/api/key-setup', {
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'Content-Type': 'application/json' },
|
||||||
|
body: JSON.stringify({
|
||||||
|
salt: bytesToHex(salt),
|
||||||
|
key_check: keyCheckHex,
|
||||||
|
params: { alg: 'pbkdf2-sha256', iterations: PBKDF2_ITERATIONS }
|
||||||
|
})
|
||||||
|
});
|
||||||
|
if (!resp.ok) throw new Error('HTTP ' + resp.status);
|
||||||
|
|
||||||
|
const apiKey = await fetchApiKey();
|
||||||
|
await showUnlockedView(hexKey, apiKey);
|
||||||
|
} catch (e) {
|
||||||
|
showErr(errEl, 'Error: ' + e.message);
|
||||||
|
} finally {
|
||||||
|
setBtnLoading('setup-btn', false, 'btnSetup');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Passphrase unlock ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async function doUnlock() {
|
||||||
|
const pass = document.getElementById('unlock-pass').value;
|
||||||
|
const errEl = document.getElementById('unlock-error');
|
||||||
|
errEl.style.display = 'none';
|
||||||
|
|
||||||
|
if (!pass) { showErr(errEl, t('errEmpty')); return; }
|
||||||
|
|
||||||
|
setBtnLoading('unlock-btn', true, 'btnUnlock');
|
||||||
|
try {
|
||||||
|
const saltResp = await fetch('/api/key-salt');
|
||||||
|
if (!saltResp.ok) throw new Error('HTTP ' + saltResp.status);
|
||||||
|
const saltData = await saltResp.json();
|
||||||
|
|
||||||
|
const cryptoKey = await deriveKey(pass, hexToBytes(saltData.salt), true);
|
||||||
|
const valid = await verifyKeyCheck(cryptoKey, saltData.key_check);
|
||||||
|
if (!valid) { showErr(errEl, t('errWrong')); return; }
|
||||||
|
|
||||||
|
const hexKey = await exportKeyHex(cryptoKey);
|
||||||
|
const apiKey = await fetchApiKey();
|
||||||
|
await showUnlockedView(hexKey, apiKey);
|
||||||
|
} catch (e) {
|
||||||
|
showErr(errEl, 'Error: ' + e.message);
|
||||||
|
} finally {
|
||||||
|
setBtnLoading('unlock-btn', false, 'btnUnlock');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Copy config ────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async function copyFullConfig() {
|
||||||
|
await copyWithFeedback(
|
||||||
|
document.getElementById('real-config').textContent,
|
||||||
|
'copy-full-btn',
|
||||||
|
'copy-full-text',
|
||||||
|
'btnCopyFull'
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function copySecretsConfig() {
|
||||||
|
await copyWithFeedback(
|
||||||
|
buildSecretsConfigText(currentApiKey, currentEncKey),
|
||||||
|
'copy-secrets-btn',
|
||||||
|
'copy-secrets-text',
|
||||||
|
'btnCopySecrets'
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function copyWithFeedback(text, btnId, textId, resetLabelKey) {
|
||||||
|
await navigator.clipboard.writeText(text);
|
||||||
|
const btn = document.getElementById(btnId);
|
||||||
|
const textEl = document.getElementById(textId);
|
||||||
|
btn.classList.add('copied');
|
||||||
|
textEl.textContent = t('btnCopied');
|
||||||
|
setTimeout(() => {
|
||||||
|
btn.classList.remove('copied');
|
||||||
|
textEl.textContent = t(resetLabelKey);
|
||||||
|
}, 2500);
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Regenerate API key ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async function confirmRegenerate() {
|
||||||
|
if (!confirm(t('regenConfirm'))) return;
|
||||||
|
try {
|
||||||
|
const resp = await fetch('/api/apikey/regenerate', { method: 'POST' });
|
||||||
|
if (!resp.ok) throw new Error();
|
||||||
|
const data = await resp.json();
|
||||||
|
currentApiKey = data.api_key;
|
||||||
|
renderRealConfig();
|
||||||
|
} catch {
|
||||||
|
alert(t('regenFailed'));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Change passphrase modal ────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
function openChangeModal() {
|
||||||
|
document.getElementById('change-pass1').value = '';
|
||||||
|
document.getElementById('change-pass2').value = '';
|
||||||
|
document.getElementById('change-error').style.display = 'none';
|
||||||
|
document.getElementById('change-modal').classList.add('open');
|
||||||
|
setTimeout(() => document.getElementById('change-pass1').focus(), 50);
|
||||||
|
}
|
||||||
|
|
||||||
|
function closeChangeModal() {
|
||||||
|
document.getElementById('change-modal').classList.remove('open');
|
||||||
|
}
|
||||||
|
|
||||||
|
async function doChange() {
|
||||||
|
const pass1 = document.getElementById('change-pass1').value;
|
||||||
|
const pass2 = document.getElementById('change-pass2').value;
|
||||||
|
const errEl = document.getElementById('change-error');
|
||||||
|
errEl.style.display = 'none';
|
||||||
|
|
||||||
|
if (!pass1) { showErr(errEl, t('errEmpty')); return; }
|
||||||
|
if (pass1.length < 8) { showErr(errEl, t('errShort')); return; }
|
||||||
|
if (pass1 !== pass2) { showErr(errEl, t('errMismatch')); return; }
|
||||||
|
|
||||||
|
const btn = document.getElementById('change-btn');
|
||||||
|
btn.disabled = true;
|
||||||
|
btn.innerHTML = '<span class="spinner" style="border-top-color:#0d1117"></span>';
|
||||||
|
try {
|
||||||
|
const salt = crypto.getRandomValues(new Uint8Array(32));
|
||||||
|
const cryptoKey = await deriveKey(pass1, salt, true);
|
||||||
|
const keyCheckHex = await encryptKeyCheck(cryptoKey);
|
||||||
|
const hexKey = await exportKeyHex(cryptoKey);
|
||||||
|
|
||||||
|
const resp = await fetch('/api/key-setup', {
|
||||||
|
method: 'POST',
|
||||||
|
headers: { 'Content-Type': 'application/json' },
|
||||||
|
body: JSON.stringify({
|
||||||
|
salt: bytesToHex(salt),
|
||||||
|
key_check: keyCheckHex,
|
||||||
|
params: { alg: 'pbkdf2-sha256', iterations: PBKDF2_ITERATIONS }
|
||||||
|
})
|
||||||
|
});
|
||||||
|
if (!resp.ok) throw new Error('HTTP ' + resp.status);
|
||||||
|
|
||||||
|
currentEncKey = hexKey;
|
||||||
|
sessionStorage.setItem('enc_key', hexKey);
|
||||||
|
renderRealConfig();
|
||||||
|
closeChangeModal();
|
||||||
|
} catch (e) {
|
||||||
|
showErr(errEl, 'Error: ' + e.message);
|
||||||
|
} finally {
|
||||||
|
btn.disabled = false;
|
||||||
|
btn.textContent = t('btnChange');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Fetch API key ──────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
async function fetchApiKey() {
|
||||||
|
const resp = await fetch('/api/apikey');
|
||||||
|
if (!resp.ok) throw new Error('Failed to load API key');
|
||||||
|
const data = await resp.json();
|
||||||
|
return data.api_key;
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Helpers ────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
function showErr(el, msg) {
|
||||||
|
el.textContent = msg;
|
||||||
|
el.style.display = 'block';
|
||||||
|
}
|
||||||
|
|
||||||
|
// ── Keyboard shortcuts ─────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
document.addEventListener('keydown', e => {
|
||||||
|
if (e.key === 'Escape') closeChangeModal();
|
||||||
|
if (e.key === 'Enter') {
|
||||||
|
if (document.getElementById('change-modal').classList.contains('open')) { doChange(); return; }
|
||||||
|
if (document.getElementById('unlock-form').style.display !== 'none' &&
|
||||||
|
document.getElementById('locked-view').style.display !== 'none') { doUnlock(); return; }
|
||||||
|
if (document.getElementById('setup-form').style.display !== 'none' &&
|
||||||
|
document.getElementById('locked-view').style.display !== 'none') { doSetup(); return; }
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// ── Init ───────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
(async function init() {
|
||||||
|
applyLang();
|
||||||
|
const savedKey = sessionStorage.getItem('enc_key');
|
||||||
|
if (savedKey) {
|
||||||
|
try {
|
||||||
|
const apiKey = await fetchApiKey();
|
||||||
|
await showUnlockedView(savedKey, apiKey);
|
||||||
|
return;
|
||||||
|
} catch { /* fall through to locked */ }
|
||||||
|
}
|
||||||
|
showLockedView();
|
||||||
|
})();
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
131
crates/secrets-mcp/templates/login.html
Normal file
131
crates/secrets-mcp/templates/login.html
Normal file
@@ -0,0 +1,131 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="zh-CN">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||||
|
<title>Secrets — Sign In</title>
|
||||||
|
<style>
|
||||||
|
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
|
||||||
|
@import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600&family=Inter:wght@400;500;600&display=swap');
|
||||||
|
:root {
|
||||||
|
--bg: #0d1117;
|
||||||
|
--surface: #161b22;
|
||||||
|
--border: #30363d;
|
||||||
|
--text: #e6edf3;
|
||||||
|
--text-muted: #8b949e;
|
||||||
|
--accent: #58a6ff;
|
||||||
|
--accent-hover: #79b8ff;
|
||||||
|
--google: #4285f4;
|
||||||
|
}
|
||||||
|
body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif;
|
||||||
|
min-height: 100vh; display: flex; align-items: center; justify-content: center; }
|
||||||
|
.card {
|
||||||
|
background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
|
||||||
|
padding: 48px 40px; width: 100%; max-width: 400px;
|
||||||
|
box-shadow: 0 8px 32px rgba(0,0,0,0.4);
|
||||||
|
}
|
||||||
|
.topbar { display: flex; justify-content: flex-end; margin-bottom: 20px; }
|
||||||
|
.lang-bar { display: flex; gap: 2px; background: rgba(255,255,255,0.04); border-radius: 6px; padding: 2px; }
|
||||||
|
.lang-btn { padding: 3px 9px; border: none; background: none; color: var(--text-muted);
|
||||||
|
font-size: 12px; cursor: pointer; border-radius: 4px; }
|
||||||
|
.lang-btn.active { background: var(--border); color: var(--text); }
|
||||||
|
.logo { display: flex; align-items: center; gap: 10px; margin-bottom: 32px; }
|
||||||
|
.logo-icon { font-family: 'JetBrains Mono', monospace; font-size: 24px; color: var(--accent); }
|
||||||
|
.logo-text { font-family: 'JetBrains Mono', monospace; font-size: 18px; font-weight: 600; }
|
||||||
|
h1 { font-size: 22px; font-weight: 600; margin-bottom: 8px; }
|
||||||
|
.subtitle { color: var(--text-muted); font-size: 14px; margin-bottom: 32px; }
|
||||||
|
.btn {
|
||||||
|
display: flex; align-items: center; justify-content: center; gap: 12px;
|
||||||
|
width: 100%; padding: 12px 20px; border: 1px solid var(--border); border-radius: 8px;
|
||||||
|
background: var(--surface); color: var(--text); font-size: 14px; font-weight: 500;
|
||||||
|
cursor: pointer; text-decoration: none; transition: all 0.2s;
|
||||||
|
}
|
||||||
|
.btn:hover { background: var(--border); border-color: var(--text-muted); }
|
||||||
|
.btn + .btn { margin-top: 12px; }
|
||||||
|
.btn svg { flex-shrink: 0; }
|
||||||
|
.footer { margin-top: 28px; text-align: center; color: var(--text-muted); font-size: 12px; }
|
||||||
|
.footer a { color: var(--accent); text-decoration: none; }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<div class="card">
|
||||||
|
<div class="topbar">
|
||||||
|
<div class="lang-bar">
|
||||||
|
<button class="lang-btn" onclick="setLang('zh-CN')">简</button>
|
||||||
|
<button class="lang-btn" onclick="setLang('zh-TW')">繁</button>
|
||||||
|
<button class="lang-btn" onclick="setLang('en')">EN</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="logo">
|
||||||
|
<span class="logo-icon">🔐</span>
|
||||||
|
<span class="logo-text">secrets</span>
|
||||||
|
</div>
|
||||||
|
<h1 data-i18n="title">登录</h1>
|
||||||
|
<p class="subtitle" data-i18n="subtitle">安全管理你的跨设备 secrets。</p>
|
||||||
|
|
||||||
|
{% if has_google %}
|
||||||
|
<a href="/auth/google" class="btn">
|
||||||
|
<svg width="18" height="18" viewBox="0 0 18 18" fill="none">
|
||||||
|
<path d="M17.64 9.2c0-.637-.057-1.251-.164-1.84H9v3.481h4.844a4.14 4.14 0 01-1.796 2.716v2.259h2.908c1.702-1.567 2.684-3.875 2.684-6.615z" fill="#4285F4"/>
|
||||||
|
<path d="M9 18c2.43 0 4.467-.806 5.956-2.18l-2.908-2.259c-.806.54-1.837.86-3.048.86-2.344 0-4.328-1.584-5.036-3.711H.957v2.332A8.997 8.997 0 009 18z" fill="#34A853"/>
|
||||||
|
<path d="M3.964 10.71A5.41 5.41 0 013.682 9c0-.593.102-1.17.282-1.71V4.958H.957A8.996 8.996 0 000 9c0 1.452.348 2.827.957 4.042l3.007-2.332z" fill="#FBBC05"/>
|
||||||
|
<path d="M9 3.58c1.321 0 2.508.454 3.44 1.345l2.582-2.58C13.463.891 11.426 0 9 0A8.997 8.997 0 00.957 4.958L3.964 7.29C4.672 5.163 6.656 3.58 9 3.58z" fill="#EA4335"/>
|
||||||
|
</svg>
|
||||||
|
<span data-i18n="google">使用 Google 登录</span>
|
||||||
|
</a>
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
{% if !has_google %}
|
||||||
|
<p style="text-align:center; color: var(--text-muted); font-size: 14px;" data-i18n="noProviders">
|
||||||
|
未配置登录方式，请联系管理员。
|
||||||
|
</p>
|
||||||
|
{% endif %}
|
||||||
|
</div>
|
||||||
|
<script>
|
||||||
|
const T = {
|
||||||
|
'zh-CN': {
|
||||||
|
title: '登录',
|
||||||
|
subtitle: '安全管理你的跨设备 secrets。',
|
||||||
|
google: '使用 Google 登录',
|
||||||
|
noProviders: '未配置登录方式，请联系管理员。',
|
||||||
|
},
|
||||||
|
'zh-TW': {
|
||||||
|
title: '登入',
|
||||||
|
subtitle: '安全管理你的跨裝置 secrets。',
|
||||||
|
google: '使用 Google 登入',
|
||||||
|
noProviders: '尚未設定登入方式，請聯絡管理員。',
|
||||||
|
},
|
||||||
|
'en': {
|
||||||
|
title: 'Sign in',
|
||||||
|
subtitle: 'Manage your cross-device secrets securely.',
|
||||||
|
google: 'Continue with Google',
|
||||||
|
noProviders: 'No login providers configured. Please contact your administrator.',
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
let currentLang = localStorage.getItem('lang') || 'zh-CN';
|
||||||
|
|
||||||
|
function t(key) { return T[currentLang][key] || T['en'][key] || key; }
|
||||||
|
|
||||||
|
function applyLang() {
|
||||||
|
document.documentElement.lang = currentLang;
|
||||||
|
document.querySelectorAll('[data-i18n]').forEach(el => {
|
||||||
|
const key = el.getAttribute('data-i18n');
|
||||||
|
el.textContent = t(key);
|
||||||
|
});
|
||||||
|
document.querySelectorAll('.lang-btn').forEach(btn => {
|
||||||
|
const map = { 'zh-CN': '简', 'zh-TW': '繁', 'en': 'EN' };
|
||||||
|
btn.classList.toggle('active', btn.textContent === map[currentLang]);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function setLang(lang) {
|
||||||
|
currentLang = lang;
|
||||||
|
localStorage.setItem('lang', lang);
|
||||||
|
applyLang();
|
||||||
|
}
|
||||||
|
|
||||||
|
applyLang();
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
27
deploy/.env.example
Normal file
27
deploy/.env.example
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
# Secrets MCP Server 环境变量配置
|
||||||
|
# 复制此文件为 .env 并填写真实值
|
||||||
|
|
||||||
|
# ─── 数据库 ───────────────────────────────────────────────────────────
|
||||||
|
SECRETS_DATABASE_URL=postgres://postgres:PASSWORD@HOST:PORT/secrets-mcp
|
||||||
|
|
||||||
|
# ─── 服务地址 ─────────────────────────────────────────────────────────
|
||||||
|
# 内网监听地址（Cloudflare / Nginx 反代时填内网端口）
|
||||||
|
SECRETS_MCP_BIND=127.0.0.1:9315
|
||||||
|
|
||||||
|
# 对外 HTTPS 地址（用于 OAuth 回调 URL 拼接）
|
||||||
|
BASE_URL=https://secrets.example.com
|
||||||
|
|
||||||
|
# ─── Google OAuth ─────────────────────────────────────────────────────
|
||||||
|
# Google Cloud Console → APIs & Services → Credentials
|
||||||
|
# 授权回调 URI 须配置为：${BASE_URL}/auth/google/callback
|
||||||
|
GOOGLE_CLIENT_ID=
|
||||||
|
GOOGLE_CLIENT_SECRET=
|
||||||
|
|
||||||
|
# ─── 微信登录（暂未开放，预留）───────────────────────────────────────
|
||||||
|
# WECHAT_APP_CLIENT_ID=
|
||||||
|
# WECHAT_APP_CLIENT_SECRET=
|
||||||
|
|
||||||
|
# ─── 注意 ─────────────────────────────────────────────────────────────
|
||||||
|
# SERVER_MASTER_KEY 已不再需要。
|
||||||
|
# 新架构（E2EE）中，加密密钥由用户密码短语在客户端本地派生，服务端不持有原始密钥。
|
||||||
|
# 仅在需要迁移旧版 wrapped_key 数据时临时启用。
|
||||||
27
deploy/secrets-mcp.service
Normal file
27
deploy/secrets-mcp.service
Normal file
@@ -0,0 +1,27 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=Secrets MCP Server
|
||||||
|
After=network.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=secrets-mcp
|
||||||
|
Group=secrets-mcp
|
||||||
|
WorkingDirectory=/opt/secrets-mcp
|
||||||
|
EnvironmentFile=/opt/secrets-mcp/.env
|
||||||
|
ExecStart=/opt/secrets-mcp/secrets-mcp
|
||||||
|
Restart=always
|
||||||
|
RestartSec=5
|
||||||
|
StandardOutput=journal
|
||||||
|
StandardError=journal
|
||||||
|
SyslogIdentifier=secrets-mcp
|
||||||
|
|
||||||
|
# 安全加固
|
||||||
|
NoNewPrivileges=yes
|
||||||
|
ProtectSystem=strict
|
||||||
|
ProtectHome=yes
|
||||||
|
ReadWritePaths=/opt/secrets-mcp
|
||||||
|
PrivateTmp=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
@@ -5,15 +5,15 @@ set -euo pipefail
|
|||||||
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
cd "$repo_root"
|
cd "$repo_root"
|
||||||
|
|
||||||
version="$(grep -m1 '^version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')"
|
version="$(grep -m1 '^version' crates/secrets-mcp/Cargo.toml | sed 's/.*"\(.*\)".*/\1/')"
|
||||||
tag="secrets-${version}"
|
tag="secrets-mcp-${version}"
|
||||||
|
|
||||||
echo "==> 当前版本: ${version}"
|
echo "==> 当前 secrets-mcp 版本: ${version}"
|
||||||
echo "==> 检查是否已存在 tag: ${tag}"
|
echo "==> 检查是否已存在 tag: ${tag}"
|
||||||
|
|
||||||
if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
|
if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
|
||||||
echo "错误: 已存在 tag ${tag}"
|
echo "错误: 已存在 tag ${tag}"
|
||||||
echo "请先 bump Cargo.toml 中的 version，再执行 cargo build 同步 Cargo.lock。"
|
echo "请先 bump crates/secrets-mcp/Cargo.toml 中的 version，再执行 cargo build 同步 Cargo.lock。"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|||||||
@@ -6,14 +6,21 @@
|
|||||||
# 所需配置:
|
# 所需配置:
|
||||||
# - secrets.RELEASE_TOKEN (必选) Release 上传用，值为 Gitea PAT
|
# - secrets.RELEASE_TOKEN (必选) Release 上传用，值为 Gitea PAT
|
||||||
# - vars.WEBHOOK_URL (可选) 飞书通知
|
# - vars.WEBHOOK_URL (可选) 飞书通知
|
||||||
|
# - vars.DEPLOY_HOST (可选) 部署目标 SSH 主机（IP 或域名）
|
||||||
|
# - vars.DEPLOY_USER (可选) SSH 用户名
|
||||||
|
# - secrets.DEPLOY_SSH_KEY (可选) SSH 私钥 PEM 全文（原始字符，含 BEGIN/END 行）；通过 DEPLOY_SSH_KEY_FILE 写入 API
|
||||||
#
|
#
|
||||||
# 注意:
|
# 注意:
|
||||||
# - Gitea 不允许 secret/variable 名以 GITEA_ 或 GITHUB_ 开头，故使用 RELEASE_TOKEN
|
# - Gitea 不允许 secret/variable 名以 GITEA_ 或 GITHUB_ 开头，故使用 RELEASE_TOKEN
|
||||||
# - Secret/Variable 的 data/value 字段需传入原始值，不要使用 base64 编码
|
# - Gitea Actions 的 secrets（API 的 data 字段，及网页里粘贴的值）必须是未经 base64 的原始值。
|
||||||
|
# 若事先 base64 再写入，工作流里拿到的仍是「一串 base64 文本」，SSH/OpenSSH 无法识别，部署会失败。
|
||||||
|
# DEPLOY_SSH_KEY 须与 .pem 文件内容一致：本脚本用 jq --rawfile 按原文上传。
|
||||||
|
# - Variables 的 value 字段同样为原始字符串，不要 base64。
|
||||||
#
|
#
|
||||||
# 用法:
|
# 用法:
|
||||||
# 1. 从 ~/.config/gitea/config.env 读取 GITEA_URL, GITEA_TOKEN, GITEA_WEBHOOK_URL
|
# 1. 从 ~/.config/gitea/config.env 读取 GITEA_URL, GITEA_TOKEN, GITEA_WEBHOOK_URL
|
||||||
# 2. 或通过环境变量覆盖: GITEA_TOKEN（作为 RELEASE_TOKEN 的值）, WEBHOOK_URL
|
# 2. 或通过环境变量覆盖: GITEA_TOKEN（作为 RELEASE_TOKEN 的值）, WEBHOOK_URL,
|
||||||
|
# DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_KEY_FILE（部署到 ECS）
|
||||||
# 3. 或使用 secrets CLI 获取: 需 DATABASE_URL，从 refining/service gitea 读取
|
# 3. 或使用 secrets CLI 获取: 需 DATABASE_URL，从 refining/service gitea 读取
|
||||||
#
|
#
|
||||||
|
|
||||||
@@ -109,8 +116,7 @@ echo "配置 Gitea Actions: $OWNER/$REPO"
|
|||||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
echo ""
|
echo ""
|
||||||
|
|
||||||
# 1. 创建 Secret: RELEASE_TOKEN
|
# 1. 创建 Secret: RELEASE_TOKEN（data = PAT 原文，勿 base64）
|
||||||
# 注意: Gitea Actions API 的 data 字段需传入原始值，不要使用 base64 编码
|
|
||||||
echo "1. 创建 Secret: RELEASE_TOKEN"
|
echo "1. 创建 Secret: RELEASE_TOKEN"
|
||||||
secret_payload=$(jq -n --arg t "$GITEA_TOKEN" '{data: $t}')
|
secret_payload=$(jq -n --arg t "$GITEA_TOKEN" '{data: $t}')
|
||||||
resp=$(curl -s -w "\n%{http_code}" -X PUT \
|
resp=$(curl -s -w "\n%{http_code}" -X PUT \
|
||||||
@@ -129,8 +135,7 @@ else
|
|||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# 2. 创建/更新 Variable: WEBHOOK_URL（可选）
|
# 2. 创建/更新 Variable: WEBHOOK_URL（可选，value 为原始 URL 字符串，勿 base64）
|
||||||
# 注意: Secret 和 Variable 均使用原始值，不要 base64 编码
|
|
||||||
WEBHOOK_VALUE="${WEBHOOK_URL:-$GITEA_WEBHOOK_URL}"
|
WEBHOOK_VALUE="${WEBHOOK_URL:-$GITEA_WEBHOOK_URL}"
|
||||||
if [[ -n "$WEBHOOK_VALUE" ]]; then
|
if [[ -n "$WEBHOOK_VALUE" ]]; then
|
||||||
echo ""
|
echo ""
|
||||||
@@ -168,6 +173,68 @@ else
|
|||||||
echo " 飞书通知将不可用；如需可后续在仓库 Settings → Variables 中添加"
|
echo " 飞书通知将不可用；如需可后续在仓库 Settings → Variables 中添加"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# 3. 部署用 Variable + Secret（与 .gitea/workflows/secrets.yml 中 deploy-mcp 一致）
|
||||||
|
upsert_repo_variable() {
|
||||||
|
local var_name="$1" var_value="$2"
|
||||||
|
local var_payload http_code body resp
|
||||||
|
var_payload=$(jq -n --arg v "$var_value" '{value: $v}')
|
||||||
|
resp=$(curl -s -w "\n%{http_code}" -X POST \
|
||||||
|
-H "Authorization: token $GITEA_TOKEN" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "$var_payload" \
|
||||||
|
"${API_BASE}/repos/${OWNER}/${REPO}/actions/variables/${var_name}")
|
||||||
|
http_code=$(echo "$resp" | tail -n1)
|
||||||
|
if [[ "$http_code" == "200" || "$http_code" == "201" || "$http_code" == "204" ]]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
if [[ "$http_code" == "409" ]]; then
|
||||||
|
resp=$(curl -s -w "\n%{http_code}" -X PUT \
|
||||||
|
-H "Authorization: token $GITEA_TOKEN" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "$var_payload" \
|
||||||
|
"${API_BASE}/repos/${OWNER}/${REPO}/actions/variables/${var_name}")
|
||||||
|
http_code=$(echo "$resp" | tail -n1)
|
||||||
|
[[ "$http_code" == "200" || "$http_code" == "204" ]]
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
body=$(echo "$resp" | sed '$d')
|
||||||
|
echo " ❌ 变量 ${var_name} 失败 (HTTP $http_code)" >&2
|
||||||
|
echo "$body" | jq -r '.message // .' 2>/dev/null || echo "$body" >&2
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
if [[ -n "$DEPLOY_HOST" && -n "$DEPLOY_USER" && -n "$DEPLOY_SSH_KEY_FILE" ]]; then
|
||||||
|
echo ""
|
||||||
|
echo "3. 部署目标: vars.DEPLOY_HOST / vars.DEPLOY_USER + secrets.DEPLOY_SSH_KEY"
|
||||||
|
if [[ ! -f "$DEPLOY_SSH_KEY_FILE" ]]; then
|
||||||
|
echo " ❌ DEPLOY_SSH_KEY_FILE 不是文件: $DEPLOY_SSH_KEY_FILE" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
upsert_repo_variable DEPLOY_HOST "$DEPLOY_HOST" || exit 1
|
||||||
|
echo " ✓ DEPLOY_HOST"
|
||||||
|
upsert_repo_variable DEPLOY_USER "$DEPLOY_USER" || exit 1
|
||||||
|
echo " ✓ DEPLOY_USER"
|
||||||
|
# PEM 原文写入 secret.data；勿对文件先做 base64，否则 runner 侧 ssh 无法解析密钥
|
||||||
|
secret_payload=$(jq -n --rawfile k "$DEPLOY_SSH_KEY_FILE" '{data: $k}')
|
||||||
|
resp=$(curl -s -w "\n%{http_code}" -X PUT \
|
||||||
|
-H "Authorization: token $GITEA_TOKEN" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "$secret_payload" \
|
||||||
|
"${API_BASE}/repos/${OWNER}/${REPO}/actions/secrets/DEPLOY_SSH_KEY")
|
||||||
|
http_code=$(echo "$resp" | tail -n1)
|
||||||
|
body=$(echo "$resp" | sed '$d')
|
||||||
|
if [[ "$http_code" == "200" || "$http_code" == "201" || "$http_code" == "204" ]]; then
|
||||||
|
echo " ✓ DEPLOY_SSH_KEY"
|
||||||
|
else
|
||||||
|
echo " ❌ DEPLOY_SSH_KEY 失败 (HTTP $http_code)" >&2
|
||||||
|
echo "$body" | jq -r '.message // .' 2>/dev/null || echo "$body" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo ""
|
||||||
|
echo "3. 跳过部署配置（需同时设置 DEPLOY_HOST、DEPLOY_USER、DEPLOY_SSH_KEY_FILE）"
|
||||||
|
fi
|
||||||
|
|
||||||
echo ""
|
echo ""
|
||||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||||
echo "✓ 配置完成"
|
echo "✓ 配置完成"
|
||||||
@@ -176,6 +243,7 @@ echo ""
|
|||||||
echo "Workflow 将使用:"
|
echo "Workflow 将使用:"
|
||||||
echo " - secrets.RELEASE_TOKEN 创建 Release 并上传二进制"
|
echo " - secrets.RELEASE_TOKEN 创建 Release 并上传二进制"
|
||||||
echo " - vars.WEBHOOK_URL 发送飞书通知（如已配置）"
|
echo " - vars.WEBHOOK_URL 发送飞书通知（如已配置）"
|
||||||
|
echo " - vars.DEPLOY_* / secrets.DEPLOY_SSH_KEY deploy-mcp（如已配置）"
|
||||||
echo ""
|
echo ""
|
||||||
echo "推送代码触发构建:"
|
echo "推送代码触发构建:"
|
||||||
echo " git push origin main"
|
echo " git push origin main"
|
||||||
|
|||||||
@@ -1,459 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::{Map, Value, json};
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use std::fs;
|
|
||||||
|
|
||||||
use crate::crypto;
|
|
||||||
use crate::db;
|
|
||||||
use crate::models::EntryRow;
|
|
||||||
use crate::output::{OutputMode, print_json};
|
|
||||||
|
|
||||||
// ── Key/value parsing helpers (shared with update.rs) ───────────────────────
|
|
||||||
|
|
||||||
/// Parse secret / metadata entries into a nested key path and JSON value.
|
|
||||||
/// - `key=value` → stores the literal string `value`
|
|
||||||
/// - `key:=<json>` → parses `<json>` as a typed JSON value
|
|
||||||
/// - `key=@file` → reads the file content as a string
|
|
||||||
/// - `a:b=value` → writes nested fields: `{ "a": { "b": "value" } }`
|
|
||||||
/// - `a:b@./file.txt` → shorthand for nested file reads without manual JSON escaping
|
|
||||||
pub(crate) fn parse_kv(entry: &str) -> Result<(Vec<String>, Value)> {
|
|
||||||
// Typed JSON form: key:=<json>
|
|
||||||
if let Some((key, json_str)) = entry.split_once(":=") {
|
|
||||||
let val: Value = serde_json::from_str(json_str).map_err(|e| {
|
|
||||||
anyhow::anyhow!(
|
|
||||||
"Invalid JSON value for key '{}': {} (use key=value for plain strings)",
|
|
||||||
key,
|
|
||||||
e
|
|
||||||
)
|
|
||||||
})?;
|
|
||||||
return Ok((parse_key_path(key)?, val));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Plain string form: key=value or key=@file
|
|
||||||
if let Some((key, raw_val)) = entry.split_once('=') {
|
|
||||||
let value = if let Some(path) = raw_val.strip_prefix('@') {
|
|
||||||
fs::read_to_string(path)
|
|
||||||
.map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", path, e))?
|
|
||||||
} else {
|
|
||||||
raw_val.to_string()
|
|
||||||
};
|
|
||||||
|
|
||||||
return Ok((parse_key_path(key)?, Value::String(value)));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Shorthand file form: nested:key@file
|
|
||||||
if let Some((key, path)) = entry.split_once('@') {
|
|
||||||
let value = fs::read_to_string(path)
|
|
||||||
.map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", path, e))?;
|
|
||||||
return Ok((parse_key_path(key)?, Value::String(value)));
|
|
||||||
}
|
|
||||||
|
|
||||||
anyhow::bail!(
|
|
||||||
"Invalid format '{}'. Expected: key=value, key=@file, nested:key@file, or key:=<json>",
|
|
||||||
entry
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn build_json(entries: &[String]) -> Result<Value> {
|
|
||||||
let mut map = Map::new();
|
|
||||||
for entry in entries {
|
|
||||||
let (path, value) = parse_kv(entry)?;
|
|
||||||
insert_path(&mut map, &path, value)?;
|
|
||||||
}
|
|
||||||
Ok(Value::Object(map))
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn key_path_to_string(path: &[String]) -> String {
|
|
||||||
path.join(":")
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn collect_key_paths(entries: &[String]) -> Result<Vec<String>> {
|
|
||||||
entries
|
|
||||||
.iter()
|
|
||||||
.map(|entry| parse_kv(entry).map(|(path, _)| key_path_to_string(&path)))
|
|
||||||
.collect()
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn collect_field_paths(entries: &[String]) -> Result<Vec<String>> {
|
|
||||||
entries
|
|
||||||
.iter()
|
|
||||||
.map(|entry| parse_key_path(entry).map(|path| key_path_to_string(&path)))
|
|
||||||
.collect()
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn parse_key_path(key: &str) -> Result<Vec<String>> {
|
|
||||||
let path: Vec<String> = key
|
|
||||||
.split(':')
|
|
||||||
.map(str::trim)
|
|
||||||
.map(ToOwned::to_owned)
|
|
||||||
.collect();
|
|
||||||
|
|
||||||
if path.is_empty() || path.iter().any(|part| part.is_empty()) {
|
|
||||||
anyhow::bail!(
|
|
||||||
"Invalid key path '{}'. Use non-empty segments like 'credentials:content'.",
|
|
||||||
key
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(path)
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn insert_path(
|
|
||||||
map: &mut Map<String, Value>,
|
|
||||||
path: &[String],
|
|
||||||
value: Value,
|
|
||||||
) -> Result<()> {
|
|
||||||
if path.is_empty() {
|
|
||||||
anyhow::bail!("Key path cannot be empty");
|
|
||||||
}
|
|
||||||
|
|
||||||
if path.len() == 1 {
|
|
||||||
map.insert(path[0].clone(), value);
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
let head = path[0].clone();
|
|
||||||
let tail = &path[1..];
|
|
||||||
|
|
||||||
match map.entry(head.clone()) {
|
|
||||||
serde_json::map::Entry::Vacant(entry) => {
|
|
||||||
let mut child = Map::new();
|
|
||||||
insert_path(&mut child, tail, value)?;
|
|
||||||
entry.insert(Value::Object(child));
|
|
||||||
}
|
|
||||||
serde_json::map::Entry::Occupied(mut entry) => match entry.get_mut() {
|
|
||||||
Value::Object(child) => insert_path(child, tail, value)?,
|
|
||||||
_ => {
|
|
||||||
anyhow::bail!(
|
|
||||||
"Cannot set nested key '{}' because '{}' is already a non-object value",
|
|
||||||
key_path_to_string(path),
|
|
||||||
head
|
|
||||||
);
|
|
||||||
}
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
pub(crate) fn remove_path(map: &mut Map<String, Value>, path: &[String]) -> Result<bool> {
|
|
||||||
if path.is_empty() {
|
|
||||||
anyhow::bail!("Key path cannot be empty");
|
|
||||||
}
|
|
||||||
|
|
||||||
if path.len() == 1 {
|
|
||||||
return Ok(map.remove(&path[0]).is_some());
|
|
||||||
}
|
|
||||||
|
|
||||||
let Some(value) = map.get_mut(&path[0]) else {
|
|
||||||
return Ok(false);
|
|
||||||
};
|
|
||||||
|
|
||||||
let Value::Object(child) = value else {
|
|
||||||
return Ok(false);
|
|
||||||
};
|
|
||||||
|
|
||||||
let removed = remove_path(child, &path[1..])?;
|
|
||||||
if child.is_empty() {
|
|
||||||
map.remove(&path[0]);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(removed)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Flatten a (potentially nested) JSON object into dot-separated field entries.
|
|
||||||
/// e.g. `{"credentials": {"type": "ssh", "content": "..."}}` →
|
|
||||||
/// `[("credentials.type", "ssh"), ("credentials.content", "...")]`
|
|
||||||
/// Top-level non-object values are emitted directly.
|
|
||||||
pub(crate) fn flatten_json_fields(prefix: &str, value: &Value) -> Vec<(String, Value)> {
|
|
||||||
match value {
|
|
||||||
Value::Object(map) => {
|
|
||||||
let mut out = Vec::new();
|
|
||||||
for (k, v) in map {
|
|
||||||
let full_key = if prefix.is_empty() {
|
|
||||||
k.clone()
|
|
||||||
} else {
|
|
||||||
format!("{}.{}", prefix, k)
|
|
||||||
};
|
|
||||||
out.extend(flatten_json_fields(&full_key, v));
|
|
||||||
}
|
|
||||||
out
|
|
||||||
}
|
|
||||||
other => vec![(prefix.to_string(), other.clone())],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Add command ──────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
pub struct AddArgs<'a> {
|
|
||||||
pub namespace: &'a str,
|
|
||||||
pub kind: &'a str,
|
|
||||||
pub name: &'a str,
|
|
||||||
pub tags: &'a [String],
|
|
||||||
pub meta_entries: &'a [String],
|
|
||||||
pub secret_entries: &'a [String],
|
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
|
|
||||||
let metadata = build_json(args.meta_entries)?;
|
|
||||||
let secret_json = build_json(args.secret_entries)?;
|
|
||||||
|
|
||||||
tracing::debug!(args.namespace, args.kind, args.name, "upserting entry");
|
|
||||||
|
|
||||||
let meta_keys = collect_key_paths(args.meta_entries)?;
|
|
||||||
let secret_keys = collect_key_paths(args.secret_entries)?;
|
|
||||||
|
|
||||||
let mut tx = pool.begin().await?;
|
|
||||||
|
|
||||||
// Upsert the entry row (tags + metadata).
|
|
||||||
let existing: Option<EntryRow> = sqlx::query_as(
|
|
||||||
"SELECT id, version, tags, metadata FROM entries \
|
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3",
|
|
||||||
)
|
|
||||||
.bind(args.namespace)
|
|
||||||
.bind(args.kind)
|
|
||||||
.bind(args.name)
|
|
||||||
.fetch_optional(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
// Snapshot the current entry state before overwriting.
|
|
||||||
if let Some(ref ex) = existing
|
|
||||||
&& let Err(e) = db::snapshot_entry_history(
|
|
||||||
&mut tx,
|
|
||||||
db::EntrySnapshotParams {
|
|
||||||
entry_id: ex.id,
|
|
||||||
namespace: args.namespace,
|
|
||||||
kind: args.kind,
|
|
||||||
name: args.name,
|
|
||||||
version: ex.version,
|
|
||||||
action: "add",
|
|
||||||
tags: &ex.tags,
|
|
||||||
metadata: &ex.metadata,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
{
|
|
||||||
tracing::warn!(error = %e, "failed to snapshot entry history before upsert");
|
|
||||||
}
|
|
||||||
|
|
||||||
let entry_id: uuid::Uuid = sqlx::query_scalar(
|
|
||||||
r#"
|
|
||||||
INSERT INTO entries (namespace, kind, name, tags, metadata, version, updated_at)
|
|
||||||
VALUES ($1, $2, $3, $4, $5, 1, NOW())
|
|
||||||
ON CONFLICT (namespace, kind, name)
|
|
||||||
DO UPDATE SET
|
|
||||||
tags = EXCLUDED.tags,
|
|
||||||
metadata = EXCLUDED.metadata,
|
|
||||||
version = entries.version + 1,
|
|
||||||
updated_at = NOW()
|
|
||||||
RETURNING id
|
|
||||||
"#,
|
|
||||||
)
|
|
||||||
.bind(args.namespace)
|
|
||||||
.bind(args.kind)
|
|
||||||
.bind(args.name)
|
|
||||||
.bind(args.tags)
|
|
||||||
.bind(&metadata)
|
|
||||||
.fetch_one(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let new_entry_version: i64 = sqlx::query_scalar("SELECT version FROM entries WHERE id = $1")
|
|
||||||
.bind(entry_id)
|
|
||||||
.fetch_one(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
// Snapshot existing secret fields before replacing.
|
|
||||||
if existing.is_some() {
|
|
||||||
#[derive(sqlx::FromRow)]
|
|
||||||
struct ExistingField {
|
|
||||||
id: uuid::Uuid,
|
|
||||||
field_name: String,
|
|
||||||
encrypted: Vec<u8>,
|
|
||||||
}
|
|
||||||
let existing_fields: Vec<ExistingField> = sqlx::query_as(
|
|
||||||
"SELECT id, field_name, encrypted \
|
|
||||||
FROM secrets WHERE entry_id = $1",
|
|
||||||
)
|
|
||||||
.bind(entry_id)
|
|
||||||
.fetch_all(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
for f in &existing_fields {
|
|
||||||
if let Err(e) = db::snapshot_secret_history(
|
|
||||||
&mut tx,
|
|
||||||
db::SecretSnapshotParams {
|
|
||||||
entry_id,
|
|
||||||
secret_id: f.id,
|
|
||||||
entry_version: new_entry_version - 1,
|
|
||||||
field_name: &f.field_name,
|
|
||||||
encrypted: &f.encrypted,
|
|
||||||
action: "add",
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
{
|
|
||||||
tracing::warn!(error = %e, "failed to snapshot secret field history");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Delete existing secret fields so we can re-insert the full set.
|
|
||||||
sqlx::query("DELETE FROM secrets WHERE entry_id = $1")
|
|
||||||
.bind(entry_id)
|
|
||||||
.execute(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Insert new secret fields.
|
|
||||||
let flat_fields = flatten_json_fields("", &secret_json);
|
|
||||||
for (field_name, field_value) in &flat_fields {
|
|
||||||
let encrypted = crypto::encrypt_json(master_key, field_value)?;
|
|
||||||
|
|
||||||
sqlx::query(
|
|
||||||
"INSERT INTO secrets (entry_id, field_name, encrypted) \
|
|
||||||
VALUES ($1, $2, $3)",
|
|
||||||
)
|
|
||||||
.bind(entry_id)
|
|
||||||
.bind(field_name)
|
|
||||||
.bind(&encrypted)
|
|
||||||
.execute(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
crate::audit::log_tx(
|
|
||||||
&mut tx,
|
|
||||||
"add",
|
|
||||||
args.namespace,
|
|
||||||
args.kind,
|
|
||||||
args.name,
|
|
||||||
json!({
|
|
||||||
"tags": args.tags,
|
|
||||||
"meta_keys": meta_keys,
|
|
||||||
"secret_keys": secret_keys,
|
|
||||||
}),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
|
|
||||||
tx.commit().await?;
|
|
||||||
|
|
||||||
let result_json = json!({
|
|
||||||
"action": "added",
|
|
||||||
"namespace": args.namespace,
|
|
||||||
"kind": args.kind,
|
|
||||||
"name": args.name,
|
|
||||||
"tags": args.tags,
|
|
||||||
"meta_keys": meta_keys,
|
|
||||||
"secret_keys": secret_keys,
|
|
||||||
});
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Json | OutputMode::JsonCompact => {
|
|
||||||
print_json(&result_json, &args.output)?;
|
|
||||||
}
|
|
||||||
_ => {
|
|
||||||
println!("Added: [{}/{}] {}", args.namespace, args.kind, args.name);
|
|
||||||
if !args.tags.is_empty() {
|
|
||||||
println!(" tags: {}", args.tags.join(", "));
|
|
||||||
}
|
|
||||||
if !args.meta_entries.is_empty() {
|
|
||||||
println!(" metadata: {}", meta_keys.join(", "));
|
|
||||||
}
|
|
||||||
if !args.secret_entries.is_empty() {
|
|
||||||
println!(" secrets: {}", secret_keys.join(", "));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(test)]
|
|
||||||
mod tests {
|
|
||||||
use super::{build_json, flatten_json_fields, key_path_to_string, parse_kv, remove_path};
|
|
||||||
use serde_json::Value;
|
|
||||||
use std::fs;
|
|
||||||
use std::path::PathBuf;
|
|
||||||
use std::time::{SystemTime, UNIX_EPOCH};
|
|
||||||
|
|
||||||
fn temp_file_path(name: &str) -> PathBuf {
|
|
||||||
let nanos = SystemTime::now()
|
|
||||||
.duration_since(UNIX_EPOCH)
|
|
||||||
.expect("clock should be after unix epoch")
|
|
||||||
.as_nanos();
|
|
||||||
std::env::temp_dir().join(format!("secrets-{name}-{nanos}.txt"))
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn parse_nested_file_shorthand() {
|
|
||||||
let path = temp_file_path("ssh-key");
|
|
||||||
fs::write(&path, "line1\nline2\n").expect("should write temp file");
|
|
||||||
|
|
||||||
let entry = format!("credentials:content@{}", path.display());
|
|
||||||
let (path_parts, value) = parse_kv(&entry).expect("should parse nested file shorthand");
|
|
||||||
|
|
||||||
assert_eq!(key_path_to_string(&path_parts), "credentials:content");
|
|
||||||
assert_eq!(value, serde_json::Value::String("line1\nline2\n".into()));
|
|
||||||
|
|
||||||
fs::remove_file(path).expect("should remove temp file");
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn build_nested_json_from_mixed_entries() {
|
|
||||||
let payload = vec![
|
|
||||||
"credentials:type=ssh".to_string(),
|
|
||||||
"credentials:enabled:=true".to_string(),
|
|
||||||
"username=root".to_string(),
|
|
||||||
];
|
|
||||||
|
|
||||||
let value = build_json(&payload).expect("should build nested json");
|
|
||||||
|
|
||||||
assert_eq!(
|
|
||||||
value,
|
|
||||||
serde_json::json!({
|
|
||||||
"credentials": {
|
|
||||||
"type": "ssh",
|
|
||||||
"enabled": true
|
|
||||||
},
|
|
||||||
"username": "root"
|
|
||||||
})
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn remove_nested_path_prunes_empty_parents() {
|
|
||||||
let mut value = serde_json::json!({
|
|
||||||
"credentials": {
|
|
||||||
"content": "pem-data"
|
|
||||||
},
|
|
||||||
"username": "root"
|
|
||||||
});
|
|
||||||
|
|
||||||
let map = match &mut value {
|
|
||||||
Value::Object(map) => map,
|
|
||||||
_ => panic!("expected object"),
|
|
||||||
};
|
|
||||||
|
|
||||||
let removed = remove_path(map, &["credentials".to_string(), "content".to_string()])
|
|
||||||
.expect("should remove nested field");
|
|
||||||
|
|
||||||
assert!(removed);
|
|
||||||
assert_eq!(value, serde_json::json!({ "username": "root" }));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn flatten_json_fields_nested() {
|
|
||||||
let v = serde_json::json!({
|
|
||||||
"username": "root",
|
|
||||||
"credentials": {
|
|
||||||
"type": "ssh",
|
|
||||||
"content": "pem-data"
|
|
||||||
}
|
|
||||||
});
|
|
||||||
let mut fields = flatten_json_fields("", &v);
|
|
||||||
fields.sort_by(|a, b| a.0.cmp(&b.0));
|
|
||||||
|
|
||||||
assert_eq!(fields[0].0, "credentials.content");
|
|
||||||
assert_eq!(fields[1].0, "credentials.type");
|
|
||||||
assert_eq!(fields[2].0, "username");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
use crate::config::{self, Config, config_path};
|
|
||||||
use anyhow::Result;
|
|
||||||
|
|
||||||
pub async fn run(action: crate::ConfigAction) -> Result<()> {
|
|
||||||
match action {
|
|
||||||
crate::ConfigAction::SetDb { url } => {
|
|
||||||
// Verify connection before writing config
|
|
||||||
let pool = crate::db::create_pool(&url)
|
|
||||||
.await
|
|
||||||
.map_err(|e| anyhow::anyhow!("Database connection failed: {}", e))?;
|
|
||||||
drop(pool);
|
|
||||||
println!("Database connection successful.");
|
|
||||||
|
|
||||||
let cfg = Config {
|
|
||||||
database_url: Some(url.clone()),
|
|
||||||
};
|
|
||||||
config::save_config(&cfg)?;
|
|
||||||
println!("Database URL saved to: {}", config_path()?.display());
|
|
||||||
println!(" {}", mask_password(&url));
|
|
||||||
}
|
|
||||||
crate::ConfigAction::Show => {
|
|
||||||
let cfg = config::load_config()?;
|
|
||||||
match cfg.database_url {
|
|
||||||
Some(url) => {
|
|
||||||
println!("database_url = {}", mask_password(&url));
|
|
||||||
println!("config file: {}", config_path()?.display());
|
|
||||||
}
|
|
||||||
None => {
|
|
||||||
println!("Database URL not configured.");
|
|
||||||
println!("Run: secrets config set-db <DATABASE_URL>");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
crate::ConfigAction::Path => {
|
|
||||||
println!("{}", config_path()?.display());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Mask the password in a postgres://user:password@host/db URL.
|
|
||||||
fn mask_password(url: &str) -> String {
|
|
||||||
if let Some(at_pos) = url.rfind('@')
|
|
||||||
&& let Some(scheme_end) = url.find("://")
|
|
||||||
{
|
|
||||||
let prefix = &url[..scheme_end + 3];
|
|
||||||
let credentials = &url[scheme_end + 3..at_pos];
|
|
||||||
let rest = &url[at_pos..];
|
|
||||||
if let Some(colon_pos) = credentials.find(':') {
|
|
||||||
let user = &credentials[..colon_pos];
|
|
||||||
return format!("{}{}:***{}", prefix, user, rest);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
url.to_string()
|
|
||||||
}
|
|
||||||
@@ -1,291 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::json;
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use uuid::Uuid;
|
|
||||||
|
|
||||||
use crate::db;
|
|
||||||
use crate::models::{EntryRow, SecretFieldRow};
|
|
||||||
use crate::output::{OutputMode, print_json};
|
|
||||||
|
|
||||||
pub struct DeleteArgs<'a> {
|
|
||||||
pub namespace: &'a str,
|
|
||||||
/// Kind filter. Required when --name is given; optional for bulk deletes.
|
|
||||||
pub kind: Option<&'a str>,
|
|
||||||
/// Exact record name. When None, bulk-delete all matching records.
|
|
||||||
pub name: Option<&'a str>,
|
|
||||||
/// Preview without writing to the database (bulk mode only).
|
|
||||||
pub dry_run: bool,
|
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Internal row type used for bulk queries ────────────────────────────────
|
|
||||||
|
|
||||||
#[derive(Debug, sqlx::FromRow)]
|
|
||||||
struct FullEntryRow {
|
|
||||||
pub id: Uuid,
|
|
||||||
pub version: i64,
|
|
||||||
pub kind: String,
|
|
||||||
pub name: String,
|
|
||||||
pub metadata: serde_json::Value,
|
|
||||||
pub tags: Vec<String>,
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Entry point ────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: DeleteArgs<'_>) -> Result<()> {
|
|
||||||
match args.name {
|
|
||||||
Some(name) => {
|
|
||||||
let kind = args
|
|
||||||
.kind
|
|
||||||
.ok_or_else(|| anyhow::anyhow!("--kind is required when --name is specified"))?;
|
|
||||||
delete_one(pool, args.namespace, kind, name, args.output).await
|
|
||||||
}
|
|
||||||
None => delete_bulk(pool, args.namespace, args.kind, args.dry_run, args.output).await,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Single-record delete (original behaviour) ─────────────────────────────
|
|
||||||
|
|
||||||
async fn delete_one(
|
|
||||||
pool: &PgPool,
|
|
||||||
namespace: &str,
|
|
||||||
kind: &str,
|
|
||||||
name: &str,
|
|
||||||
output: OutputMode,
|
|
||||||
) -> Result<()> {
|
|
||||||
tracing::debug!(namespace, kind, name, "deleting entry");
|
|
||||||
|
|
||||||
let mut tx = pool.begin().await?;
|
|
||||||
|
|
||||||
let row: Option<EntryRow> = sqlx::query_as(
|
|
||||||
"SELECT id, version, tags, metadata FROM entries \
|
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 \
|
|
||||||
FOR UPDATE",
|
|
||||||
)
|
|
||||||
.bind(namespace)
|
|
||||||
.bind(kind)
|
|
||||||
.bind(name)
|
|
||||||
.fetch_optional(&mut *tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let Some(row) = row else {
|
|
||||||
tx.rollback().await?;
|
|
||||||
tracing::warn!(namespace, kind, name, "entry not found for deletion");
|
|
||||||
let v = json!({"action":"not_found","namespace":namespace,"kind":kind,"name":name});
|
|
||||||
match output {
|
|
||||||
OutputMode::Text => println!("Not found: [{}/{}] {}", namespace, kind, name),
|
|
||||||
ref mode => print_json(&v, mode)?,
|
|
||||||
}
|
|
||||||
return Ok(());
|
|
||||||
};
|
|
||||||
|
|
||||||
snapshot_and_delete(&mut tx, namespace, kind, name, &row).await?;
|
|
||||||
|
|
||||||
crate::audit::log_tx(&mut tx, "delete", namespace, kind, name, json!({})).await;
|
|
||||||
tx.commit().await?;
|
|
||||||
|
|
||||||
let v = json!({"action":"deleted","namespace":namespace,"kind":kind,"name":name});
|
|
||||||
match output {
|
|
||||||
OutputMode::Text => println!("Deleted: [{}/{}] {}", namespace, kind, name),
|
|
||||||
ref mode => print_json(&v, mode)?,
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Bulk delete by namespace (+ optional kind filter) ─────────────────────
|
|
||||||
|
|
||||||
async fn delete_bulk(
|
|
||||||
pool: &PgPool,
|
|
||||||
namespace: &str,
|
|
||||||
kind: Option<&str>,
|
|
||||||
dry_run: bool,
|
|
||||||
output: OutputMode,
|
|
||||||
) -> Result<()> {
|
|
||||||
tracing::debug!(namespace, ?kind, dry_run, "bulk-deleting entries");
|
|
||||||
|
|
||||||
let rows: Vec<FullEntryRow> = if let Some(k) = kind {
|
|
||||||
sqlx::query_as(
|
|
||||||
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
|
||||||
WHERE namespace = $1 AND kind = $2 \
|
|
||||||
ORDER BY name",
|
|
||||||
)
|
|
||||||
.bind(namespace)
|
|
||||||
.bind(k)
|
|
||||||
.fetch_all(pool)
|
|
||||||
.await?
|
|
||||||
} else {
|
|
||||||
sqlx::query_as(
|
|
||||||
"SELECT id, version, kind, name, metadata, tags FROM entries \
|
|
||||||
WHERE namespace = $1 \
|
|
||||||
ORDER BY kind, name",
|
|
||||||
)
|
|
||||||
.bind(namespace)
|
|
||||||
.fetch_all(pool)
|
|
||||||
.await?
|
|
||||||
};
|
|
||||||
|
|
||||||
if rows.is_empty() {
|
|
||||||
let v = json!({
|
|
||||||
"action": "noop",
|
|
||||||
"namespace": namespace,
|
|
||||||
"kind": kind,
|
|
||||||
"deleted": 0,
|
|
||||||
"dry_run": dry_run
|
|
||||||
});
|
|
||||||
match output {
|
|
||||||
OutputMode::Text => println!(
|
|
||||||
"No records found in namespace \"{}\"{}.",
|
|
||||||
namespace,
|
|
||||||
kind.map(|k| format!(" with kind \"{}\"", k))
|
|
||||||
.unwrap_or_default()
|
|
||||||
),
|
|
||||||
ref mode => print_json(&v, mode)?,
|
|
||||||
}
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
if dry_run {
|
|
||||||
let count = rows.len();
|
|
||||||
match output {
|
|
||||||
OutputMode::Text => {
|
|
||||||
println!(
|
|
||||||
"dry-run: would delete {} record(s) in namespace \"{}\":",
|
|
||||||
count, namespace
|
|
||||||
);
|
|
||||||
for r in &rows {
|
|
||||||
println!(" [{}/{}] {}", namespace, r.kind, r.name);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
ref mode => {
|
|
||||||
let items: Vec<_> = rows
|
|
||||||
.iter()
|
|
||||||
.map(|r| json!({"namespace": namespace, "kind": r.kind, "name": r.name}))
|
|
||||||
.collect();
|
|
||||||
print_json(
|
|
||||||
&json!({
|
|
||||||
"action": "dry_run",
|
|
||||||
"namespace": namespace,
|
|
||||||
"kind": kind,
|
|
||||||
"would_delete": count,
|
|
||||||
"entries": items
|
|
||||||
}),
|
|
||||||
mode,
|
|
||||||
)?;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
let mut deleted = Vec::with_capacity(rows.len());
|
|
||||||
|
|
||||||
for row in &rows {
|
|
||||||
let entry_row = EntryRow {
|
|
||||||
id: row.id,
|
|
||||||
version: row.version,
|
|
||||||
tags: row.tags.clone(),
|
|
||||||
metadata: row.metadata.clone(),
|
|
||||||
};
|
|
||||||
let mut tx = pool.begin().await?;
|
|
||||||
snapshot_and_delete(&mut tx, namespace, &row.kind, &row.name, &entry_row).await?;
|
|
||||||
crate::audit::log_tx(
|
|
||||||
&mut tx,
|
|
||||||
"delete",
|
|
||||||
namespace,
|
|
||||||
&row.kind,
|
|
||||||
&row.name,
|
|
||||||
json!({"bulk": true}),
|
|
||||||
)
|
|
||||||
.await;
|
|
||||||
tx.commit().await?;
|
|
||||||
|
|
||||||
deleted.push(json!({"namespace": namespace, "kind": row.kind, "name": row.name}));
|
|
||||||
tracing::info!(namespace, kind = %row.kind, name = %row.name, "bulk deleted");
|
|
||||||
}
|
|
||||||
|
|
||||||
let count = deleted.len();
|
|
||||||
match output {
|
|
||||||
OutputMode::Text => {
|
|
||||||
for item in &deleted {
|
|
||||||
println!(
|
|
||||||
"Deleted: [{}/{}] {}",
|
|
||||||
item["namespace"].as_str().unwrap_or(""),
|
|
||||||
item["kind"].as_str().unwrap_or(""),
|
|
||||||
item["name"].as_str().unwrap_or("")
|
|
||||||
);
|
|
||||||
}
|
|
||||||
println!("Total: {} record(s) deleted.", count);
|
|
||||||
}
|
|
||||||
ref mode => print_json(
|
|
||||||
&json!({
|
|
||||||
"action": "deleted",
|
|
||||||
"namespace": namespace,
|
|
||||||
"kind": kind,
|
|
||||||
"deleted": count,
|
|
||||||
"entries": deleted
|
|
||||||
}),
|
|
||||||
mode,
|
|
||||||
)?,
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Shared helper: snapshot history then DELETE ────────────────────────────
|
|
||||||
|
|
||||||
async fn snapshot_and_delete(
|
|
||||||
tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
|
|
||||||
namespace: &str,
|
|
||||||
kind: &str,
|
|
||||||
name: &str,
|
|
||||||
row: &EntryRow,
|
|
||||||
) -> Result<()> {
|
|
||||||
if let Err(e) = db::snapshot_entry_history(
|
|
||||||
tx,
|
|
||||||
db::EntrySnapshotParams {
|
|
||||||
entry_id: row.id,
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
version: row.version,
|
|
||||||
action: "delete",
|
|
||||||
tags: &row.tags,
|
|
||||||
metadata: &row.metadata,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
{
|
|
||||||
tracing::warn!(error = %e, "failed to snapshot entry history before delete");
|
|
||||||
}
|
|
||||||
|
|
||||||
let fields: Vec<SecretFieldRow> = sqlx::query_as(
|
|
||||||
"SELECT id, field_name, encrypted \
|
|
||||||
FROM secrets WHERE entry_id = $1",
|
|
||||||
)
|
|
||||||
.bind(row.id)
|
|
||||||
.fetch_all(&mut **tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
for f in &fields {
|
|
||||||
if let Err(e) = db::snapshot_secret_history(
|
|
||||||
tx,
|
|
||||||
db::SecretSnapshotParams {
|
|
||||||
entry_id: row.id,
|
|
||||||
secret_id: f.id,
|
|
||||||
entry_version: row.version,
|
|
||||||
field_name: &f.field_name,
|
|
||||||
encrypted: &f.encrypted,
|
|
||||||
action: "delete",
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
{
|
|
||||||
tracing::warn!(error = %e, "failed to snapshot secret history before delete");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
sqlx::query("DELETE FROM entries WHERE id = $1")
|
|
||||||
.bind(row.id)
|
|
||||||
.execute(&mut **tx)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,109 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use std::collections::BTreeMap;
|
|
||||||
use std::io::Write;
|
|
||||||
|
|
||||||
use crate::commands::search::{fetch_entries, fetch_secrets_for_entries};
|
|
||||||
use crate::crypto;
|
|
||||||
use crate::models::{ExportData, ExportEntry, ExportFormat};
|
|
||||||
|
|
||||||
pub struct ExportArgs<'a> {
|
|
||||||
pub namespace: Option<&'a str>,
|
|
||||||
pub kind: Option<&'a str>,
|
|
||||||
pub name: Option<&'a str>,
|
|
||||||
pub tags: &'a [String],
|
|
||||||
pub query: Option<&'a str>,
|
|
||||||
/// Output file path. None means write to stdout.
|
|
||||||
pub file: Option<&'a str>,
|
|
||||||
/// Explicit format override (e.g. from --format flag).
|
|
||||||
pub format: Option<&'a str>,
|
|
||||||
/// When true, secrets are omitted and master_key is not used.
|
|
||||||
pub no_secrets: bool,
|
|
||||||
}
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: ExportArgs<'_>, master_key: Option<&[u8; 32]>) -> Result<()> {
|
|
||||||
// Determine output format: --format > file extension > default JSON.
|
|
||||||
let format = if let Some(fmt_str) = args.format {
|
|
||||||
ExportFormat::from_str(fmt_str)?
|
|
||||||
} else if let Some(path) = args.file {
|
|
||||||
ExportFormat::from_extension(path).unwrap_or(ExportFormat::Json)
|
|
||||||
} else {
|
|
||||||
ExportFormat::Json
|
|
||||||
};
|
|
||||||
|
|
||||||
let entries = fetch_entries(
|
|
||||||
pool,
|
|
||||||
args.namespace,
|
|
||||||
args.kind,
|
|
||||||
args.name,
|
|
||||||
args.tags,
|
|
||||||
args.query,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let entry_ids: Vec<uuid::Uuid> = entries.iter().map(|e| e.id).collect();
|
|
||||||
|
|
||||||
let secrets_map = if !args.no_secrets && !entry_ids.is_empty() {
|
|
||||||
fetch_secrets_for_entries(pool, &entry_ids).await?
|
|
||||||
} else {
|
|
||||||
std::collections::HashMap::new()
|
|
||||||
};
|
|
||||||
|
|
||||||
let key = if !args.no_secrets { master_key } else { None };
|
|
||||||
|
|
||||||
let mut export_entries: Vec<ExportEntry> = Vec::with_capacity(entries.len());
|
|
||||||
for entry in &entries {
|
|
||||||
let secrets = if args.no_secrets {
|
|
||||||
None
|
|
||||||
} else {
|
|
||||||
let fields = secrets_map.get(&entry.id).map(Vec::as_slice).unwrap_or(&[]);
|
|
||||||
if fields.is_empty() {
|
|
||||||
Some(BTreeMap::new())
|
|
||||||
} else {
|
|
||||||
let mk =
|
|
||||||
key.ok_or_else(|| anyhow::anyhow!("master key required to decrypt secrets"))?;
|
|
||||||
let mut map = BTreeMap::new();
|
|
||||||
for f in fields {
|
|
||||||
let decrypted = crypto::decrypt_json(mk, &f.encrypted)?;
|
|
||||||
map.insert(f.field_name.clone(), decrypted);
|
|
||||||
}
|
|
||||||
Some(map)
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
export_entries.push(ExportEntry {
|
|
||||||
namespace: entry.namespace.clone(),
|
|
||||||
kind: entry.kind.clone(),
|
|
||||||
name: entry.name.clone(),
|
|
||||||
tags: entry.tags.clone(),
|
|
||||||
metadata: entry.metadata.clone(),
|
|
||||||
secrets,
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
let data = ExportData {
|
|
||||||
version: 1,
|
|
||||||
exported_at: chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
|
||||||
entries: export_entries,
|
|
||||||
};
|
|
||||||
|
|
||||||
let serialized = format.serialize(&data)?;
|
|
||||||
|
|
||||||
if let Some(path) = args.file {
|
|
||||||
std::fs::write(path, &serialized)?;
|
|
||||||
println!(
|
|
||||||
"Exported {} record(s) to {} ({:?})",
|
|
||||||
data.entries.len(),
|
|
||||||
path,
|
|
||||||
format
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
std::io::stdout().write_all(serialized.as_bytes())?;
|
|
||||||
// Ensure trailing newline on stdout.
|
|
||||||
if !serialized.ends_with('\n') {
|
|
||||||
println!();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,78 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::{Value, json};
|
|
||||||
use sqlx::{FromRow, PgPool};
|
|
||||||
|
|
||||||
use crate::output::{OutputMode, format_local_time, print_json};
|
|
||||||
|
|
||||||
pub struct HistoryArgs<'a> {
|
|
||||||
pub namespace: &'a str,
|
|
||||||
pub kind: &'a str,
|
|
||||||
pub name: &'a str,
|
|
||||||
pub limit: u32,
|
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
|
||||||
|
|
||||||
/// List history entries for an entry.
|
|
||||||
pub async fn run(pool: &PgPool, args: HistoryArgs<'_>) -> Result<()> {
|
|
||||||
#[derive(FromRow)]
|
|
||||||
struct HistorySummary {
|
|
||||||
version: i64,
|
|
||||||
action: String,
|
|
||||||
actor: String,
|
|
||||||
created_at: chrono::DateTime<chrono::Utc>,
|
|
||||||
}
|
|
||||||
|
|
||||||
let rows: Vec<HistorySummary> = sqlx::query_as(
|
|
||||||
"SELECT version, action, actor, created_at FROM entries_history \
|
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3 \
|
|
||||||
ORDER BY id DESC LIMIT $4",
|
|
||||||
)
|
|
||||||
.bind(args.namespace)
|
|
||||||
.bind(args.kind)
|
|
||||||
.bind(args.name)
|
|
||||||
.bind(args.limit as i64)
|
|
||||||
.fetch_all(pool)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Json | OutputMode::JsonCompact => {
|
|
||||||
let arr: Vec<Value> = rows
|
|
||||||
.iter()
|
|
||||||
.map(|r| {
|
|
||||||
json!({
|
|
||||||
"version": r.version,
|
|
||||||
"action": r.action,
|
|
||||||
"actor": r.actor,
|
|
||||||
"created_at": r.created_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
|
||||||
})
|
|
||||||
})
|
|
||||||
.collect();
|
|
||||||
print_json(&Value::Array(arr), &args.output)?;
|
|
||||||
}
|
|
||||||
_ => {
|
|
||||||
if rows.is_empty() {
|
|
||||||
println!(
|
|
||||||
"No history found for [{}/{}] {}.",
|
|
||||||
args.namespace, args.kind, args.name
|
|
||||||
);
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
println!(
|
|
||||||
"History for [{}/{}] {}:",
|
|
||||||
args.namespace, args.kind, args.name
|
|
||||||
);
|
|
||||||
for r in &rows {
|
|
||||||
println!(
|
|
||||||
" v{:<4} {:8} {} {}",
|
|
||||||
r.version,
|
|
||||||
r.action,
|
|
||||||
r.actor,
|
|
||||||
format_local_time(r.created_at)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
println!(" (use `secrets rollback --to-version <N>` to restore)");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,217 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::Value;
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use std::collections::BTreeMap;
|
|
||||||
|
|
||||||
use crate::commands::add::{self, AddArgs};
|
|
||||||
use crate::models::ExportFormat;
|
|
||||||
use crate::output::{OutputMode, print_json};
|
|
||||||
|
|
||||||
pub struct ImportArgs<'a> {
|
|
||||||
pub file: &'a str,
|
|
||||||
/// Overwrite existing records when there is a conflict (upsert).
|
|
||||||
/// Without this flag, the import aborts on the first conflict.
|
|
||||||
/// A future `--skip` flag could allow silently skipping conflicts and continuing.
|
|
||||||
pub force: bool,
|
|
||||||
/// Check and preview operations without writing to the database.
|
|
||||||
pub dry_run: bool,
|
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: ImportArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
|
|
||||||
let format = ExportFormat::from_extension(args.file)?;
|
|
||||||
let content = std::fs::read_to_string(args.file)
|
|
||||||
.map_err(|e| anyhow::anyhow!("Cannot read file '{}': {}", args.file, e))?;
|
|
||||||
let data = format.deserialize(&content)?;
|
|
||||||
|
|
||||||
if data.version != 1 {
|
|
||||||
anyhow::bail!(
|
|
||||||
"Unsupported export version {}. Only version 1 is supported.",
|
|
||||||
data.version
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
let total = data.entries.len();
|
|
||||||
let mut inserted = 0usize;
|
|
||||||
let mut skipped = 0usize;
|
|
||||||
let mut failed = 0usize;
|
|
||||||
|
|
||||||
for entry in &data.entries {
|
|
||||||
// Check if record already exists.
|
|
||||||
let exists: bool = sqlx::query_scalar(
|
|
||||||
"SELECT EXISTS(SELECT 1 FROM entries \
|
|
||||||
WHERE namespace = $1 AND kind = $2 AND name = $3)",
|
|
||||||
)
|
|
||||||
.bind(&entry.namespace)
|
|
||||||
.bind(&entry.kind)
|
|
||||||
.bind(&entry.name)
|
|
||||||
.fetch_one(pool)
|
|
||||||
.await
|
|
||||||
.unwrap_or(false);
|
|
||||||
|
|
||||||
if exists && !args.force {
|
|
||||||
let v = serde_json::json!({
|
|
||||||
"action": "conflict",
|
|
||||||
"namespace": entry.namespace,
|
|
||||||
"kind": entry.kind,
|
|
||||||
"name": entry.name,
|
|
||||||
});
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => eprintln!(
|
|
||||||
"[{}/{}/{}] conflict — record already exists (use --force to overwrite)",
|
|
||||||
entry.namespace, entry.kind, entry.name
|
|
||||||
),
|
|
||||||
ref mode => {
|
|
||||||
// Write conflict notice to stderr so it does not mix with summary JSON.
|
|
||||||
eprint!(
|
|
||||||
"{}",
|
|
||||||
if *mode == OutputMode::Json {
|
|
||||||
serde_json::to_string_pretty(&v)?
|
|
||||||
} else {
|
|
||||||
serde_json::to_string(&v)?
|
|
||||||
}
|
|
||||||
);
|
|
||||||
eprintln!();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return Err(anyhow::anyhow!(
|
|
||||||
"Import aborted: conflict on [{}/{}/{}]",
|
|
||||||
entry.namespace,
|
|
||||||
entry.kind,
|
|
||||||
entry.name
|
|
||||||
));
|
|
||||||
}
|
|
||||||
|
|
||||||
let action = if exists { "upsert" } else { "insert" };
|
|
||||||
|
|
||||||
if args.dry_run {
|
|
||||||
let v = serde_json::json!({
|
|
||||||
"action": action,
|
|
||||||
"namespace": entry.namespace,
|
|
||||||
"kind": entry.kind,
|
|
||||||
"name": entry.name,
|
|
||||||
"dry_run": true,
|
|
||||||
});
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => println!(
|
|
||||||
"[dry-run] {} [{}/{}/{}]",
|
|
||||||
action, entry.namespace, entry.kind, entry.name
|
|
||||||
),
|
|
||||||
ref mode => print_json(&v, mode)?,
|
|
||||||
}
|
|
||||||
if exists {
|
|
||||||
skipped += 1;
|
|
||||||
} else {
|
|
||||||
inserted += 1;
|
|
||||||
}
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Build secret_entries: convert BTreeMap<String, Value> to Vec<String> ("key:=json")
|
|
||||||
let secret_entries = build_secret_entries(entry.secrets.as_ref());
|
|
||||||
|
|
||||||
// Build meta_entries from metadata JSON object.
|
|
||||||
let meta_entries = build_meta_entries(&entry.metadata);
|
|
||||||
|
|
||||||
match add::run(
|
|
||||||
pool,
|
|
||||||
AddArgs {
|
|
||||||
namespace: &entry.namespace,
|
|
||||||
kind: &entry.kind,
|
|
||||||
name: &entry.name,
|
|
||||||
tags: &entry.tags,
|
|
||||||
meta_entries: &meta_entries,
|
|
||||||
secret_entries: &secret_entries,
|
|
||||||
output: OutputMode::Text,
|
|
||||||
},
|
|
||||||
master_key,
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
{
|
|
||||||
Ok(()) => {
|
|
||||||
let v = serde_json::json!({
|
|
||||||
"action": action,
|
|
||||||
"namespace": entry.namespace,
|
|
||||||
"kind": entry.kind,
|
|
||||||
"name": entry.name,
|
|
||||||
});
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => println!(
|
|
||||||
"Imported [{}/{}/{}]",
|
|
||||||
entry.namespace, entry.kind, entry.name
|
|
||||||
),
|
|
||||||
ref mode => print_json(&v, mode)?,
|
|
||||||
}
|
|
||||||
inserted += 1;
|
|
||||||
}
|
|
||||||
Err(e) => {
|
|
||||||
eprintln!(
|
|
||||||
"Error importing [{}/{}/{}]: {}",
|
|
||||||
entry.namespace, entry.kind, entry.name, e
|
|
||||||
);
|
|
||||||
failed += 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
let summary = serde_json::json!({
|
|
||||||
"total": total,
|
|
||||||
"inserted": inserted,
|
|
||||||
"skipped": skipped,
|
|
||||||
"failed": failed,
|
|
||||||
"dry_run": args.dry_run,
|
|
||||||
});
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => {
|
|
||||||
if args.dry_run {
|
|
||||||
println!(
|
|
||||||
"\n[dry-run] {} total: {} would insert, {} would skip, {} would fail",
|
|
||||||
total, inserted, skipped, failed
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
println!(
|
|
||||||
"\nImport done: {} total — {} inserted, {} skipped, {} failed",
|
|
||||||
total, inserted, skipped, failed
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
ref mode => print_json(&summary, mode)?,
|
|
||||||
}
|
|
||||||
|
|
||||||
if failed > 0 {
|
|
||||||
anyhow::bail!("{} record(s) failed to import", failed);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Convert metadata JSON object into Vec<String> of "key:=json_value" entries.
|
|
||||||
fn build_meta_entries(metadata: &Value) -> Vec<String> {
|
|
||||||
let mut entries = Vec::new();
|
|
||||||
if let Some(obj) = metadata.as_object() {
|
|
||||||
for (k, v) in obj {
|
|
||||||
entries.push(value_to_kv_entry(k, v));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
entries
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Convert a BTreeMap<String, Value> (secrets) into Vec<String> of "key:=json_value" entries.
|
|
||||||
fn build_secret_entries(secrets: Option<&BTreeMap<String, Value>>) -> Vec<String> {
|
|
||||||
let mut entries = Vec::new();
|
|
||||||
if let Some(map) = secrets {
|
|
||||||
for (k, v) in map {
|
|
||||||
entries.push(value_to_kv_entry(k, v));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
entries
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Convert a key/value pair to a CLI-style entry string.
|
|
||||||
/// Strings use `key=value`; everything else uses `key:=<json>`.
|
|
||||||
fn value_to_kv_entry(key: &str, value: &Value) -> String {
|
|
||||||
match value {
|
|
||||||
Value::String(s) => format!("{}={}", key, s),
|
|
||||||
other => format!("{}:={}", key, other),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
use anyhow::{Context, Result};
|
|
||||||
use rand::RngExt;
|
|
||||||
use sqlx::PgPool;
|
|
||||||
|
|
||||||
use crate::{crypto, db};
|
|
||||||
|
|
||||||
const MIN_MASTER_PASSWORD_LEN: usize = 8;
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool) -> Result<()> {
|
|
||||||
println!("Initializing secrets master key...");
|
|
||||||
println!();
|
|
||||||
|
|
||||||
// Read password (no echo)
|
|
||||||
let password = rpassword::prompt_password(format!(
|
|
||||||
"Enter master password (at least {} characters): ",
|
|
||||||
MIN_MASTER_PASSWORD_LEN
|
|
||||||
))
|
|
||||||
.context("failed to read password")?;
|
|
||||||
if password.chars().count() < MIN_MASTER_PASSWORD_LEN {
|
|
||||||
anyhow::bail!(
|
|
||||||
"Master password must be at least {} characters.",
|
|
||||||
MIN_MASTER_PASSWORD_LEN
|
|
||||||
);
|
|
||||||
}
|
|
||||||
let confirm = rpassword::prompt_password("Confirm master password: ")
|
|
||||||
.context("failed to read password confirmation")?;
|
|
||||||
if password != confirm {
|
|
||||||
anyhow::bail!("Passwords do not match.");
|
|
||||||
}
|
|
||||||
|
|
||||||
// Get or create Argon2id salt
|
|
||||||
let salt = match db::load_argon2_salt(pool).await? {
|
|
||||||
Some(existing) => {
|
|
||||||
println!("Found existing salt in database (not the first device).");
|
|
||||||
existing
|
|
||||||
}
|
|
||||||
None => {
|
|
||||||
println!("Generating new Argon2id salt and storing in database...");
|
|
||||||
let mut salt = vec![0u8; 16];
|
|
||||||
rand::rng().fill(&mut salt[..]);
|
|
||||||
db::store_argon2_salt(pool, &salt).await?;
|
|
||||||
salt
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
// Derive master key
|
|
||||||
print!("Deriving master key (Argon2id, this takes a moment)... ");
|
|
||||||
let master_key = crypto::derive_master_key(&password, &salt)?;
|
|
||||||
println!("done.");
|
|
||||||
|
|
||||||
// Store in OS Keychain
|
|
||||||
crypto::store_master_key(&master_key)?;
|
|
||||||
|
|
||||||
// Self-test: encrypt and decrypt a canary value
|
|
||||||
let canary = b"secrets-cli-canary";
|
|
||||||
let enc = crypto::encrypt(&master_key, canary)?;
|
|
||||||
let dec = crypto::decrypt(&master_key, &enc)?;
|
|
||||||
if dec != canary {
|
|
||||||
anyhow::bail!("Self-test failed: encryption roundtrip mismatch");
|
|
||||||
}
|
|
||||||
|
|
||||||
println!();
|
|
||||||
println!("Master key stored in OS Keychain.");
|
|
||||||
println!("You can now use `secrets add` / `secrets search` commands.");
|
|
||||||
println!();
|
|
||||||
println!("IMPORTANT: Remember your master password — it is not stored anywhere.");
|
|
||||||
println!(" On a new device, run `secrets init` with the same password.");
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
pub mod add;
|
|
||||||
pub mod config;
|
|
||||||
pub mod delete;
|
|
||||||
pub mod export_cmd;
|
|
||||||
pub mod history;
|
|
||||||
pub mod import_cmd;
|
|
||||||
pub mod init;
|
|
||||||
pub mod rollback;
|
|
||||||
pub mod run;
|
|
||||||
pub mod search;
|
|
||||||
pub mod update;
|
|
||||||
pub mod upgrade;
|
|
||||||
@@ -1,248 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::json;
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use std::collections::HashMap;
|
|
||||||
|
|
||||||
use crate::commands::search::{build_injected_env_map, fetch_entries, fetch_secrets_for_entries};
|
|
||||||
use crate::output::OutputMode;
|
|
||||||
|
|
||||||
pub struct RunArgs<'a> {
|
|
||||||
pub namespace: Option<&'a str>,
|
|
||||||
pub kind: Option<&'a str>,
|
|
||||||
pub name: Option<&'a str>,
|
|
||||||
pub tags: &'a [String],
|
|
||||||
pub secret_fields: &'a [String],
|
|
||||||
pub prefix: &'a str,
|
|
||||||
pub dry_run: bool,
|
|
||||||
pub output: OutputMode,
|
|
||||||
pub command: &'a [String],
|
|
||||||
}
|
|
||||||
|
|
||||||
/// A single environment variable with its origin for dry-run display.
|
|
||||||
pub struct EnvMapping {
|
|
||||||
pub var_name: String,
|
|
||||||
pub source: String,
|
|
||||||
pub field: String,
|
|
||||||
}
|
|
||||||
|
|
||||||
struct CollectArgs<'a> {
|
|
||||||
namespace: Option<&'a str>,
|
|
||||||
kind: Option<&'a str>,
|
|
||||||
name: Option<&'a str>,
|
|
||||||
tags: &'a [String],
|
|
||||||
secret_fields: &'a [String],
|
|
||||||
prefix: &'a str,
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Fetch entries matching the filter and build a flat env map (decrypted secrets only, no metadata).
|
|
||||||
/// If `secret_fields` is non-empty, only those fields are decrypted and included.
|
|
||||||
async fn collect_env_map(
|
|
||||||
pool: &PgPool,
|
|
||||||
args: &CollectArgs<'_>,
|
|
||||||
master_key: &[u8; 32],
|
|
||||||
) -> Result<HashMap<String, String>> {
|
|
||||||
if args.namespace.is_none()
|
|
||||||
&& args.kind.is_none()
|
|
||||||
&& args.name.is_none()
|
|
||||||
&& args.tags.is_empty()
|
|
||||||
{
|
|
||||||
anyhow::bail!(
|
|
||||||
"At least one filter (--namespace, --kind, --name, or --tag) is required for run"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
let entries =
|
|
||||||
fetch_entries(pool, args.namespace, args.kind, args.name, args.tags, None).await?;
|
|
||||||
if entries.is_empty() {
|
|
||||||
anyhow::bail!("No records matched the given filters.");
|
|
||||||
}
|
|
||||||
|
|
||||||
let entry_ids: Vec<uuid::Uuid> = entries.iter().map(|e| e.id).collect();
|
|
||||||
let fields_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
|
|
||||||
|
|
||||||
let mut map = HashMap::new();
|
|
||||||
for entry in &entries {
|
|
||||||
let empty = vec![];
|
|
||||||
let all_fields = fields_map.get(&entry.id).unwrap_or(&empty);
|
|
||||||
let filtered_fields: Vec<_> = if args.secret_fields.is_empty() {
|
|
||||||
all_fields.iter().collect()
|
|
||||||
} else {
|
|
||||||
all_fields
|
|
||||||
.iter()
|
|
||||||
.filter(|f| args.secret_fields.contains(&f.field_name))
|
|
||||||
.collect()
|
|
||||||
};
|
|
||||||
let row_map =
|
|
||||||
build_injected_env_map(pool, entry, args.prefix, master_key, &filtered_fields).await?;
|
|
||||||
for (k, v) in row_map {
|
|
||||||
map.insert(k, v);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Ok(map)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Like `collect_env_map` but also returns per-variable source info for dry-run display.
|
|
||||||
async fn collect_env_map_with_source(
|
|
||||||
pool: &PgPool,
|
|
||||||
args: &CollectArgs<'_>,
|
|
||||||
master_key: &[u8; 32],
|
|
||||||
) -> Result<(HashMap<String, String>, Vec<EnvMapping>)> {
|
|
||||||
if args.namespace.is_none()
|
|
||||||
&& args.kind.is_none()
|
|
||||||
&& args.name.is_none()
|
|
||||||
&& args.tags.is_empty()
|
|
||||||
{
|
|
||||||
anyhow::bail!(
|
|
||||||
"At least one filter (--namespace, --kind, --name, or --tag) is required for run"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
let entries =
|
|
||||||
fetch_entries(pool, args.namespace, args.kind, args.name, args.tags, None).await?;
|
|
||||||
if entries.is_empty() {
|
|
||||||
anyhow::bail!("No records matched the given filters.");
|
|
||||||
}
|
|
||||||
|
|
||||||
let entry_ids: Vec<uuid::Uuid> = entries.iter().map(|e| e.id).collect();
|
|
||||||
let fields_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
|
|
||||||
|
|
||||||
let mut map = HashMap::new();
|
|
||||||
let mut mappings: Vec<EnvMapping> = Vec::new();
|
|
||||||
|
|
||||||
for entry in &entries {
|
|
||||||
let empty = vec![];
|
|
||||||
let all_fields = fields_map.get(&entry.id).unwrap_or(&empty);
|
|
||||||
let filtered_fields: Vec<_> = if args.secret_fields.is_empty() {
|
|
||||||
all_fields.iter().collect()
|
|
||||||
} else {
|
|
||||||
all_fields
|
|
||||||
.iter()
|
|
||||||
.filter(|f| args.secret_fields.contains(&f.field_name))
|
|
||||||
.collect()
|
|
||||||
};
|
|
||||||
|
|
||||||
let row_map =
|
|
||||||
build_injected_env_map(pool, entry, args.prefix, master_key, &filtered_fields).await?;
|
|
||||||
|
|
||||||
let source = format!("{}/{}/{}", entry.namespace, entry.kind, entry.name);
|
|
||||||
for field in &filtered_fields {
|
|
||||||
let var_name = format!(
|
|
||||||
"{}_{}",
|
|
||||||
env_prefix_name(&entry.name, args.prefix),
|
|
||||||
field.field_name.to_uppercase().replace(['-', '.'], "_")
|
|
||||||
);
|
|
||||||
if row_map.contains_key(&var_name) {
|
|
||||||
mappings.push(EnvMapping {
|
|
||||||
var_name: var_name.clone(),
|
|
||||||
source: source.clone(),
|
|
||||||
field: field.field_name.clone(),
|
|
||||||
});
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
for (k, v) in row_map {
|
|
||||||
map.insert(k, v);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Ok((map, mappings))
|
|
||||||
}
|
|
||||||
|
|
||||||
fn env_prefix_name(entry_name: &str, prefix: &str) -> String {
|
|
||||||
let name_part = entry_name.to_uppercase().replace(['-', '.', ' '], "_");
|
|
||||||
if prefix.is_empty() {
|
|
||||||
name_part
|
|
||||||
} else {
|
|
||||||
format!(
|
|
||||||
"{}_{}",
|
|
||||||
prefix.to_uppercase().replace(['-', '.', ' '], "_"),
|
|
||||||
name_part
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/// `run` command: inject secrets into a child process environment and execute.
|
|
||||||
/// With `--dry-run`, prints the variable mapping (names and sources only) without executing.
|
|
||||||
pub async fn run_exec(pool: &PgPool, args: RunArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
|
|
||||||
if !args.dry_run && args.command.is_empty() {
|
|
||||||
anyhow::bail!(
|
|
||||||
"No command specified. Usage: secrets run [filter flags] -- <command> [args]"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
let collect = CollectArgs {
|
|
||||||
namespace: args.namespace,
|
|
||||||
kind: args.kind,
|
|
||||||
name: args.name,
|
|
||||||
tags: args.tags,
|
|
||||||
secret_fields: args.secret_fields,
|
|
||||||
prefix: args.prefix,
|
|
||||||
};
|
|
||||||
|
|
||||||
if args.dry_run {
|
|
||||||
let (env_map, mappings) = collect_env_map_with_source(pool, &collect, master_key).await?;
|
|
||||||
|
|
||||||
let total_vars = env_map.len();
|
|
||||||
let total_records = {
|
|
||||||
let mut seen = std::collections::HashSet::new();
|
|
||||||
for m in &mappings {
|
|
||||||
seen.insert(&m.source);
|
|
||||||
}
|
|
||||||
seen.len()
|
|
||||||
};
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Text => {
|
|
||||||
for m in &mappings {
|
|
||||||
println!("{:<40} <- {} :: {}", m.var_name, m.source, m.field);
|
|
||||||
}
|
|
||||||
println!("---");
|
|
||||||
println!(
|
|
||||||
"{} variable(s) from {} record(s).",
|
|
||||||
total_vars, total_records
|
|
||||||
);
|
|
||||||
}
|
|
||||||
OutputMode::Json | OutputMode::JsonCompact => {
|
|
||||||
let vars: Vec<_> = mappings
|
|
||||||
.iter()
|
|
||||||
.map(|m| {
|
|
||||||
json!({
|
|
||||||
"name": m.var_name,
|
|
||||||
"source": m.source,
|
|
||||||
"field": m.field,
|
|
||||||
})
|
|
||||||
})
|
|
||||||
.collect();
|
|
||||||
let out = json!({
|
|
||||||
"variables": vars,
|
|
||||||
"total_vars": total_vars,
|
|
||||||
"total_records": total_records,
|
|
||||||
});
|
|
||||||
if args.output == OutputMode::Json {
|
|
||||||
println!("{}", serde_json::to_string_pretty(&out)?);
|
|
||||||
} else {
|
|
||||||
println!("{}", serde_json::to_string(&out)?);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
let env_map = collect_env_map(pool, &collect, master_key).await?;
|
|
||||||
|
|
||||||
tracing::debug!(
|
|
||||||
vars = env_map.len(),
|
|
||||||
cmd = args.command[0].as_str(),
|
|
||||||
"injecting secrets into child process"
|
|
||||||
);
|
|
||||||
|
|
||||||
let status = std::process::Command::new(&args.command[0])
|
|
||||||
.args(&args.command[1..])
|
|
||||||
.envs(&env_map)
|
|
||||||
.status()
|
|
||||||
.map_err(|e| anyhow::anyhow!("Failed to execute '{}': {}", args.command[0], e))?;
|
|
||||||
|
|
||||||
if !status.success() {
|
|
||||||
let code = status.code().unwrap_or(1);
|
|
||||||
std::process::exit(code);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,568 +0,0 @@
|
|||||||
use anyhow::Result;
|
|
||||||
use serde_json::{Value, json};
|
|
||||||
use sqlx::PgPool;
|
|
||||||
use std::collections::HashMap;
|
|
||||||
|
|
||||||
use crate::crypto;
|
|
||||||
use crate::models::{Entry, SecretField};
|
|
||||||
use crate::output::{OutputMode, format_local_time};
|
|
||||||
|
|
||||||
pub struct SearchArgs<'a> {
|
|
||||||
pub namespace: Option<&'a str>,
|
|
||||||
pub kind: Option<&'a str>,
|
|
||||||
pub name: Option<&'a str>,
|
|
||||||
pub tags: &'a [String],
|
|
||||||
pub query: Option<&'a str>,
|
|
||||||
pub fields: &'a [String],
|
|
||||||
pub summary: bool,
|
|
||||||
pub limit: u32,
|
|
||||||
pub offset: u32,
|
|
||||||
pub sort: &'a str,
|
|
||||||
pub output: OutputMode,
|
|
||||||
}
|
|
||||||
|
|
||||||
pub async fn run(pool: &PgPool, args: SearchArgs<'_>) -> Result<()> {
|
|
||||||
validate_safe_search_args(args.fields)?;
|
|
||||||
|
|
||||||
let rows = fetch_entries_paged(
|
|
||||||
pool,
|
|
||||||
PagedFetchArgs {
|
|
||||||
namespace: args.namespace,
|
|
||||||
kind: args.kind,
|
|
||||||
name: args.name,
|
|
||||||
tags: args.tags,
|
|
||||||
query: args.query,
|
|
||||||
sort: args.sort,
|
|
||||||
limit: args.limit,
|
|
||||||
offset: args.offset,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
// -f/--field: extract specific metadata field values directly
|
|
||||||
if !args.fields.is_empty() {
|
|
||||||
return print_fields(&rows, args.fields);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Fetch secret schemas for all returned entries (no master key needed).
|
|
||||||
let entry_ids: Vec<uuid::Uuid> = rows.iter().map(|r| r.id).collect();
|
|
||||||
let schema_map = if !args.summary && !entry_ids.is_empty() {
|
|
||||||
fetch_secret_schemas(pool, &entry_ids).await?
|
|
||||||
} else {
|
|
||||||
HashMap::new()
|
|
||||||
};
|
|
||||||
|
|
||||||
match args.output {
|
|
||||||
OutputMode::Json | OutputMode::JsonCompact => {
|
|
||||||
let arr: Vec<Value> = rows
|
|
||||||
.iter()
|
|
||||||
.map(|r| to_json(r, args.summary, schema_map.get(&r.id).map(Vec::as_slice)))
|
|
||||||
.collect();
|
|
||||||
let out = if args.output == OutputMode::Json {
|
|
||||||
serde_json::to_string_pretty(&arr)?
|
|
||||||
} else {
|
|
||||||
serde_json::to_string(&arr)?
|
|
||||||
};
|
|
||||||
println!("{}", out);
|
|
||||||
}
|
|
||||||
OutputMode::Text => {
|
|
||||||
if rows.is_empty() {
|
|
||||||
println!("No records found.");
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
for row in &rows {
|
|
||||||
print_text(
|
|
||||||
row,
|
|
||||||
args.summary,
|
|
||||||
schema_map.get(&row.id).map(Vec::as_slice),
|
|
||||||
)?;
|
|
||||||
}
|
|
||||||
println!("{} record(s) found.", rows.len());
|
|
||||||
if rows.len() == args.limit as usize {
|
|
||||||
println!(
|
|
||||||
" (showing up to {}; use --offset {} to see more)",
|
|
||||||
args.limit,
|
|
||||||
args.offset + args.limit
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn validate_safe_search_args(fields: &[String]) -> Result<()> {
|
|
||||||
if let Some(field) = fields.iter().find(|field| is_secret_field(field)) {
|
|
||||||
anyhow::bail!(
|
|
||||||
"Field '{}' is sensitive. `search -f` only supports metadata.* fields; use `secrets run` for secrets.",
|
|
||||||
field
|
|
||||||
);
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn is_secret_field(field: &str) -> bool {
|
|
||||||
matches!(
|
|
||||||
field.split_once('.').map(|(section, _)| section),
|
|
||||||
Some("secret" | "secrets" | "encrypted")
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Entry fetching ────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
struct PagedFetchArgs<'a> {
|
|
||||||
namespace: Option<&'a str>,
|
|
||||||
kind: Option<&'a str>,
|
|
||||||
name: Option<&'a str>,
|
|
||||||
tags: &'a [String],
|
|
||||||
query: Option<&'a str>,
|
|
||||||
sort: &'a str,
|
|
||||||
limit: u32,
|
|
||||||
offset: u32,
|
|
||||||
}
|
|
||||||
|
|
||||||
/// A very large limit used when callers need all matching records (export, run).
|
|
||||||
/// Postgres will stop scanning when this many rows are found; adjust if needed.
|
|
||||||
pub const FETCH_ALL_LIMIT: u32 = 100_000;
|
|
||||||
|
|
||||||
/// Fetch entries matching the given filters (used by search, run).
|
|
||||||
/// `limit` caps the result set; pass `FETCH_ALL_LIMIT` when you need all matching records.
|
|
||||||
pub async fn fetch_entries(
|
|
||||||
pool: &PgPool,
|
|
||||||
namespace: Option<&str>,
|
|
||||||
kind: Option<&str>,
|
|
||||||
name: Option<&str>,
|
|
||||||
tags: &[String],
|
|
||||||
query: Option<&str>,
|
|
||||||
) -> Result<Vec<Entry>> {
|
|
||||||
fetch_entries_with_limit(pool, namespace, kind, name, tags, query, FETCH_ALL_LIMIT).await
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Like `fetch_entries` but with an explicit limit. Used internally by `search`.
|
|
||||||
pub(crate) async fn fetch_entries_with_limit(
|
|
||||||
pool: &PgPool,
|
|
||||||
namespace: Option<&str>,
|
|
||||||
kind: Option<&str>,
|
|
||||||
name: Option<&str>,
|
|
||||||
tags: &[String],
|
|
||||||
query: Option<&str>,
|
|
||||||
limit: u32,
|
|
||||||
) -> Result<Vec<Entry>> {
|
|
||||||
fetch_entries_paged(
|
|
||||||
pool,
|
|
||||||
PagedFetchArgs {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
tags,
|
|
||||||
query,
|
|
||||||
sort: "name",
|
|
||||||
limit,
|
|
||||||
offset: 0,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await
|
|
||||||
}
|
|
||||||
|
|
||||||
async fn fetch_entries_paged(pool: &PgPool, a: PagedFetchArgs<'_>) -> Result<Vec<Entry>> {
|
|
||||||
let mut conditions: Vec<String> = Vec::new();
|
|
||||||
let mut idx: i32 = 1;
|
|
||||||
|
|
||||||
if a.namespace.is_some() {
|
|
||||||
conditions.push(format!("namespace = ${}", idx));
|
|
||||||
idx += 1;
|
|
||||||
}
|
|
||||||
if a.kind.is_some() {
|
|
||||||
conditions.push(format!("kind = ${}", idx));
|
|
||||||
idx += 1;
|
|
||||||
}
|
|
||||||
if a.name.is_some() {
|
|
||||||
conditions.push(format!("name = ${}", idx));
|
|
||||||
idx += 1;
|
|
||||||
}
|
|
||||||
if !a.tags.is_empty() {
|
|
||||||
let placeholders: Vec<String> = a
|
|
||||||
.tags
|
|
||||||
.iter()
|
|
||||||
.map(|_| {
|
|
||||||
let p = format!("${}", idx);
|
|
||||||
idx += 1;
|
|
||||||
p
|
|
||||||
})
|
|
||||||
.collect();
|
|
||||||
conditions.push(format!("tags @> ARRAY[{}]", placeholders.join(", ")));
|
|
||||||
}
|
|
||||||
if a.query.is_some() {
|
|
||||||
conditions.push(format!(
|
|
||||||
"(name ILIKE ${i} ESCAPE '\\' OR namespace ILIKE ${i} ESCAPE '\\' OR kind ILIKE ${i} ESCAPE '\\' OR metadata::text ILIKE ${i} ESCAPE '\\' OR EXISTS (SELECT 1 FROM unnest(tags) t WHERE t ILIKE ${i} ESCAPE '\\'))",
|
|
||||||
i = idx
|
|
||||||
));
|
|
||||||
idx += 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
let where_clause = if conditions.is_empty() {
|
|
||||||
String::new()
|
|
||||||
} else {
|
|
||||||
format!("WHERE {}", conditions.join(" AND "))
|
|
||||||
};
|
|
||||||
|
|
||||||
let order = match a.sort {
|
|
||||||
"updated" => "updated_at DESC",
|
|
||||||
"created" => "created_at DESC",
|
|
||||||
_ => "namespace, kind, name",
|
|
||||||
};
|
|
||||||
|
|
||||||
let sql = format!(
|
|
||||||
"SELECT * FROM entries {} ORDER BY {} LIMIT ${} OFFSET ${}",
|
|
||||||
where_clause,
|
|
||||||
order,
|
|
||||||
idx,
|
|
||||||
idx + 1
|
|
||||||
);
|
|
||||||
|
|
||||||
tracing::debug!(sql, "executing search query");
|
|
||||||
|
|
||||||
let mut q = sqlx::query_as::<_, Entry>(&sql);
|
|
||||||
if let Some(v) = a.namespace {
|
|
||||||
q = q.bind(v);
|
|
||||||
}
|
|
||||||
if let Some(v) = a.kind {
|
|
||||||
q = q.bind(v);
|
|
||||||
}
|
|
||||||
if let Some(v) = a.name {
|
|
||||||
q = q.bind(v);
|
|
||||||
}
|
|
||||||
for v in a.tags {
|
|
||||||
q = q.bind(v.as_str());
|
|
||||||
}
|
|
||||||
if let Some(v) = a.query {
|
|
||||||
q = q.bind(format!(
|
|
||||||
"%{}%",
|
|
||||||
v.replace('\\', "\\\\")
|
|
||||||
.replace('%', "\\%")
|
|
||||||
.replace('_', "\\_")
|
|
||||||
));
|
|
||||||
}
|
|
||||||
q = q.bind(a.limit as i64).bind(a.offset as i64);
|
|
||||||
|
|
||||||
Ok(q.fetch_all(pool).await?)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Secret schema fetching (no master key) ───────────────────────────────────
|
|
||||||
|
|
||||||
/// Fetch secret field names for a set of entry ids.
|
|
||||||
/// Returns a map from entry_id to list of SecretField.
|
|
||||||
async fn fetch_secret_schemas(
|
|
||||||
pool: &PgPool,
|
|
||||||
entry_ids: &[uuid::Uuid],
|
|
||||||
) -> Result<HashMap<uuid::Uuid, Vec<SecretField>>> {
|
|
||||||
if entry_ids.is_empty() {
|
|
||||||
return Ok(HashMap::new());
|
|
||||||
}
|
|
||||||
|
|
||||||
let fields: Vec<SecretField> = sqlx::query_as(
|
|
||||||
"SELECT * FROM secrets WHERE entry_id = ANY($1) ORDER BY entry_id, field_name",
|
|
||||||
)
|
|
||||||
.bind(entry_ids)
|
|
||||||
.fetch_all(pool)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let mut map: HashMap<uuid::Uuid, Vec<SecretField>> = HashMap::new();
|
|
||||||
for f in fields {
|
|
||||||
map.entry(f.entry_id).or_default().push(f);
|
|
||||||
}
|
|
||||||
Ok(map)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Fetch all secret fields (including encrypted bytes) for a set of entry ids.
|
|
||||||
pub async fn fetch_secrets_for_entries(
|
|
||||||
pool: &PgPool,
|
|
||||||
entry_ids: &[uuid::Uuid],
|
|
||||||
) -> Result<HashMap<uuid::Uuid, Vec<SecretField>>> {
|
|
||||||
if entry_ids.is_empty() {
|
|
||||||
return Ok(HashMap::new());
|
|
||||||
}
|
|
||||||
|
|
||||||
let fields: Vec<SecretField> = sqlx::query_as(
|
|
||||||
"SELECT * FROM secrets WHERE entry_id = ANY($1) ORDER BY entry_id, field_name",
|
|
||||||
)
|
|
||||||
.bind(entry_ids)
|
|
||||||
.fetch_all(pool)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
let mut map: HashMap<uuid::Uuid, Vec<SecretField>> = HashMap::new();
|
|
||||||
for f in fields {
|
|
||||||
map.entry(f.entry_id).or_default().push(f);
|
|
||||||
}
|
|
||||||
Ok(map)
|
|
||||||
}
|
|
||||||
|
|
||||||
// ── Display helpers ───────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
fn env_prefix(entry: &Entry, prefix: &str) -> String {
|
|
||||||
let name_part = entry.name.to_uppercase().replace(['-', '.', ' '], "_");
|
|
||||||
if prefix.is_empty() {
|
|
||||||
name_part
|
|
||||||
} else {
|
|
||||||
format!(
|
|
||||||
"{}_{}",
|
|
||||||
prefix.to_uppercase().replace(['-', '.', ' '], "_"),
|
|
||||||
name_part
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Build a flat KEY=VALUE map from decrypted secret fields only.
|
|
||||||
/// Resolves key_ref: if metadata.key_ref is set, merges secret fields from that key entry.
|
|
||||||
pub async fn build_injected_env_map(
|
|
||||||
pool: &PgPool,
|
|
||||||
entry: &Entry,
|
|
||||||
prefix: &str,
|
|
||||||
master_key: &[u8; 32],
|
|
||||||
fields: &[&SecretField],
|
|
||||||
) -> Result<HashMap<String, String>> {
|
|
||||||
let effective_prefix = env_prefix(entry, prefix);
|
|
||||||
let mut map = HashMap::new();
|
|
||||||
|
|
||||||
// Decrypt each secret field and add to env map.
|
|
||||||
for f in fields {
|
|
||||||
let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
|
|
||||||
let key = format!(
|
|
||||||
"{}_{}",
|
|
||||||
effective_prefix,
|
|
||||||
f.field_name.to_uppercase().replace(['-', '.'], "_")
|
|
||||||
);
|
|
||||||
map.insert(key, json_value_to_env_string(&decrypted));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Resolve key_ref: merge secrets from the referenced key entry.
|
|
||||||
if let Some(key_ref) = entry.metadata.get("key_ref").and_then(|v| v.as_str()) {
|
|
||||||
let key_entries = fetch_entries(
|
|
||||||
pool,
|
|
||||||
Some(&entry.namespace),
|
|
||||||
Some("key"),
|
|
||||||
Some(key_ref),
|
|
||||||
&[],
|
|
||||||
None,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
|
|
||||||
if let Some(key_entry) = key_entries.first() {
|
|
||||||
let key_ids = vec![key_entry.id];
|
|
||||||
let key_fields_map = fetch_secrets_for_entries(pool, &key_ids).await?;
|
|
||||||
let empty = vec![];
|
|
||||||
let key_fields = key_fields_map.get(&key_entry.id).unwrap_or(&empty);
|
|
||||||
|
|
||||||
let key_prefix = env_prefix(key_entry, prefix);
|
|
||||||
for f in key_fields {
|
|
||||||
let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
|
|
||||||
let key_var = format!(
|
|
||||||
"{}_{}",
|
|
||||||
key_prefix,
|
|
||||||
f.field_name.to_uppercase().replace(['-', '.'], "_")
|
|
||||||
);
|
|
||||||
map.insert(key_var, json_value_to_env_string(&decrypted));
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
tracing::warn!(key_ref, "key_ref target not found");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(map)
|
|
||||||
}
|
|
||||||
|
|
||||||
fn json_value_to_env_string(v: &Value) -> String {
|
|
||||||
match v {
|
|
||||||
Value::String(s) => s.clone(),
|
|
||||||
Value::Null => String::new(),
|
|
||||||
other => other.to_string(),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn to_json(entry: &Entry, summary: bool, schema: Option<&[SecretField]>) -> Value {
|
|
||||||
if summary {
|
|
||||||
let desc = entry
|
|
||||||
.metadata
|
|
||||||
.get("desc")
|
|
||||||
.or_else(|| entry.metadata.get("url"))
|
|
||||||
.and_then(|v| v.as_str())
|
|
||||||
.unwrap_or("")
|
|
||||||
.to_string();
|
|
||||||
return json!({
|
|
||||||
"namespace": entry.namespace,
|
|
||||||
"kind": entry.kind,
|
|
||||||
"name": entry.name,
|
|
||||||
"tags": entry.tags,
|
|
||||||
"desc": desc,
|
|
||||||
"updated_at": entry.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
let secrets_val: Value = match schema {
|
|
||||||
Some(fields) if !fields.is_empty() => {
|
|
||||||
let schema_arr: Vec<Value> = fields
|
|
||||||
.iter()
|
|
||||||
.map(|f| {
|
|
||||||
json!({
|
|
||||||
"field_name": f.field_name,
|
|
||||||
})
|
|
||||||
})
|
|
||||||
.collect();
|
|
||||||
Value::Array(schema_arr)
|
|
||||||
}
|
|
||||||
_ => Value::Array(vec![]),
|
|
||||||
};
|
|
||||||
|
|
||||||
json!({
|
|
||||||
"id": entry.id,
|
|
||||||
"namespace": entry.namespace,
|
|
||||||
"kind": entry.kind,
|
|
||||||
"name": entry.name,
|
|
||||||
"tags": entry.tags,
|
|
||||||
"metadata": entry.metadata,
|
|
||||||
"secrets": secrets_val,
|
|
||||||
"version": entry.version,
|
|
||||||
"created_at": entry.created_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
|
||||||
"updated_at": entry.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
fn print_text(entry: &Entry, summary: bool, schema: Option<&[SecretField]>) -> Result<()> {
|
|
||||||
println!("[{}/{}] {}", entry.namespace, entry.kind, entry.name);
|
|
||||||
if summary {
|
|
||||||
let desc = entry
|
|
||||||
.metadata
|
|
||||||
.get("desc")
|
|
||||||
.or_else(|| entry.metadata.get("url"))
|
|
||||||
.and_then(|v| v.as_str())
|
|
||||||
.unwrap_or("-");
|
|
||||||
if !entry.tags.is_empty() {
|
|
||||||
println!(" tags: [{}]", entry.tags.join(", "));
|
|
||||||
}
|
|
||||||
println!(" desc: {}", desc);
|
|
||||||
println!(" updated: {}", format_local_time(entry.updated_at));
|
|
||||||
} else {
|
|
||||||
println!(" id: {}", entry.id);
|
|
||||||
if !entry.tags.is_empty() {
|
|
||||||
println!(" tags: [{}]", entry.tags.join(", "));
|
|
||||||
}
|
|
||||||
if entry.metadata.as_object().is_some_and(|m| !m.is_empty()) {
|
|
||||||
println!(
|
|
||||||
" metadata: {}",
|
|
||||||
serde_json::to_string_pretty(&entry.metadata)?
|
|
||||||
);
|
|
||||||
}
|
|
||||||
match schema {
|
|
||||||
Some(fields) if !fields.is_empty() => {
|
|
||||||
let schema_str: Vec<String> = fields.iter().map(|f| f.field_name.clone()).collect();
|
|
||||||
println!(" secrets: {}", schema_str.join(", "));
|
|
||||||
println!(" (use `secrets run` to get values)");
|
|
||||||
}
|
|
||||||
_ => {}
|
|
||||||
}
|
|
||||||
println!(" version: {}", entry.version);
|
|
||||||
println!(" created: {}", format_local_time(entry.created_at));
|
|
||||||
}
|
|
||||||
println!();
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Extract one or more metadata field paths like `metadata.url`.
|
|
||||||
fn print_fields(rows: &[Entry], fields: &[String]) -> Result<()> {
|
|
||||||
for row in rows {
|
|
||||||
for field in fields {
|
|
||||||
let val = extract_field(row, field)?;
|
|
||||||
println!("{}", val);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
fn extract_field(entry: &Entry, field: &str) -> Result<String> {
|
|
||||||
let (section, key) = field
|
|
||||||
.split_once('.')
|
|
||||||
.ok_or_else(|| anyhow::anyhow!("Invalid field path '{}'. Use metadata.<key>.", field))?;
|
|
||||||
|
|
||||||
let obj = match section {
|
|
||||||
"metadata" | "meta" => &entry.metadata,
|
|
||||||
other => anyhow::bail!("Unknown field section '{}'. Use 'metadata'.", other),
|
|
||||||
};
|
|
||||||
|
|
||||||
obj.get(key)
|
|
||||||
.and_then(|v| {
|
|
||||||
v.as_str()
|
|
||||||
.map(|s| s.to_string())
|
|
||||||
.or_else(|| Some(v.to_string()))
|
|
||||||
})
|
|
||||||
.ok_or_else(|| {
|
|
||||||
anyhow::anyhow!(
|
|
||||||
"Field '{}' not found in record [{}/{}/{}]",
|
|
||||||
field,
|
|
||||||
entry.namespace,
|
|
||||||
entry.kind,
|
|
||||||
entry.name
|
|
||||||
)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(test)]
|
|
||||||
mod tests {
|
|
||||||
use super::*;
|
|
||||||
use chrono::Utc;
|
|
||||||
use serde_json::json;
|
|
||||||
use uuid::Uuid;
|
|
||||||
|
|
||||||
fn sample_entry() -> Entry {
|
|
||||||
Entry {
|
|
||||||
id: Uuid::nil(),
|
|
||||||
namespace: "refining".to_string(),
|
|
||||||
kind: "service".to_string(),
|
|
||||||
name: "gitea.main".to_string(),
|
|
||||||
tags: vec!["prod".to_string()],
|
|
||||||
metadata: json!({"url": "https://code.example.com", "enabled": true}),
|
|
||||||
version: 1,
|
|
||||||
created_at: Utc::now(),
|
|
||||||
updated_at: Utc::now(),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
fn sample_fields() -> Vec<SecretField> {
|
|
||||||
let key = [0x42u8; 32];
|
|
||||||
let enc = crypto::encrypt_json(&key, &json!("abc123")).unwrap();
|
|
||||||
vec![SecretField {
|
|
||||||
id: Uuid::nil(),
|
|
||||||
entry_id: Uuid::nil(),
|
|
||||||
field_name: "token".to_string(),
|
|
||||||
encrypted: enc,
|
|
||||||
version: 1,
|
|
||||||
created_at: Utc::now(),
|
|
||||||
updated_at: Utc::now(),
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn rejects_secret_field_extraction() {
|
|
||||||
let fields = vec!["secret.token".to_string()];
|
|
||||||
let err = validate_safe_search_args(&fields).unwrap_err();
|
|
||||||
assert!(err.to_string().contains("sensitive"));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn to_json_full_includes_secrets_schema() {
|
|
||||||
let entry = sample_entry();
|
|
||||||
let fields = sample_fields();
|
|
||||||
let v = to_json(&entry, false, Some(&fields));
|
|
||||||
|
|
||||||
let secrets = v.get("secrets").unwrap().as_array().unwrap();
|
|
||||||
assert_eq!(secrets.len(), 1);
|
|
||||||
assert_eq!(secrets[0]["field_name"], "token");
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn to_json_summary_omits_secrets_schema() {
|
|
||||||
let entry = sample_entry();
|
|
||||||
let fields = sample_fields();
|
|
||||||
let v = to_json(&entry, true, Some(&fields));
|
|
||||||
assert!(v.get("secrets").is_none());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,411 +0,0 @@
|
|||||||
use anyhow::{Context, Result, bail};
|
|
||||||
use flate2::read::GzDecoder;
|
|
||||||
use serde::Deserialize;
|
|
||||||
use sha2::{Digest, Sha256};
|
|
||||||
use std::io::{Cursor, Read, Write};
|
|
||||||
use std::time::Duration;
|
|
||||||
|
|
||||||
const CURRENT_VERSION: &str = env!("CARGO_PKG_VERSION");
|
|
||||||
|
|
||||||
/// Build-time config via `option_env!("SECRETS_UPGRADE_URL")`. Set during `cargo build`, e.g.:
|
|
||||||
/// SECRETS_UPGRADE_URL=https://... cargo build --release
|
|
||||||
const BUILD_UPGRADE_URL: Option<&'static str> = option_env!("SECRETS_UPGRADE_URL");
|
|
||||||
|
|
||||||
fn upgrade_api_url() -> Result<String> {
|
|
||||||
if let Some(url) = BUILD_UPGRADE_URL.filter(|s| !s.trim().is_empty()) {
|
|
||||||
return Ok(url.to_string());
|
|
||||||
}
|
|
||||||
let url = std::env::var("SECRETS_UPGRADE_URL").context(
|
|
||||||
"SECRETS_UPGRADE_URL is not set at build or runtime. Set it when building: \
|
|
||||||
SECRETS_UPGRADE_URL=https://... cargo build, or export before running secrets upgrade.",
|
|
||||||
)?;
|
|
||||||
if url.trim().is_empty() {
|
|
||||||
anyhow::bail!("SECRETS_UPGRADE_URL is empty.");
|
|
||||||
}
|
|
||||||
Ok(url)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(Debug, Deserialize)]
|
|
||||||
struct Release {
|
|
||||||
tag_name: String,
|
|
||||||
assets: Vec<Asset>,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(Debug, Deserialize)]
|
|
||||||
struct Asset {
|
|
||||||
name: String,
|
|
||||||
browser_download_url: String,
|
|
||||||
}
|
|
||||||
|
|
||||||
fn available_assets(assets: &[Asset]) -> String {
|
|
||||||
assets
|
|
||||||
.iter()
|
|
||||||
.map(|a| a.name.as_str())
|
|
||||||
.collect::<Vec<_>>()
|
|
||||||
.join(", ")
|
|
||||||
}
|
|
||||||
|
|
||||||
fn release_asset_name(tag_name: &str, suffix: &str) -> String {
|
|
||||||
format!("secrets-{tag_name}-{suffix}")
|
|
||||||
}
|
|
||||||
|
|
||||||
fn find_asset_by_name<'a>(assets: &'a [Asset], name: &str) -> Result<&'a Asset> {
|
|
||||||
assets.iter().find(|a| a.name == name).with_context(|| {
|
|
||||||
format!(
|
|
||||||
"no matching release asset found: {name}\navailable: {}",
|
|
||||||
available_assets(assets)
|
|
||||||
)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Detect the asset suffix for the current platform/arch at compile time.
|
|
||||||
fn platform_asset_suffix() -> Result<&'static str> {
|
|
||||||
#[cfg(all(target_os = "linux", target_arch = "x86_64"))]
|
|
||||||
{
|
|
||||||
Ok("x86_64-linux-musl.tar.gz")
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(all(target_os = "macos", target_arch = "aarch64"))]
|
|
||||||
{
|
|
||||||
Ok("aarch64-macos.tar.gz")
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(all(target_os = "macos", target_arch = "x86_64"))]
|
|
||||||
{
|
|
||||||
Ok("x86_64-macos.tar.gz")
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(all(target_os = "windows", target_arch = "x86_64"))]
|
|
||||||
{
|
|
||||||
Ok("x86_64-windows.zip")
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(not(any(
|
|
||||||
all(target_os = "linux", target_arch = "x86_64"),
|
|
||||||
all(target_os = "macos", target_arch = "aarch64"),
|
|
||||||
all(target_os = "macos", target_arch = "x86_64"),
|
|
||||||
all(target_os = "windows", target_arch = "x86_64"),
|
|
||||||
)))]
|
|
||||||
bail!(
|
|
||||||
"Unsupported platform: {}/{}",
|
|
||||||
std::env::consts::OS,
|
|
||||||
std::env::consts::ARCH
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Strip the "secrets-" prefix from the tag and parse as semver.
|
|
||||||
fn parse_tag_version(tag: &str) -> Result<semver::Version> {
|
|
||||||
let ver_str = tag
|
|
||||||
.strip_prefix("secrets-")
|
|
||||||
.with_context(|| format!("unexpected tag format: {tag}"))?;
|
|
||||||
semver::Version::parse(ver_str)
|
|
||||||
.with_context(|| format!("failed to parse version from tag: {tag}"))
|
|
||||||
}
|
|
||||||
|
|
||||||
fn sha256_hex(bytes: &[u8]) -> String {
|
|
||||||
let digest = Sha256::digest(bytes);
|
|
||||||
format!("{digest:x}")
|
|
||||||
}
|
|
||||||
|
|
||||||
fn verify_checksum(asset_name: &str, archive: &[u8], checksum_contents: &str) -> Result<String> {
|
|
||||||
let expected_checksum = parse_checksum_file(checksum_contents)?;
|
|
||||||
let actual_checksum = sha256_hex(archive);
|
|
||||||
|
|
||||||
if actual_checksum != expected_checksum {
|
|
||||||
bail!(
|
|
||||||
"checksum verification failed for {}: expected {}, got {}",
|
|
||||||
asset_name,
|
|
||||||
expected_checksum,
|
|
||||||
actual_checksum
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(actual_checksum)
|
|
||||||
}
|
|
||||||
|
|
||||||
fn parse_checksum_file(contents: &str) -> Result<String> {
|
|
||||||
let checksum = contents
|
|
||||||
.split_whitespace()
|
|
||||||
.next()
|
|
||||||
.context("checksum file is empty")?
|
|
||||||
.trim()
|
|
||||||
.to_ascii_lowercase();
|
|
||||||
|
|
||||||
if checksum.len() != 64 || !checksum.bytes().all(|b| b.is_ascii_hexdigit()) {
|
|
||||||
bail!("invalid SHA-256 checksum format")
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(checksum)
|
|
||||||
}
|
|
||||||
|
|
||||||
async fn download_bytes(client: &reqwest::Client, url: &str, context: &str) -> Result<Vec<u8>> {
|
|
||||||
Ok(client
|
|
||||||
.get(url)
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.with_context(|| format!("{context}: request failed"))?
|
|
||||||
.error_for_status()
|
|
||||||
.with_context(|| format!("{context}: server returned an error"))?
|
|
||||||
.bytes()
|
|
||||||
.await
|
|
||||||
.with_context(|| format!("{context}: failed to read response body"))?
|
|
||||||
.to_vec())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Extract the binary from a tar.gz archive (first file whose name == "secrets").
|
|
||||||
fn extract_from_targz(bytes: &[u8]) -> Result<Vec<u8>> {
|
|
||||||
let gz = GzDecoder::new(Cursor::new(bytes));
|
|
||||||
let mut archive = tar::Archive::new(gz);
|
|
||||||
for entry in archive.entries().context("failed to read tar entries")? {
|
|
||||||
let mut entry = entry.context("bad tar entry")?;
|
|
||||||
let path = entry.path().context("bad tar entry path")?.into_owned();
|
|
||||||
let fname = path
|
|
||||||
.file_name()
|
|
||||||
.and_then(|n| n.to_str())
|
|
||||||
.unwrap_or_default();
|
|
||||||
if fname == "secrets" || fname == "secrets.exe" {
|
|
||||||
let mut buf = Vec::new();
|
|
||||||
entry.read_to_end(&mut buf).context("read tar entry")?;
|
|
||||||
return Ok(buf);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
bail!("binary not found inside tar.gz archive")
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Extract the binary from a zip archive (first file whose name matches).
|
|
||||||
#[cfg(target_os = "windows")]
|
|
||||||
fn extract_from_zip(bytes: &[u8]) -> Result<Vec<u8>> {
|
|
||||||
let reader = Cursor::new(bytes);
|
|
||||||
let mut archive = zip::ZipArchive::new(reader).context("failed to open zip archive")?;
|
|
||||||
for i in 0..archive.len() {
|
|
||||||
let mut file = archive.by_index(i).context("bad zip entry")?;
|
|
||||||
let fname = file.name().to_owned();
|
|
||||||
if fname.ends_with("secrets.exe") || fname.ends_with("secrets") {
|
|
||||||
let mut buf = Vec::new();
|
|
||||||
file.read_to_end(&mut buf).context("read zip entry")?;
|
|
||||||
return Ok(buf);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
bail!("binary not found inside zip archive")
|
|
||||||
}
|
|
||||||
|
|
||||||
pub async fn run(check_only: bool) -> Result<()> {
|
|
||||||
let current = semver::Version::parse(CURRENT_VERSION).context("invalid current version")?;
|
|
||||||
|
|
||||||
println!("Current version: v{current}");
|
|
||||||
println!("Checking for updates...");
|
|
||||||
|
|
||||||
let client = reqwest::Client::builder()
|
|
||||||
.user_agent(format!("secrets-cli/{CURRENT_VERSION}"))
|
|
||||||
.connect_timeout(Duration::from_secs(10))
|
|
||||||
.timeout(Duration::from_secs(120))
|
|
||||||
.build()
|
|
||||||
.context("failed to build HTTP client")?;
|
|
||||||
|
|
||||||
let api_url = upgrade_api_url()?;
|
|
||||||
let release: Release = client
|
|
||||||
.get(&api_url)
|
|
||||||
.send()
|
|
||||||
.await
|
|
||||||
.context("failed to fetch release info")?
|
|
||||||
.error_for_status()
|
|
||||||
.context("release API returned an error")?
|
|
||||||
.json()
|
|
||||||
.await
|
|
||||||
.context("failed to parse release JSON")?;
|
|
||||||
|
|
||||||
let latest = parse_tag_version(&release.tag_name)?;
|
|
||||||
|
|
||||||
if latest <= current {
|
|
||||||
println!("Already up to date (v{current})");
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
println!("New version available: v{latest}");
|
|
||||||
|
|
||||||
if check_only {
|
|
||||||
println!("Run `secrets upgrade` to update.");
|
|
||||||
return Ok(());
|
|
||||||
}
|
|
||||||
|
|
||||||
let suffix = platform_asset_suffix()?;
|
|
||||||
let asset_name = release_asset_name(&release.tag_name, suffix);
|
|
||||||
let asset = find_asset_by_name(&release.assets, &asset_name)?;
|
|
||||||
let checksum_name = format!("{}.sha256", asset.name);
|
|
||||||
let checksum_asset = find_asset_by_name(&release.assets, &checksum_name)?;
|
|
||||||
|
|
||||||
println!("Downloading {}...", asset.name);
|
|
||||||
|
|
||||||
let archive = download_bytes(&client, &asset.browser_download_url, "archive download").await?;
|
|
||||||
let checksum_contents = download_bytes(
|
|
||||||
&client,
|
|
||||||
&checksum_asset.browser_download_url,
|
|
||||||
"checksum download",
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
let actual_checksum = verify_checksum(
|
|
||||||
&asset.name,
|
|
||||||
&archive,
|
|
||||||
std::str::from_utf8(&checksum_contents).context("checksum file is not valid UTF-8")?,
|
|
||||||
)?;
|
|
||||||
|
|
||||||
println!("Verified SHA-256: {actual_checksum}");
|
|
||||||
|
|
||||||
println!("Extracting...");
|
|
||||||
|
|
||||||
let binary = if suffix.ends_with(".tar.gz") {
|
|
||||||
extract_from_targz(&archive)?
|
|
||||||
} else {
|
|
||||||
#[cfg(target_os = "windows")]
|
|
||||||
{
|
|
||||||
extract_from_zip(&archive)?
|
|
||||||
}
|
|
||||||
#[cfg(not(target_os = "windows"))]
|
|
||||||
bail!("zip extraction is only supported on Windows")
|
|
||||||
};
|
|
||||||
|
|
||||||
// Write to a temporary file, set executable permission, then atomically replace.
|
|
||||||
let mut tmp = tempfile::NamedTempFile::new().context("failed to create temp file")?;
|
|
||||||
tmp.write_all(&binary)
|
|
||||||
.context("failed to write temp binary")?;
|
|
||||||
|
|
||||||
#[cfg(unix)]
|
|
||||||
{
|
|
||||||
use std::os::unix::fs::PermissionsExt;
|
|
||||||
let perms = std::fs::Permissions::from_mode(0o755);
|
|
||||||
std::fs::set_permissions(tmp.path(), perms).context("failed to chmod temp binary")?;
|
|
||||||
}
|
|
||||||
|
|
||||||
self_replace::self_replace(tmp.path()).context("failed to replace current binary")?;
|
|
||||||
|
|
||||||
println!("Updated: v{current} → v{latest}");
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(test)]
|
|
||||||
mod tests {
|
|
||||||
use super::*;
|
|
||||||
use flate2::Compression;
|
|
||||||
use flate2::write::GzEncoder;
|
|
||||||
use tar::Builder;
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn parse_tag_version_accepts_release_tag() {
|
|
||||||
let version = parse_tag_version("secrets-0.6.1").expect("version should parse");
|
|
||||||
assert_eq!(version, semver::Version::new(0, 6, 1));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn parse_tag_version_rejects_invalid_tag() {
|
|
||||||
let err = parse_tag_version("v0.6.1").expect_err("tag should be rejected");
|
|
||||||
assert!(err.to_string().contains("unexpected tag format"));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn parse_checksum_file_accepts_sha256sum_format() {
|
|
||||||
let checksum = parse_checksum_file(
|
|
||||||
"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef secrets.tar.gz",
|
|
||||||
)
|
|
||||||
.expect("checksum should parse");
|
|
||||||
assert_eq!(
|
|
||||||
checksum,
|
|
||||||
"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn parse_checksum_file_rejects_invalid_checksum() {
|
|
||||||
let err = parse_checksum_file("not-a-sha256").expect_err("checksum should be rejected");
|
|
||||||
assert!(err.to_string().contains("invalid SHA-256 checksum format"));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn release_asset_name_matches_release_tag() {
|
|
||||||
assert_eq!(
|
|
||||||
release_asset_name("secrets-0.7.0", "x86_64-linux-musl.tar.gz"),
|
|
||||||
"secrets-secrets-0.7.0-x86_64-linux-musl.tar.gz"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn find_asset_by_name_rejects_stale_platform_match() {
|
|
||||||
let assets = vec![
|
|
||||||
Asset {
|
|
||||||
name: "secrets-secrets-0.6.9-x86_64-linux-musl.tar.gz".into(),
|
|
||||||
browser_download_url: "https://example.invalid/old".into(),
|
|
||||||
},
|
|
||||||
Asset {
|
|
||||||
name: "secrets-secrets-0.7.0-aarch64-macos.tar.gz".into(),
|
|
||||||
browser_download_url: "https://example.invalid/other".into(),
|
|
||||||
},
|
|
||||||
];
|
|
||||||
|
|
||||||
let err = find_asset_by_name(&assets, "secrets-secrets-0.7.0-x86_64-linux-musl.tar.gz")
|
|
||||||
.expect_err("stale asset should not match");
|
|
||||||
|
|
||||||
assert!(err.to_string().contains("no matching release asset found"));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn sha256_hex_matches_known_value() {
|
|
||||||
assert_eq!(
|
|
||||||
sha256_hex(b"abc"),
|
|
||||||
"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn verify_checksum_rejects_mismatch() {
|
|
||||||
let err = verify_checksum(
|
|
||||||
"secrets.tar.gz",
|
|
||||||
b"abc",
|
|
||||||
"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef secrets.tar.gz",
|
|
||||||
)
|
|
||||||
.expect_err("checksum mismatch should fail");
|
|
||||||
|
|
||||||
assert!(err.to_string().contains("checksum verification failed"));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn extract_from_targz_reads_binary() {
|
|
||||||
let payload = b"fake-secrets-binary";
|
|
||||||
let archive = make_test_targz("secrets", payload);
|
|
||||||
let extracted = extract_from_targz(&archive).expect("binary should extract");
|
|
||||||
assert_eq!(extracted, payload);
|
|
||||||
}
|
|
||||||
|
|
||||||
fn make_test_targz(name: &str, payload: &[u8]) -> Vec<u8> {
|
|
||||||
let encoder = GzEncoder::new(Vec::new(), Compression::default());
|
|
||||||
let mut builder = Builder::new(encoder);
|
|
||||||
|
|
||||||
let mut header = tar::Header::new_gnu();
|
|
||||||
header.set_mode(0o755);
|
|
||||||
header.set_size(payload.len() as u64);
|
|
||||||
header.set_cksum();
|
|
||||||
builder
|
|
||||||
.append_data(&mut header, name, payload)
|
|
||||||
.expect("append tar entry");
|
|
||||||
|
|
||||||
let encoder = builder.into_inner().expect("finish tar builder");
|
|
||||||
encoder.finish().expect("finish gzip")
|
|
||||||
}
|
|
||||||
|
|
||||||
#[cfg(target_os = "windows")]
|
|
||||||
#[test]
|
|
||||||
fn extract_from_zip_reads_binary() {
|
|
||||||
use zip::write::SimpleFileOptions;
|
|
||||||
|
|
||||||
let cursor = Cursor::new(Vec::<u8>::new());
|
|
||||||
let mut writer = zip::ZipWriter::new(cursor);
|
|
||||||
writer
|
|
||||||
.start_file("secrets.exe", SimpleFileOptions::default())
|
|
||||||
.expect("start zip file");
|
|
||||||
writer
|
|
||||||
.write_all(b"fake-secrets-binary")
|
|
||||||
.expect("write zip payload");
|
|
||||||
let bytes = writer.finish().expect("finish zip").into_inner();
|
|
||||||
|
|
||||||
let extracted = extract_from_zip(&bytes).expect("binary should extract");
|
|
||||||
assert_eq!(extracted, b"fake-secrets-binary");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
use anyhow::{Context, Result};
|
|
||||||
use serde::{Deserialize, Serialize};
|
|
||||||
use std::fs;
|
|
||||||
use std::path::PathBuf;
|
|
||||||
|
|
||||||
#[derive(Debug, Serialize, Deserialize, Default)]
|
|
||||||
pub struct Config {
|
|
||||||
pub database_url: Option<String>,
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn config_dir() -> Result<PathBuf> {
|
|
||||||
let dir = dirs::config_dir()
|
|
||||||
.or_else(|| dirs::home_dir().map(|h| h.join(".config")))
|
|
||||||
.context(
|
|
||||||
"Cannot determine config directory: \
|
|
||||||
neither XDG_CONFIG_HOME nor HOME is set",
|
|
||||||
)?
|
|
||||||
.join("secrets");
|
|
||||||
Ok(dir)
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn config_path() -> Result<PathBuf> {
|
|
||||||
Ok(config_dir()?.join("config.toml"))
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn load_config() -> Result<Config> {
|
|
||||||
let path = config_path()?;
|
|
||||||
if !path.exists() {
|
|
||||||
return Ok(Config::default());
|
|
||||||
}
|
|
||||||
let content = fs::read_to_string(&path)
|
|
||||||
.with_context(|| format!("failed to read config file: {}", path.display()))?;
|
|
||||||
let config: Config = toml::from_str(&content)
|
|
||||||
.with_context(|| format!("failed to parse config file: {}", path.display()))?;
|
|
||||||
Ok(config)
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn save_config(config: &Config) -> Result<()> {
|
|
||||||
let dir = config_dir()?;
|
|
||||||
fs::create_dir_all(&dir)
|
|
||||||
.with_context(|| format!("failed to create config dir: {}", dir.display()))?;
|
|
||||||
|
|
||||||
let path = dir.join("config.toml");
|
|
||||||
let content = toml::to_string_pretty(config).context("failed to serialize config")?;
|
|
||||||
fs::write(&path, &content)
|
|
||||||
.with_context(|| format!("failed to write config file: {}", path.display()))?;
|
|
||||||
|
|
||||||
// Set file permissions to 0600 (owner read/write only)
|
|
||||||
#[cfg(unix)]
|
|
||||||
{
|
|
||||||
use std::os::unix::fs::PermissionsExt;
|
|
||||||
let perms = fs::Permissions::from_mode(0o600);
|
|
||||||
fs::set_permissions(&path, perms)
|
|
||||||
.with_context(|| format!("failed to set file permissions: {}", path.display()))?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Resolve database URL by priority:
|
|
||||||
/// 1. --db-url CLI flag (if non-empty)
|
|
||||||
/// 2. database_url in ~/.config/secrets/config.toml
|
|
||||||
/// 3. Error with setup instructions
|
|
||||||
pub fn resolve_db_url(cli_db_url: &str) -> Result<String> {
|
|
||||||
if !cli_db_url.is_empty() {
|
|
||||||
return Ok(cli_db_url.to_string());
|
|
||||||
}
|
|
||||||
|
|
||||||
let config = load_config()?;
|
|
||||||
if let Some(url) = config.database_url
|
|
||||||
&& !url.is_empty()
|
|
||||||
{
|
|
||||||
return Ok(url);
|
|
||||||
}
|
|
||||||
|
|
||||||
anyhow::bail!("Database not configured. Run:\n\n secrets config set-db <DATABASE_URL>\n")
|
|
||||||
}
|
|
||||||
853
src/main.rs
853
src/main.rs
@@ -1,853 +0,0 @@
|
|||||||
mod audit;
|
|
||||||
mod commands;
|
|
||||||
mod config;
|
|
||||||
mod crypto;
|
|
||||||
mod db;
|
|
||||||
mod models;
|
|
||||||
mod output;
|
|
||||||
|
|
||||||
use anyhow::Result;
|
|
||||||
|
|
||||||
/// Load .env from current or parent directories (best-effort, no error if missing).
|
|
||||||
fn load_dotenv() {
|
|
||||||
let _ = dotenvy::dotenv();
|
|
||||||
}
|
|
||||||
use clap::{Parser, Subcommand};
|
|
||||||
use tracing_subscriber::EnvFilter;
|
|
||||||
|
|
||||||
use output::resolve_output_mode;
|
|
||||||
|
|
||||||
#[derive(Parser)]
|
|
||||||
#[command(
|
|
||||||
name = "secrets",
|
|
||||||
version,
|
|
||||||
about = "Secrets & config manager backed by PostgreSQL — optimised for AI agents",
|
|
||||||
after_help = "QUICK START:
|
|
||||||
# 1. Configure database (once per device)
|
|
||||||
secrets config set-db \"postgres://postgres:<password>@<host>:<port>/secrets\"
|
|
||||||
|
|
||||||
# 2. Initialize master key (once per device)
|
|
||||||
secrets init
|
|
||||||
|
|
||||||
# Discover what namespaces / kinds exist
|
|
||||||
secrets search --summary --limit 20
|
|
||||||
|
|
||||||
# Precise lookup (JSON output for easy parsing)
|
|
||||||
secrets search -n refining --kind service --name gitea -o json
|
|
||||||
|
|
||||||
# Extract a single metadata field directly
|
|
||||||
secrets search -n refining --kind service --name gitea -f metadata.url
|
|
||||||
|
|
||||||
# Pipe-friendly (non-TTY defaults to json-compact automatically)
|
|
||||||
secrets search -n refining --kind service | jq '.[].name'
|
|
||||||
|
|
||||||
# Run a command with secrets injected into its child process environment
|
|
||||||
secrets run -n refining --kind service --name gitea -- printenv"
|
|
||||||
)]
|
|
||||||
struct Cli {
|
|
||||||
/// Database URL, overrides saved config (one-time override)
|
|
||||||
#[arg(long, global = true, default_value = "")]
|
|
||||||
db_url: String,
|
|
||||||
|
|
||||||
/// Enable verbose debug output
|
|
||||||
#[arg(long, short, global = true)]
|
|
||||||
verbose: bool,
|
|
||||||
|
|
||||||
#[command(subcommand)]
|
|
||||||
command: Commands,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(Subcommand)]
|
|
||||||
enum Commands {
|
|
||||||
/// Initialize master key on this device (run once per device).
|
|
||||||
///
|
|
||||||
/// Prompts for a master password, derives a key with Argon2id, and stores
|
|
||||||
/// it in the OS Keychain. Use the same password on every device.
|
|
||||||
///
|
|
||||||
/// NOTE: Run `secrets config set-db <URL>` first if database is not configured.
|
|
||||||
#[command(after_help = "PREREQUISITE:
|
|
||||||
Database must be configured first. Run: secrets config set-db <DATABASE_URL>
|
|
||||||
|
|
||||||
EXAMPLES:
|
|
||||||
# First device: generates a new Argon2id salt and stores master key
|
|
||||||
secrets init
|
|
||||||
|
|
||||||
# Subsequent devices: reuses existing salt from the database
|
|
||||||
secrets init")]
|
|
||||||
Init,
|
|
||||||
|
|
||||||
/// Add or update a record (upsert). Use -m for plaintext metadata, -s for secrets.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Add a server
|
|
||||||
secrets add -n refining --kind server --name my-server \\
|
|
||||||
--tag aliyun --tag shanghai \\
|
|
||||||
-m ip=10.0.0.1 -m desc=\"Example ECS\" \\
|
|
||||||
-s username=root -s ssh_key=@./keys/server.pem
|
|
||||||
|
|
||||||
# Add a service credential
|
|
||||||
secrets add -n refining --kind service --name gitea \\
|
|
||||||
--tag gitea \\
|
|
||||||
-m url=https://code.example.com -m default_org=myorg \\
|
|
||||||
-s token=<token>
|
|
||||||
|
|
||||||
# Add typed JSON metadata
|
|
||||||
secrets add -n refining --kind service --name gitea \\
|
|
||||||
-m port:=3000 \\
|
|
||||||
-m enabled:=true \\
|
|
||||||
-m domains:='[\"code.example.com\",\"git.example.com\"]' \\
|
|
||||||
-m tls:='{\"enabled\":true,\"redirect_http\":true}'
|
|
||||||
|
|
||||||
# Add with token read from a file
|
|
||||||
secrets add -n ricnsmart --kind service --name mqtt \\
|
|
||||||
-m host=mqtt.example.com -m port=1883 \\
|
|
||||||
-s password=@./mqtt_password.txt
|
|
||||||
|
|
||||||
# Add typed JSON secrets
|
|
||||||
secrets add -n refining --kind service --name deploy-bot \\
|
|
||||||
-s enabled:=true \\
|
|
||||||
-s retry_count:=3 \\
|
|
||||||
-s scopes:='[\"repo\",\"workflow\"]' \\
|
|
||||||
-s extra:='{\"region\":\"ap-east-1\",\"verify_tls\":true}'
|
|
||||||
|
|
||||||
# Write a multiline file into a nested secret field
|
|
||||||
secrets add -n refining --kind server --name my-server \\
|
|
||||||
-s credentials:content@./keys/server.pem
|
|
||||||
|
|
||||||
# Shared PEM (key_ref): store key once, reference from multiple servers
|
|
||||||
secrets add -n refining --kind key --name my-shared-key \\
|
|
||||||
--tag aliyun -s content=@./keys/shared.pem
|
|
||||||
secrets add -n refining --kind server --name i-abc123 \\
|
|
||||||
-m ip=10.0.0.1 -m key_ref=my-shared-key -s username=ecs-user")]
|
|
||||||
Add {
|
|
||||||
/// Namespace, e.g. refining, ricnsmart
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: String,
|
|
||||||
/// Kind of record: server, service, key, ...
|
|
||||||
#[arg(long)]
|
|
||||||
kind: String,
|
|
||||||
/// Human-readable unique name, e.g. gitea, i-example0abcd1234efgh
|
|
||||||
#[arg(long)]
|
|
||||||
name: String,
|
|
||||||
/// Tag for categorization (repeatable), e.g. --tag aliyun --tag hongkong
|
|
||||||
#[arg(long = "tag")]
|
|
||||||
tags: Vec<String>,
|
|
||||||
/// Plaintext metadata: key=value, key:=<json>, key=@file, or nested:path@file.
|
|
||||||
/// Use key_ref=<name> to reference a shared key entry (kind=key); run merges its secrets.
|
|
||||||
#[arg(long = "meta", short = 'm')]
|
|
||||||
meta: Vec<String>,
|
|
||||||
/// Secret entry: key=value, key:=<json>, key=@file, or nested:path@file
|
|
||||||
#[arg(long = "secret", short = 's')]
|
|
||||||
secrets: Vec<String>,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Search / read records. This is the primary read command for AI agents.
|
|
||||||
///
|
|
||||||
/// Supports fuzzy search (-q), exact lookup (--name), field extraction (-f),
|
|
||||||
/// summary view (--summary), pagination (--limit / --offset), and structured
|
|
||||||
/// output (-o json / json-compact). When stdout is not a TTY, output
|
|
||||||
/// defaults to json-compact automatically.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Discover all records (summary, safe default limit)
|
|
||||||
secrets search --summary --limit 20
|
|
||||||
|
|
||||||
# Filter by namespace and kind
|
|
||||||
secrets search -n refining --kind service
|
|
||||||
|
|
||||||
# Exact lookup — returns 0 or 1 record
|
|
||||||
secrets search -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# Fuzzy keyword search (matches name, namespace, kind, tags, metadata)
|
|
||||||
secrets search -q mqtt
|
|
||||||
|
|
||||||
# Extract a single metadata field value
|
|
||||||
secrets search -n refining --kind service --name gitea -f metadata.url
|
|
||||||
|
|
||||||
# Multiple fields at once
|
|
||||||
secrets search -n refining --kind service --name gitea \\
|
|
||||||
-f metadata.url -f metadata.default_org
|
|
||||||
|
|
||||||
# Run a command with decrypted secrets only when needed
|
|
||||||
secrets run -n refining --kind service --name gitea -- printenv
|
|
||||||
|
|
||||||
# Paginate large result sets
|
|
||||||
secrets search -n refining --summary --limit 10 --offset 0
|
|
||||||
secrets search -n refining --summary --limit 10 --offset 10
|
|
||||||
|
|
||||||
# Sort by most recently updated
|
|
||||||
secrets search --sort updated --limit 5 --summary
|
|
||||||
|
|
||||||
# Non-TTY / pipe: output is json-compact by default
|
|
||||||
secrets search -n refining --kind service | jq '.[].name'")]
|
|
||||||
Search {
|
|
||||||
/// Filter by namespace, e.g. refining, ricnsmart
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: Option<String>,
|
|
||||||
/// Filter by kind, e.g. server, service
|
|
||||||
#[arg(long)]
|
|
||||||
kind: Option<String>,
|
|
||||||
/// Exact name filter, e.g. gitea, i-example0abcd1234efgh
|
|
||||||
#[arg(long)]
|
|
||||||
name: Option<String>,
|
|
||||||
/// Filter by tag, e.g. --tag aliyun (repeatable for AND intersection)
|
|
||||||
#[arg(long)]
|
|
||||||
tag: Vec<String>,
|
|
||||||
/// Fuzzy keyword (matches name, namespace, kind, tags, metadata text)
|
|
||||||
#[arg(short, long)]
|
|
||||||
query: Option<String>,
|
|
||||||
/// Extract metadata field value(s) directly: metadata.<key> (repeatable)
|
|
||||||
#[arg(short = 'f', long = "field")]
|
|
||||||
fields: Vec<String>,
|
|
||||||
/// Return lightweight summary only (namespace, kind, name, tags, desc, updated_at)
|
|
||||||
#[arg(long)]
|
|
||||||
summary: bool,
|
|
||||||
/// Maximum number of records to return [default: 50]
|
|
||||||
#[arg(long, default_value = "50")]
|
|
||||||
limit: u32,
|
|
||||||
/// Skip this many records (for pagination)
|
|
||||||
#[arg(long, default_value = "0")]
|
|
||||||
offset: u32,
|
|
||||||
/// Sort order: name (default), updated, created
|
|
||||||
#[arg(long, default_value = "name")]
|
|
||||||
sort: String,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Delete one record precisely, or bulk-delete by namespace.
|
|
||||||
///
|
|
||||||
/// With --name: deletes exactly that record (--kind also required).
|
|
||||||
/// Without --name: bulk-deletes all records matching namespace + optional --kind.
|
|
||||||
/// Use --dry-run to preview bulk deletes before committing.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Delete a single record (exact match)
|
|
||||||
secrets delete -n refining --kind service --name legacy-mqtt
|
|
||||||
|
|
||||||
# Preview what a bulk delete would remove (no writes)
|
|
||||||
secrets delete -n refining --dry-run
|
|
||||||
|
|
||||||
# Bulk-delete all records in a namespace
|
|
||||||
secrets delete -n ricnsmart
|
|
||||||
|
|
||||||
# Bulk-delete only server records in a namespace
|
|
||||||
secrets delete -n ricnsmart --kind server
|
|
||||||
|
|
||||||
# JSON output
|
|
||||||
secrets delete -n refining --kind service -o json")]
|
|
||||||
Delete {
|
|
||||||
/// Namespace, e.g. refining
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: String,
|
|
||||||
/// Kind filter, e.g. server, service (required with --name; optional for bulk)
|
|
||||||
#[arg(long)]
|
|
||||||
kind: Option<String>,
|
|
||||||
/// Exact name of the record to delete (omit for bulk delete)
|
|
||||||
#[arg(long)]
|
|
||||||
name: Option<String>,
|
|
||||||
/// Preview what would be deleted without making any changes (bulk mode only)
|
|
||||||
#[arg(long)]
|
|
||||||
dry_run: bool,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Incrementally update an existing record (merge semantics; record must exist).
|
|
||||||
///
|
|
||||||
/// Only the fields you pass are changed — everything else is preserved.
|
|
||||||
/// Use --add-tag / --remove-tag to modify tags without touching other fields.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Update a single metadata field (all other fields unchanged)
|
|
||||||
secrets update -n refining --kind server --name my-server -m ip=10.0.0.1
|
|
||||||
|
|
||||||
# Rotate a secret token
|
|
||||||
secrets update -n refining --kind service --name gitea -s token=<new-token>
|
|
||||||
|
|
||||||
# Update typed JSON metadata
|
|
||||||
secrets update -n refining --kind service --name gitea \\
|
|
||||||
-m deploy:strategy:='{\"type\":\"rolling\",\"batch\":2}' \\
|
|
||||||
-m runtime:max_open_conns:=20
|
|
||||||
|
|
||||||
# Add a tag and rotate password at the same time
|
|
||||||
secrets update -n refining --kind service --name gitea \\
|
|
||||||
--add-tag production -s token=<new-token>
|
|
||||||
|
|
||||||
# Remove a deprecated metadata field and a stale secret key
|
|
||||||
secrets update -n refining --kind service --name mqtt \\
|
|
||||||
--remove-meta old_port --remove-secret old_password
|
|
||||||
|
|
||||||
# Remove a nested field
|
|
||||||
secrets update -n refining --kind server --name my-server \\
|
|
||||||
--remove-secret credentials:content
|
|
||||||
|
|
||||||
# Remove a tag
|
|
||||||
secrets update -n refining --kind service --name gitea --remove-tag staging
|
|
||||||
|
|
||||||
# Update a nested secret field from a file
|
|
||||||
secrets update -n refining --kind server --name my-server \\
|
|
||||||
-s credentials:content@./keys/server.pem
|
|
||||||
|
|
||||||
# Update nested typed JSON fields
|
|
||||||
secrets update -n refining --kind service --name deploy-bot \\
|
|
||||||
-s auth:config:='{\"issuer\":\"gitea\",\"rotate\":true}' \\
|
|
||||||
-s auth:retry:=5
|
|
||||||
|
|
||||||
# Rotate shared PEM (all servers with key_ref=my-shared-key get the new key)
|
|
||||||
secrets update -n refining --kind key --name my-shared-key \\
|
|
||||||
-s content=@./keys/new-shared.pem")]
|
|
||||||
Update {
|
|
||||||
/// Namespace, e.g. refining, ricnsmart
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: String,
|
|
||||||
/// Kind of record: server, service, key, ...
|
|
||||||
#[arg(long)]
|
|
||||||
kind: String,
|
|
||||||
/// Human-readable unique name
|
|
||||||
#[arg(long)]
|
|
||||||
name: String,
|
|
||||||
/// Add a tag (repeatable; does not affect existing tags)
|
|
||||||
#[arg(long = "add-tag")]
|
|
||||||
add_tags: Vec<String>,
|
|
||||||
/// Remove a tag (repeatable)
|
|
||||||
#[arg(long = "remove-tag")]
|
|
||||||
remove_tags: Vec<String>,
|
|
||||||
/// Set or overwrite a metadata field: key=value, key:=<json>, key=@file, or nested:path@file.
|
|
||||||
/// Use key_ref=<name> to reference a shared key entry (kind=key).
|
|
||||||
#[arg(long = "meta", short = 'm')]
|
|
||||||
meta: Vec<String>,
|
|
||||||
/// Delete a metadata field by key or nested path, e.g. old_port or credentials:content
|
|
||||||
#[arg(long = "remove-meta")]
|
|
||||||
remove_meta: Vec<String>,
|
|
||||||
/// Set or overwrite a secret field: key=value, key:=<json>, key=@file, or nested:path@file
|
|
||||||
#[arg(long = "secret", short = 's')]
|
|
||||||
secrets: Vec<String>,
|
|
||||||
/// Delete a secret field by key or nested path, e.g. old_password or credentials:content
|
|
||||||
#[arg(long = "remove-secret")]
|
|
||||||
remove_secrets: Vec<String>,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Manage CLI configuration (database connection, etc.)
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Configure the database URL (run once per device; persisted to config file)
|
|
||||||
secrets config set-db \"postgres://postgres:<password>@<host>:<port>/secrets\"
|
|
||||||
|
|
||||||
# Show current config (password is masked)
|
|
||||||
secrets config show
|
|
||||||
|
|
||||||
# Print path to the config file
|
|
||||||
secrets config path")]
|
|
||||||
Config {
|
|
||||||
#[command(subcommand)]
|
|
||||||
action: ConfigAction,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Show the change history for a record.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Show last 20 versions for a service record
|
|
||||||
secrets history -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# Show last 5 versions
|
|
||||||
secrets history -n refining --kind service --name gitea --limit 5")]
|
|
||||||
History {
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: String,
|
|
||||||
#[arg(long)]
|
|
||||||
kind: String,
|
|
||||||
#[arg(long)]
|
|
||||||
name: String,
|
|
||||||
/// Number of history entries to show [default: 20]
|
|
||||||
#[arg(long, default_value = "20")]
|
|
||||||
limit: u32,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Roll back a record to a previous version.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Roll back to the most recent snapshot (undo last change)
|
|
||||||
secrets rollback -n refining --kind service --name gitea
|
|
||||||
|
|
||||||
# Roll back to a specific version number
|
|
||||||
secrets rollback -n refining --kind service --name gitea --to-version 3")]
|
|
||||||
Rollback {
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: String,
|
|
||||||
#[arg(long)]
|
|
||||||
kind: String,
|
|
||||||
#[arg(long)]
|
|
||||||
name: String,
|
|
||||||
/// Target version to restore. Omit to restore the most recent snapshot.
|
|
||||||
#[arg(long)]
|
|
||||||
to_version: Option<i64>,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Run a command with secrets injected as environment variables.
|
|
||||||
///
|
|
||||||
/// Secrets are available only to the child process; the current shell
|
|
||||||
/// environment is not modified. The process exit code is propagated.
|
|
||||||
///
|
|
||||||
/// Use -s/--secret to inject only specific fields. Use --dry-run to preview
|
|
||||||
/// which variables would be injected without executing the command.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Run a script with a single service's secrets injected
|
|
||||||
secrets run -n refining --kind service --name gitea -- ./deploy.sh
|
|
||||||
|
|
||||||
# Inject only specific fields (minimal exposure)
|
|
||||||
secrets run -n refining --kind service --name aliyun \\
|
|
||||||
-s access_key_id -s access_key_secret -- aliyun ecs DescribeInstances
|
|
||||||
|
|
||||||
# Run with a tag filter (all matched records merged)
|
|
||||||
secrets run --tag production -- env | grep GITEA
|
|
||||||
|
|
||||||
# With prefix
|
|
||||||
secrets run -n refining --kind service --name gitea --prefix GITEA -- printenv
|
|
||||||
|
|
||||||
# Preview which variables would be injected (no command executed)
|
|
||||||
secrets run -n refining --kind service --name gitea --dry-run
|
|
||||||
|
|
||||||
# Preview with field filter and JSON output
|
|
||||||
secrets run -n refining --kind service --name gitea -s token --dry-run -o json
|
|
||||||
|
|
||||||
# metadata.key_ref entries get key secrets merged (e.g. server + shared PEM)")]
|
|
||||||
Run {
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: Option<String>,
|
|
||||||
#[arg(long)]
|
|
||||||
kind: Option<String>,
|
|
||||||
#[arg(long)]
|
|
||||||
name: Option<String>,
|
|
||||||
#[arg(long)]
|
|
||||||
tag: Vec<String>,
|
|
||||||
/// Only inject these secret field names (repeatable). Omit to inject all fields.
|
|
||||||
#[arg(long = "secret", short = 's')]
|
|
||||||
secret_fields: Vec<String>,
|
|
||||||
/// Prefix to prepend to every variable name (uppercased automatically)
|
|
||||||
#[arg(long, default_value = "")]
|
|
||||||
prefix: String,
|
|
||||||
/// Preview variables that would be injected without executing the command
|
|
||||||
#[arg(long)]
|
|
||||||
dry_run: bool,
|
|
||||||
/// Output format for --dry-run: json (default), json-compact, text
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
/// Command and arguments to execute with injected environment
|
|
||||||
#[arg(last = true)]
|
|
||||||
command: Vec<String>,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Check for a newer version and update the binary in-place.
|
|
||||||
///
|
|
||||||
/// Downloads the latest release and replaces the current binary. No database connection or master key required.
|
|
||||||
/// Release URL defaults to the upstream server; override via SECRETS_UPGRADE_URL for self-hosted or fork.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Check for updates only (no download)
|
|
||||||
secrets upgrade --check
|
|
||||||
|
|
||||||
# Download and install the latest version
|
|
||||||
secrets upgrade")]
|
|
||||||
Upgrade {
|
|
||||||
/// Only check if a newer version is available; do not download
|
|
||||||
#[arg(long)]
|
|
||||||
check: bool,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Export records to a file (JSON, TOML, or YAML).
|
|
||||||
///
|
|
||||||
/// Decrypts and exports all matched records. Requires master key unless --no-secrets is used.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Export everything to JSON
|
|
||||||
secrets export --file backup.json
|
|
||||||
|
|
||||||
# Export a specific namespace to TOML
|
|
||||||
secrets export -n refining --file refining.toml
|
|
||||||
|
|
||||||
# Export a specific kind
|
|
||||||
secrets export -n refining --kind service --file services.yaml
|
|
||||||
|
|
||||||
# Export by tag
|
|
||||||
secrets export --tag production --file prod.json
|
|
||||||
|
|
||||||
# Export schema only (no decryption needed)
|
|
||||||
secrets export --no-secrets --file schema.json
|
|
||||||
|
|
||||||
# Print to stdout in YAML
|
|
||||||
secrets export -n refining --format yaml")]
|
|
||||||
Export {
|
|
||||||
/// Filter by namespace
|
|
||||||
#[arg(short, long)]
|
|
||||||
namespace: Option<String>,
|
|
||||||
/// Filter by kind, e.g. server, service
|
|
||||||
#[arg(long)]
|
|
||||||
kind: Option<String>,
|
|
||||||
/// Exact name filter
|
|
||||||
#[arg(long)]
|
|
||||||
name: Option<String>,
|
|
||||||
/// Filter by tag (repeatable)
|
|
||||||
#[arg(long)]
|
|
||||||
tag: Vec<String>,
|
|
||||||
/// Fuzzy keyword search
|
|
||||||
#[arg(short, long)]
|
|
||||||
query: Option<String>,
|
|
||||||
/// Output file path (format inferred from extension: .json / .toml / .yaml / .yml)
|
|
||||||
#[arg(long)]
|
|
||||||
file: Option<String>,
|
|
||||||
/// Explicit format: json, toml, or yaml (overrides file extension; required for stdout)
|
|
||||||
#[arg(long)]
|
|
||||||
format: Option<String>,
|
|
||||||
/// Omit secrets from output (no master key required)
|
|
||||||
#[arg(long)]
|
|
||||||
no_secrets: bool,
|
|
||||||
},
|
|
||||||
|
|
||||||
/// Import records from a file (JSON, TOML, or YAML).
|
|
||||||
///
|
|
||||||
/// Reads an export file and inserts or updates entries. Requires master key to re-encrypt secrets.
|
|
||||||
#[command(after_help = "EXAMPLES:
|
|
||||||
# Import a JSON backup (conflict = error by default)
|
|
||||||
secrets import backup.json
|
|
||||||
|
|
||||||
# Import and overwrite existing records
|
|
||||||
secrets import --force refining.toml
|
|
||||||
|
|
||||||
# Preview what would be imported (no writes)
|
|
||||||
secrets import --dry-run backup.yaml
|
|
||||||
|
|
||||||
# JSON output for the import summary
|
|
||||||
secrets import backup.json -o json")]
|
|
||||||
Import {
|
|
||||||
/// Input file path (format inferred from extension: .json / .toml / .yaml / .yml)
|
|
||||||
file: String,
|
|
||||||
/// Overwrite existing records on conflict (default: error and abort)
|
|
||||||
#[arg(long)]
|
|
||||||
force: bool,
|
|
||||||
/// Preview operations without writing to the database
|
|
||||||
#[arg(long)]
|
|
||||||
dry_run: bool,
|
|
||||||
/// Output format: text (default on TTY), json, json-compact
|
|
||||||
#[arg(short, long = "output")]
|
|
||||||
output: Option<String>,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
#[derive(Subcommand)]
|
|
||||||
enum ConfigAction {
|
|
||||||
/// Save database URL to config file (~/.config/secrets/config.toml)
|
|
||||||
SetDb {
|
|
||||||
/// PostgreSQL connection string, e.g. postgres://user:pass@<host>:<port>/dbname
|
|
||||||
url: String,
|
|
||||||
},
|
|
||||||
/// Show current configuration (password masked)
|
|
||||||
Show,
|
|
||||||
/// Print path to the config file
|
|
||||||
Path,
|
|
||||||
}
|
|
||||||
|
|
||||||
#[tokio::main]
|
|
||||||
async fn main() -> Result<()> {
|
|
||||||
load_dotenv();
|
|
||||||
let cli = Cli::parse();
|
|
||||||
|
|
||||||
let filter = if cli.verbose {
|
|
||||||
EnvFilter::new("secrets=debug")
|
|
||||||
} else {
|
|
||||||
EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new("secrets=warn"))
|
|
||||||
};
|
|
||||||
tracing_subscriber::fmt()
|
|
||||||
.with_env_filter(filter)
|
|
||||||
.with_target(false)
|
|
||||||
.init();
|
|
||||||
|
|
||||||
// config subcommand needs no database or master key
|
|
||||||
if let Commands::Config { action } = cli.command {
|
|
||||||
return commands::config::run(action).await;
|
|
||||||
}
|
|
||||||
|
|
||||||
// upgrade needs no database or master key either
|
|
||||||
if let Commands::Upgrade { check } = cli.command {
|
|
||||||
return commands::upgrade::run(check).await;
|
|
||||||
}
|
|
||||||
|
|
||||||
let db_url = config::resolve_db_url(&cli.db_url)?;
|
|
||||||
let pool = db::create_pool(&db_url).await?;
|
|
||||||
db::migrate(&pool).await?;
|
|
||||||
|
|
||||||
// init needs a pool but sets up the master key — handle before loading it
|
|
||||||
if let Commands::Init = cli.command {
|
|
||||||
return commands::init::run(&pool).await;
|
|
||||||
}
|
|
||||||
|
|
||||||
// All remaining commands require the master key from the OS Keychain,
|
|
||||||
// except delete which operates on plaintext metadata only.
|
|
||||||
|
|
||||||
match cli.command {
|
|
||||||
Commands::Init | Commands::Config { .. } | Commands::Upgrade { .. } => unreachable!(),
|
|
||||||
|
|
||||||
Commands::Add {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
tags,
|
|
||||||
meta,
|
|
||||||
secrets,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let master_key = crypto::load_master_key()?;
|
|
||||||
let _span =
|
|
||||||
tracing::info_span!("cmd", command = "add", %namespace, %kind, %name).entered();
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::add::run(
|
|
||||||
&pool,
|
|
||||||
commands::add::AddArgs {
|
|
||||||
namespace: &namespace,
|
|
||||||
kind: &kind,
|
|
||||||
name: &name,
|
|
||||||
tags: &tags,
|
|
||||||
meta_entries: &meta,
|
|
||||||
secret_entries: &secrets,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
&master_key,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Search {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
tag,
|
|
||||||
query,
|
|
||||||
fields,
|
|
||||||
summary,
|
|
||||||
limit,
|
|
||||||
offset,
|
|
||||||
sort,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let _span = tracing::info_span!("cmd", command = "search").entered();
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::search::run(
|
|
||||||
&pool,
|
|
||||||
commands::search::SearchArgs {
|
|
||||||
namespace: namespace.as_deref(),
|
|
||||||
kind: kind.as_deref(),
|
|
||||||
name: name.as_deref(),
|
|
||||||
tags: &tag,
|
|
||||||
query: query.as_deref(),
|
|
||||||
fields: &fields,
|
|
||||||
summary,
|
|
||||||
limit,
|
|
||||||
offset,
|
|
||||||
sort: &sort,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Delete {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
dry_run,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let _span =
|
|
||||||
tracing::info_span!("cmd", command = "delete", %namespace, ?kind, ?name).entered();
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::delete::run(
|
|
||||||
&pool,
|
|
||||||
commands::delete::DeleteArgs {
|
|
||||||
namespace: &namespace,
|
|
||||||
kind: kind.as_deref(),
|
|
||||||
name: name.as_deref(),
|
|
||||||
dry_run,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Update {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
add_tags,
|
|
||||||
remove_tags,
|
|
||||||
meta,
|
|
||||||
remove_meta,
|
|
||||||
secrets,
|
|
||||||
remove_secrets,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let master_key = crypto::load_master_key()?;
|
|
||||||
let _span =
|
|
||||||
tracing::info_span!("cmd", command = "update", %namespace, %kind, %name).entered();
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::update::run(
|
|
||||||
&pool,
|
|
||||||
commands::update::UpdateArgs {
|
|
||||||
namespace: &namespace,
|
|
||||||
kind: &kind,
|
|
||||||
name: &name,
|
|
||||||
add_tags: &add_tags,
|
|
||||||
remove_tags: &remove_tags,
|
|
||||||
meta_entries: &meta,
|
|
||||||
remove_meta: &remove_meta,
|
|
||||||
secret_entries: &secrets,
|
|
||||||
remove_secrets: &remove_secrets,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
&master_key,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::History {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
limit,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::history::run(
|
|
||||||
&pool,
|
|
||||||
commands::history::HistoryArgs {
|
|
||||||
namespace: &namespace,
|
|
||||||
kind: &kind,
|
|
||||||
name: &name,
|
|
||||||
limit,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Rollback {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
to_version,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let master_key = crypto::load_master_key()?;
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::rollback::run(
|
|
||||||
&pool,
|
|
||||||
commands::rollback::RollbackArgs {
|
|
||||||
namespace: &namespace,
|
|
||||||
kind: &kind,
|
|
||||||
name: &name,
|
|
||||||
to_version,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
&master_key,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Run {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
tag,
|
|
||||||
secret_fields,
|
|
||||||
prefix,
|
|
||||||
dry_run,
|
|
||||||
output,
|
|
||||||
command,
|
|
||||||
} => {
|
|
||||||
let master_key = crypto::load_master_key()?;
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
if !dry_run && command.is_empty() {
|
|
||||||
anyhow::bail!(
|
|
||||||
"No command specified. Usage: secrets run [filter flags] -- <command> [args]"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
commands::run::run_exec(
|
|
||||||
&pool,
|
|
||||||
commands::run::RunArgs {
|
|
||||||
namespace: namespace.as_deref(),
|
|
||||||
kind: kind.as_deref(),
|
|
||||||
name: name.as_deref(),
|
|
||||||
tags: &tag,
|
|
||||||
secret_fields: &secret_fields,
|
|
||||||
prefix: &prefix,
|
|
||||||
dry_run,
|
|
||||||
output: out,
|
|
||||||
command: &command,
|
|
||||||
},
|
|
||||||
&master_key,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Export {
|
|
||||||
namespace,
|
|
||||||
kind,
|
|
||||||
name,
|
|
||||||
tag,
|
|
||||||
query,
|
|
||||||
file,
|
|
||||||
format,
|
|
||||||
no_secrets,
|
|
||||||
} => {
|
|
||||||
let master_key = if no_secrets {
|
|
||||||
None
|
|
||||||
} else {
|
|
||||||
Some(crypto::load_master_key()?)
|
|
||||||
};
|
|
||||||
let _span = tracing::info_span!("cmd", command = "export").entered();
|
|
||||||
commands::export_cmd::run(
|
|
||||||
&pool,
|
|
||||||
commands::export_cmd::ExportArgs {
|
|
||||||
namespace: namespace.as_deref(),
|
|
||||||
kind: kind.as_deref(),
|
|
||||||
name: name.as_deref(),
|
|
||||||
tags: &tag,
|
|
||||||
query: query.as_deref(),
|
|
||||||
file: file.as_deref(),
|
|
||||||
format: format.as_deref(),
|
|
||||||
no_secrets,
|
|
||||||
},
|
|
||||||
master_key.as_ref(),
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
|
|
||||||
Commands::Import {
|
|
||||||
file,
|
|
||||||
force,
|
|
||||||
dry_run,
|
|
||||||
output,
|
|
||||||
} => {
|
|
||||||
let master_key = crypto::load_master_key()?;
|
|
||||||
let _span = tracing::info_span!("cmd", command = "import").entered();
|
|
||||||
let out = resolve_output_mode(output.as_deref())?;
|
|
||||||
commands::import_cmd::run(
|
|
||||||
&pool,
|
|
||||||
commands::import_cmd::ImportArgs {
|
|
||||||
file: &file,
|
|
||||||
force,
|
|
||||||
dry_run,
|
|
||||||
output: out,
|
|
||||||
},
|
|
||||||
&master_key,
|
|
||||||
)
|
|
||||||
.await?;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
use chrono::{DateTime, Local, Utc};
|
|
||||||
use std::str::FromStr;
|
|
||||||
|
|
||||||
/// Output format for all commands.
|
|
||||||
#[derive(Debug, Clone, Default, PartialEq)]
|
|
||||||
pub enum OutputMode {
|
|
||||||
/// Human-readable text (default when stdout is a TTY)
|
|
||||||
#[default]
|
|
||||||
Text,
|
|
||||||
/// Pretty-printed JSON
|
|
||||||
Json,
|
|
||||||
/// Single-line JSON (default when stdout is NOT a TTY, e.g. piped to jq)
|
|
||||||
JsonCompact,
|
|
||||||
}
|
|
||||||
|
|
||||||
impl FromStr for OutputMode {
|
|
||||||
type Err = anyhow::Error;
|
|
||||||
|
|
||||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
|
||||||
match s {
|
|
||||||
"text" => Ok(Self::Text),
|
|
||||||
"json" => Ok(Self::Json),
|
|
||||||
"json-compact" => Ok(Self::JsonCompact),
|
|
||||||
other => Err(anyhow::anyhow!(
|
|
||||||
"Unknown output format '{}'. Valid: text, json, json-compact",
|
|
||||||
other
|
|
||||||
)),
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Resolve the effective output mode.
|
|
||||||
/// - Explicit value from `--output` takes priority.
|
|
||||||
/// - Default is always `Json` (AI-first); use `-o text` for human-readable output.
|
|
||||||
pub fn resolve_output_mode(explicit: Option<&str>) -> anyhow::Result<OutputMode> {
|
|
||||||
if let Some(s) = explicit {
|
|
||||||
return s.parse();
|
|
||||||
}
|
|
||||||
Ok(OutputMode::Json)
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Format a UTC timestamp for local human-readable output.
|
|
||||||
pub fn format_local_time(dt: DateTime<Utc>) -> String {
|
|
||||||
dt.with_timezone(&Local)
|
|
||||||
.format("%Y-%m-%d %H:%M:%S %:z")
|
|
||||||
.to_string()
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Print a JSON value to stdout in the requested output mode.
|
|
||||||
/// - `Json` → pretty-printed
|
|
||||||
/// - `JsonCompact` → single line
|
|
||||||
/// - `Text` → no-op (caller is responsible for the text branch)
|
|
||||||
pub fn print_json(value: &serde_json::Value, mode: &OutputMode) -> anyhow::Result<()> {
|
|
||||||
match mode {
|
|
||||||
OutputMode::Json => println!("{}", serde_json::to_string_pretty(value)?),
|
|
||||||
OutputMode::JsonCompact => println!("{}", serde_json::to_string(value)?),
|
|
||||||
OutputMode::Text => {}
|
|
||||||
}
|
|
||||||
Ok(())
|
|
||||||
}
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
-----BEGIN EXAMPLE KEY PLACEHOLDER-----
|
|
||||||
This file is for local dev/testing. Replace with a real key when needed.
|
|
||||||
-----END EXAMPLE KEY PLACEHOLDER-----
|
|
||||||
Reference in New Issue
Block a user