refactor: entries + secrets 双表，search 展示 field schema，key_ref PEM 共享

- secrets 表拆为 entries（主表）+ secrets（每字段一行）
- search 无需 master_key 即可展示 secrets 字段名、类型、长度
- inject/run 支持 metadata.key_ref 引用 kind=key 记录，PEM 轮换 O(1)
- entries_history + secrets_history 字段级历史，rollback 按 version 恢复
- 移除迁移用 DROP 语句，migrate 幂等
- v0.8.0

Made-with: Cursor

src/commands/add.rs

@@ -7,6 +7,8 @@ use crate::crypto;
 use crate::db;
 use crate::output::OutputMode;
 
+// ── Key/value parsing helpers (shared with update.rs) ───────────────────────
+
 /// Parse secret / metadata entries into a nested key path and JSON value.
 /// - `key=value`        → stores the literal string `value`
 /// - `key:=<json>`      → parses `<json>` as a typed JSON value
@@ -158,6 +160,52 @@ pub(crate) fn remove_path(map: &mut Map<String, Value>, path: &[String]) -> Resu
     Ok(removed)
 }
 
+// ── field_type inference and value_len ──────────────────────────────────────
+
+/// Infer the field type string from a JSON value.
+pub(crate) fn infer_field_type(v: &Value) -> &'static str {
+    match v {
+        Value::String(_) => "string",
+        Value::Number(_) => "number",
+        Value::Bool(_) => "boolean",
+        Value::Null => "string",
+        Value::Array(_) | Value::Object(_) => "json",
+    }
+}
+
+/// Compute the plaintext length of a JSON value (chars for string, serialized length otherwise).
+pub(crate) fn compute_value_len(v: &Value) -> i32 {
+    match v {
+        Value::String(s) => s.chars().count() as i32,
+        Value::Null => 0,
+        other => other.to_string().chars().count() as i32,
+    }
+}
+
+/// Flatten a (potentially nested) JSON object into dot-separated field entries.
+/// e.g. `{"credentials": {"type": "ssh", "content": "..."}}` →
+///   `[("credentials.type", "ssh"), ("credentials.content", "...")]`
+/// Top-level non-object values are emitted directly.
+pub(crate) fn flatten_json_fields(prefix: &str, value: &Value) -> Vec<(String, Value)> {
+    match value {
+        Value::Object(map) => {
+            let mut out = Vec::new();
+            for (k, v) in map {
+                let full_key = if prefix.is_empty() {
+                    k.clone()
+                } else {
+                    format!("{}.{}", prefix, k)
+                };
+                out.extend(flatten_json_fields(&full_key, v));
+            }
+            out
+        }
+        other => vec![(prefix.to_string(), other.clone())],
+    }
+}
+
+// ── Add command ──────────────────────────────────────────────────────────────
+
 pub struct AddArgs<'a> {
     pub namespace: &'a str,
     pub kind: &'a str,
@@ -171,26 +219,24 @@ pub struct AddArgs<'a> {
 pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Result<()> {
     let metadata = build_json(args.meta_entries)?;
     let secret_json = build_json(args.secret_entries)?;
-    let encrypted_bytes = crypto::encrypt_json(master_key, &secret_json)?;
 
-    tracing::debug!(args.namespace, args.kind, args.name, "upserting record");
+    tracing::debug!(args.namespace, args.kind, args.name, "upserting entry");
 
     let meta_keys = collect_key_paths(args.meta_entries)?;
     let secret_keys = collect_key_paths(args.secret_entries)?;
 
     let mut tx = pool.begin().await?;
 
-    // Snapshot existing row into history before overwriting (if it exists).
+    // Upsert the entry row (tags + metadata).
     #[derive(sqlx::FromRow)]
-    struct ExistingRow {
+    struct EntryRow {
         id: uuid::Uuid,
         version: i64,
         tags: Vec<String>,
-        metadata: serde_json::Value,
-        encrypted: Vec<u8>,
+        metadata: Value,
     }
-    let existing: Option<ExistingRow> = sqlx::query_as(
-        "SELECT id, version, tags, metadata, encrypted FROM secrets \
+    let existing: Option<EntryRow> = sqlx::query_as(
+        "SELECT id, version, tags, metadata FROM entries \
          WHERE namespace = $1 AND kind = $2 AND name = $3",
     )
     .bind(args.namespace)
@@ -199,11 +245,12 @@ pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Res
     .fetch_optional(&mut *tx)
     .await?;
 
-    if let Some(ex) = existing
-        && let Err(e) = db::snapshot_history(
+    // Snapshot the current entry state before overwriting.
+    if let Some(ref ex) = existing
+        && let Err(e) = db::snapshot_entry_history(
             &mut tx,
-            db::SnapshotParams {
-                secret_id: ex.id,
+            db::EntrySnapshotParams {
+                entry_id: ex.id,
                 namespace: args.namespace,
                 kind: args.kind,
                 name: args.name,
@@ -211,25 +258,24 @@ pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Res
                 action: "add",
                 tags: &ex.tags,
                 metadata: &ex.metadata,
-                encrypted: &ex.encrypted,
             },
         )
         .await
     {
-        tracing::warn!(error = %e, "failed to snapshot history before upsert");
+        tracing::warn!(error = %e, "failed to snapshot entry history before upsert");
     }
 
-    sqlx::query(
+    let entry_id: uuid::Uuid = sqlx::query_scalar(
         r#"
-        INSERT INTO secrets (namespace, kind, name, tags, metadata, encrypted, version, updated_at)
-        VALUES ($1, $2, $3, $4, $5, $6, 1, NOW())
+        INSERT INTO entries (namespace, kind, name, tags, metadata, version, updated_at)
+        VALUES ($1, $2, $3, $4, $5, 1, NOW())
         ON CONFLICT (namespace, kind, name)
         DO UPDATE SET
             tags       = EXCLUDED.tags,
             metadata   = EXCLUDED.metadata,
-            encrypted  = EXCLUDED.encrypted,
-            version    = secrets.version + 1,
+            version    = entries.version + 1,
             updated_at = NOW()
+        RETURNING id
         "#,
     )
     .bind(args.namespace)
@@ -237,10 +283,79 @@ pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Res
     .bind(args.name)
     .bind(args.tags)
     .bind(&metadata)
-    .bind(&encrypted_bytes)
-    .execute(&mut *tx)
+    .fetch_one(&mut *tx)
     .await?;
 
+    let new_entry_version: i64 = sqlx::query_scalar("SELECT version FROM entries WHERE id = $1")
+        .bind(entry_id)
+        .fetch_one(&mut *tx)
+        .await?;
+
+    // Snapshot existing secret fields before replacing.
+    if existing.is_some() {
+        #[derive(sqlx::FromRow)]
+        struct ExistingField {
+            id: uuid::Uuid,
+            field_name: String,
+            field_type: String,
+            value_len: i32,
+            encrypted: Vec<u8>,
+        }
+        let existing_fields: Vec<ExistingField> = sqlx::query_as(
+            "SELECT id, field_name, field_type, value_len, encrypted \
+             FROM secrets WHERE entry_id = $1",
+        )
+        .bind(entry_id)
+        .fetch_all(&mut *tx)
+        .await?;
+
+        for f in &existing_fields {
+            if let Err(e) = db::snapshot_secret_history(
+                &mut tx,
+                db::SecretSnapshotParams {
+                    entry_id,
+                    secret_id: f.id,
+                    entry_version: new_entry_version - 1,
+                    field_name: &f.field_name,
+                    field_type: &f.field_type,
+                    value_len: f.value_len,
+                    encrypted: &f.encrypted,
+                    action: "add",
+                },
+            )
+            .await
+            {
+                tracing::warn!(error = %e, "failed to snapshot secret field history");
+            }
+        }
+
+        // Delete existing secret fields so we can re-insert the full set.
+        sqlx::query("DELETE FROM secrets WHERE entry_id = $1")
+            .bind(entry_id)
+            .execute(&mut *tx)
+            .await?;
+    }
+
+    // Insert new secret fields.
+    let flat_fields = flatten_json_fields("", &secret_json);
+    for (field_name, field_value) in &flat_fields {
+        let field_type = infer_field_type(field_value);
+        let value_len = compute_value_len(field_value);
+        let encrypted = crypto::encrypt_json(master_key, field_value)?;
+
+        sqlx::query(
+            "INSERT INTO secrets (entry_id, field_name, field_type, value_len, encrypted) \
+             VALUES ($1, $2, $3, $4, $5)",
+        )
+        .bind(entry_id)
+        .bind(field_name)
+        .bind(field_type)
+        .bind(value_len)
+        .bind(&encrypted)
+        .execute(&mut *tx)
+        .await?;
+    }
+
     crate::audit::log_tx(
         &mut tx,
         "add",
@@ -293,7 +408,10 @@ pub async fn run(pool: &PgPool, args: AddArgs<'_>, master_key: &[u8; 32]) -> Res
 
 #[cfg(test)]
 mod tests {
-    use super::{build_json, key_path_to_string, parse_kv, remove_path};
+    use super::{
+        build_json, compute_value_len, flatten_json_fields, infer_field_type, key_path_to_string,
+        parse_kv, remove_path,
+    };
     use serde_json::Value;
     use std::fs;
     use std::path::PathBuf;
@@ -363,4 +481,36 @@ mod tests {
         assert!(removed);
         assert_eq!(value, serde_json::json!({ "username": "root" }));
     }
+
+    #[test]
+    fn flatten_json_fields_nested() {
+        let v = serde_json::json!({
+            "username": "root",
+            "credentials": {
+                "type": "ssh",
+                "content": "pem-data"
+            }
+        });
+        let mut fields = flatten_json_fields("", &v);
+        fields.sort_by(|a, b| a.0.cmp(&b.0));
+
+        assert_eq!(fields[0].0, "credentials.content");
+        assert_eq!(fields[1].0, "credentials.type");
+        assert_eq!(fields[2].0, "username");
+    }
+
+    #[test]
+    fn infer_field_types() {
+        assert_eq!(infer_field_type(&Value::String("x".into())), "string");
+        assert_eq!(infer_field_type(&serde_json::json!(42)), "number");
+        assert_eq!(infer_field_type(&Value::Bool(true)), "boolean");
+        assert_eq!(infer_field_type(&serde_json::json!(["a"])), "json");
+    }
+
+    #[test]
+    fn compute_value_len_string() {
+        assert_eq!(compute_value_len(&Value::String("root".into())), 4);
+        assert_eq!(compute_value_len(&Value::Null), 0);
+        assert_eq!(compute_value_len(&serde_json::json!(1234)), 4);
+    }
 }