feat(web): 条目列表页 /entries 与总条数统计

- 新增受会话保护的 GET /entries，仅展示 entries 非敏感列 - search: list_entries、count_entries 共享筛选条件；分页与计数不读 secrets - 侧边栏在 dashboard/audit 增加「条目」入口 - secrets-mcp 0.3.4（tag 尚未存在） Made-with: Cursor
release(secrets-mcp): v0.3.3 — 强制 PostgreSQL TLS 校验
2026-04-02 11:26:51 +08:00 · 2026-04-01 15:18:14 +08:00 · 2026-03-27 10:45:12 +08:00 · 2026-03-26 17:35:56 +08:00
17 changed files with 1028 additions and 129 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -118,7 +118,7 @@ oauth_accounts (

 ### PEM 共享（`key_ref`）

-将共享 PEM 存为 **`type=key`** 的 entry；其它记录在 `metadata.key_ref` 指向该 key 的 `name`。更新 key 记录后，引用方通过服务层解析合并逻辑即可使用新密钥（实现见 `secrets_core::service`）。
+将共享 PEM 存为 **`type=key`** 的 entry；其它记录在 `metadata.key_ref` 指向该 key 的 `name`（支持 `folder/name` 格式消歧）。更新 key 记录后，引用方通过服务层解析合并逻辑即可使用新密钥（实现见 `secrets_core::service::env_map`）。

 ## 代码规范

--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1968,7 +1968,7 @@ dependencies = [

 [[package]]
 name = "secrets-mcp"
-version = "0.3.0"
+version = "0.3.4"
 dependencies = [
 "anyhow",
 "askama",
--- a/README.md
+++ b/README.md
@@ -17,7 +17,10 @@ cargo build --release -p secrets-mcp

 | 变量 | 说明 |
 |------|------|
-| `SECRETS_DATABASE_URL` | **必填**。PostgreSQL 连接串（建议专用库，如 `secrets-mcp`）。 |
+| `SECRETS_DATABASE_URL` | **必填**。PostgreSQL 连接串（推荐使用域名，例如 `db.refining.ltd`，避免直连 IP）。 |
+| `SECRETS_DATABASE_SSL_MODE` | 可选但强烈建议生产必填。推荐 `verify-full`（至少 `verify-ca`），避免回退到弱 TLS 模式。 |
+| `SECRETS_DATABASE_SSL_ROOT_CERT` | 可选。私有 CA 或自签链路时指定 CA 根证书路径（如 `/etc/secrets/pg-ca.crt`）。 |
+| `SECRETS_ENV` | 可选。设为 `prod` / `production` 时会拒绝弱 PostgreSQL TLS 模式（`prefer`、`disable`、`allow`、`require`）。 |
 | `BASE_URL` | 对外访问基址；OAuth 回调为 `{BASE_URL}/auth/google/callback`。默认 `http://localhost:9315`。 |
 | `SECRETS_MCP_BIND` | 监听地址，默认 `127.0.0.1:9315`。容器内或直接对外暴露端口时请改为 `0.0.0.0:9315`；反代时常为 `127.0.0.1:9315`。 |
 | `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | 可选；不配置则无 Google 登录入口。运行时从环境读取，勿写入 CI、勿打入二进制。 |
@@ -27,9 +30,26 @@ cargo build --release -p secrets-mcp
 cargo run -p secrets-mcp
 ```

+生产推荐示例（PostgreSQL TLS）：
+
+```bash
+SECRETS_DATABASE_URL=postgres://postgres:***@db.refining.ltd:5432/secrets-mcp
+SECRETS_DATABASE_SSL_MODE=verify-full
+SECRETS_DATABASE_SSL_ROOT_CERT=/etc/secrets/pg-ca.crt
+SECRETS_ENV=production
+```
+
 - **Web**：`BASE_URL`（登录、Dashboard、设置密码短语、创建 API Key）。
 - **MCP**：Streamable HTTP 基址 `{BASE_URL}/mcp`，需 `Authorization: Bearer <api_key>` + `X-Encryption-Key: <hex>` 请求头（读密文工具须带密钥）。

+## PostgreSQL TLS 加固
+
+- 推荐将数据库域名单独设置为 `db.refining.ltd`，服务域名保持 `secrets.refining.app`。
+- 数据库证书建议使用可校验链路（如 Let's Encrypt 或私有 CA），并保证证书 `SAN` 包含 `db.refining.ltd`。
+- PostgreSQL 侧建议使用 `hostssl` 规则限制应用来源（如 `47.238.146.244/32`），逐步移除公网明文 `host` 访问。
+- 应用端推荐 `SECRETS_DATABASE_SSL_MODE=verify-full`；仅在过渡阶段可临时用 `verify-ca`。
+- 可执行运维步骤见 [`deploy/postgres-tls-hardening.md`](deploy/postgres-tls-hardening.md)。
+
 ## MCP 与 AI 工作流（v0.3+）

 条目在逻辑上以 **`(folder, name)`** 在用户内唯一（数据库唯一索引：`user_id + folder + name`）。同名可在不同 folder 下各存一条（例如 `refining/aliyun` 与 `ricnsmart/aliyun`）。
@@ -147,7 +167,7 @@ flowchart LR

 ### PEM 共享（`key_ref`）

-同一 PEM 可被多条 `server` 等记录引用：将 PEM 存为 **`type=key`** 的 entry，在其它条目的 `metadata.key_ref` 中写该 key 条目的 `name`；轮换时只更新 key 对应记录即可。
+同一 PEM 可被多条 `server` 等记录引用：将 PEM 存为 **`type=key`** 的 entry，在其它条目的 `metadata.key_ref` 中写该 key 条目的 `name`（支持 `folder/name` 格式消歧）；轮换时只更新 key 记录即可。

 ## 审计日志

--- a/crates/secrets-core/src/config.rs
+++ b/crates/secrets-core/src/config.rs
@@ -1,4 +1,15 @@
-use anyhow::Result;
+use std::path::PathBuf;
+
+use anyhow::{Context, Result};
+use sqlx::postgres::PgSslMode;
+
+#[derive(Debug, Clone)]
+pub struct DatabaseConfig {
+    pub url: String,
+    pub ssl_mode: Option<PgSslMode>,
+    pub ssl_root_cert: Option<PathBuf>,
+    pub enforce_strict_tls: bool,
+}

 /// Resolve database URL from environment.
 /// Priority: `SECRETS_DATABASE_URL` env var → error.
@@ -18,3 +29,54 @@ pub fn resolve_db_url(override_url: &str) -> Result<String> {
         Example: SECRETS_DATABASE_URL=postgres://user:pass@host:port/dbname"
    )
 }
+
+fn env_var_non_empty(name: &str) -> Option<String> {
+    std::env::var(name)
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+}
+
+fn parse_ssl_mode_from_env() -> Result<Option<PgSslMode>> {
+    let Some(mode) = env_var_non_empty("SECRETS_DATABASE_SSL_MODE") else {
+        return Ok(None);
+    };
+
+    let parsed = mode.parse::<PgSslMode>().with_context(|| {
+        format!(
+            "Invalid SECRETS_DATABASE_SSL_MODE='{mode}'. Use one of: disable, allow, prefer, require, verify-ca, verify-full."
+        )
+    })?;
+    Ok(Some(parsed))
+}
+
+fn resolve_ssl_root_cert_from_env() -> Result<Option<PathBuf>> {
+    let Some(path) = env_var_non_empty("SECRETS_DATABASE_SSL_ROOT_CERT") else {
+        return Ok(None);
+    };
+    let path = PathBuf::from(path);
+    if !path.exists() {
+        anyhow::bail!(
+            "SECRETS_DATABASE_SSL_ROOT_CERT points to a missing file: {}",
+            path.display()
+        );
+    }
+    Ok(Some(path))
+}
+
+fn is_production_env() -> bool {
+    matches!(
+        env_var_non_empty("SECRETS_ENV")
+            .as_deref()
+            .map(|value| value.to_ascii_lowercase()),
+        Some(value) if value == "prod" || value == "production"
+    )
+}
+
+pub fn resolve_db_config(override_url: &str) -> Result<DatabaseConfig> {
+    Ok(DatabaseConfig {
+        url: resolve_db_url(override_url)?,
+        ssl_mode: parse_ssl_mode_from_env()?,
+        ssl_root_cert: resolve_ssl_root_cert_from_env()?,
+        enforce_strict_tls: is_production_env(),
+    })
+}
--- a/crates/secrets-core/src/db.rs
+++ b/crates/secrets-core/src/db.rs
@@ -1,14 +1,45 @@
-use anyhow::Result;
+use std::str::FromStr;
+
+use anyhow::{Context, Result};
 use serde_json::Value;
 use sqlx::PgPool;
-use sqlx::postgres::PgPoolOptions;
+use sqlx::postgres::{PgConnectOptions, PgPoolOptions, PgSslMode};

-pub async fn create_pool(database_url: &str) -> Result<PgPool> {
+use crate::config::DatabaseConfig;
+
+fn build_connect_options(config: &DatabaseConfig) -> Result<PgConnectOptions> {
+    let mut options = PgConnectOptions::from_str(&config.url)
+        .with_context(|| "failed to parse SECRETS_DATABASE_URL".to_string())?;
+
+    if let Some(mode) = config.ssl_mode {
+        options = options.ssl_mode(mode);
+    }
+    if let Some(path) = &config.ssl_root_cert {
+        options = options.ssl_root_cert(path);
+    }
+
+    if config.enforce_strict_tls
+        && !matches!(
+            options.get_ssl_mode(),
+            PgSslMode::VerifyCa | PgSslMode::VerifyFull
+        )
+    {
+        anyhow::bail!(
+            "Refusing to start in production with weak PostgreSQL TLS mode. \
+             Set SECRETS_DATABASE_SSL_MODE=verify-ca or verify-full."
+        );
+    }
+
+    Ok(options)
+}
+
+pub async fn create_pool(config: &DatabaseConfig) -> Result<PgPool> {
    tracing::debug!("connecting to database");
+    let connect_options = build_connect_options(config)?;
    let pool = PgPoolOptions::new()
        .max_connections(10)
        .acquire_timeout(std::time::Duration::from_secs(5))
-        .connect(database_url)
+        .connect_with(connect_options)
        .await?;
    tracing::debug!("database connection established");
    Ok(pool)
--- a/crates/secrets-core/src/service/env_map.rs
+++ b/crates/secrets-core/src/service/env_map.rs
@@ -26,7 +26,8 @@ pub async fn build_env_map(
    let mut combined: HashMap<String, String> = HashMap::new();

    for entry in &entries {
-        let entry_map = build_entry_env_map(pool, entry, only_fields, prefix, master_key).await?;
+        let entry_map =
+            build_entry_env_map(pool, entry, only_fields, prefix, master_key, user_id).await?;
        combined.extend(entry_map);
    }

@@ -39,6 +40,7 @@ async fn build_entry_env_map(
    only_fields: &[String],
    prefix: &str,
    master_key: &[u8; 32],
+    user_id: Option<Uuid>,
 ) -> Result<HashMap<String, String>> {
    let entry_ids = vec![entry.id];
    let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
@@ -66,10 +68,31 @@ async fn build_entry_env_map(
        map.insert(key, json_to_env_string(&decrypted));
    }

-    // Resolve key_ref
+    // Resolve key_ref. Supported formats: "name" or "folder/name".
    if let Some(key_ref) = entry.metadata.get("key_ref").and_then(|v| v.as_str()) {
-        let key_entries =
-            fetch_entries(pool, None, Some("key"), Some(key_ref), &[], None, None).await?;
+        let (ref_folder, ref_name) = if let Some((f, n)) = key_ref.split_once('/') {
+            (Some(f), n)
+        } else {
+            (None, key_ref)
+        };
+        let key_entries = fetch_entries(
+            pool,
+            ref_folder,
+            Some("key"),
+            Some(ref_name),
+            &[],
+            None,
+            user_id,
+        )
+        .await?;
+
+        if key_entries.len() > 1 {
+            anyhow::bail!(
+                "key_ref '{}' matched {} entries; qualify with folder/name to resolve the ambiguity",
+                key_ref,
+                key_entries.len()
+            );
+        }

        if let Some(key_entry) = key_entries.first() {
            let key_ids = vec![key_entry.id];
@@ -87,7 +110,7 @@ async fn build_entry_env_map(
                map.insert(key_var, json_to_env_string(&decrypted));
            }
        } else {
-            tracing::warn!(key_ref, "key_ref target not found");
+            tracing::warn!(key_ref, ?user_id, "key_ref target not found");
        }
    }

--- a/crates/secrets-core/src/service/get_secret.rs
+++ b/crates/secrets-core/src/service/get_secret.rs
@@ -5,7 +5,7 @@ use std::collections::HashMap;
 use uuid::Uuid;

 use crate::crypto;
-use crate::service::search::{fetch_secrets_for_entries, resolve_entry};
+use crate::service::search::{fetch_secrets_for_entries, resolve_entry, resolve_entry_by_id};

 /// Decrypt a single named field from an entry.
 /// `folder` is optional; if omitted and multiple entries share the name, an error is returned.
@@ -53,3 +53,52 @@ pub async fn get_all_secrets(
    }
    Ok(map)
 }
+
+/// Decrypt a single named field from an entry, located by its UUID.
+pub async fn get_secret_field_by_id(
+    pool: &PgPool,
+    entry_id: Uuid,
+    field_name: &str,
+    master_key: &[u8; 32],
+    user_id: Option<Uuid>,
+) -> Result<Value> {
+    resolve_entry_by_id(pool, entry_id, user_id)
+        .await
+        .map_err(|_| anyhow::anyhow!("Entry with id '{}' not found", entry_id))?;
+
+    let entry_ids = vec![entry_id];
+    let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
+    let fields = secrets_map.get(&entry_id).map(Vec::as_slice).unwrap_or(&[]);
+
+    let field = fields
+        .iter()
+        .find(|f| f.field_name == field_name)
+        .ok_or_else(|| anyhow::anyhow!("Secret field '{}' not found", field_name))?;
+
+    crypto::decrypt_json(master_key, &field.encrypted)
+}
+
+/// Decrypt all secret fields from an entry, located by its UUID.
+/// Returns a map field_name → decrypted Value.
+pub async fn get_all_secrets_by_id(
+    pool: &PgPool,
+    entry_id: Uuid,
+    master_key: &[u8; 32],
+    user_id: Option<Uuid>,
+) -> Result<HashMap<String, Value>> {
+    // Validate entry exists (and that it belongs to the requesting user)
+    resolve_entry_by_id(pool, entry_id, user_id)
+        .await
+        .map_err(|_| anyhow::anyhow!("Entry with id '{}' not found", entry_id))?;
+
+    let entry_ids = vec![entry_id];
+    let secrets_map = fetch_secrets_for_entries(pool, &entry_ids).await?;
+    let fields = secrets_map.get(&entry_id).map(Vec::as_slice).unwrap_or(&[]);
+
+    let mut map = HashMap::new();
+    for f in fields {
+        let decrypted = crypto::decrypt_json(master_key, &f.encrypted)?;
+        map.insert(f.field_name.clone(), decrypted);
+    }
+    Ok(map)
+}
--- a/crates/secrets-core/src/service/search.rs
+++ b/crates/secrets-core/src/service/search.rs
@@ -27,49 +27,46 @@ pub struct SearchResult {
    pub secret_schemas: HashMap<Uuid, Vec<SecretField>>,
 }

-pub async fn run(pool: &PgPool, params: SearchParams<'_>) -> Result<SearchResult> {
-    let entries = fetch_entries_paged(pool, &params).await?;
-    let entry_ids: Vec<Uuid> = entries.iter().map(|e| e.id).collect();
-    let secret_schemas = if !entry_ids.is_empty() {
-        fetch_secret_schemas(pool, &entry_ids).await?
-    } else {
-        HashMap::new()
-    };
-    Ok(SearchResult {
-        entries,
-        secret_schemas,
-    })
-}
-
-/// Fetch entries matching the given filters — returns all matching entries up to FETCH_ALL_LIMIT.
-pub async fn fetch_entries(
-    pool: &PgPool,
-    folder: Option<&str>,
-    entry_type: Option<&str>,
-    name: Option<&str>,
-    tags: &[String],
-    query: Option<&str>,
-    user_id: Option<Uuid>,
-) -> Result<Vec<Entry>> {
-    let params = SearchParams {
-        folder,
-        entry_type,
-        name,
-        tags,
-        query,
-        sort: "name",
-        limit: FETCH_ALL_LIMIT,
-        offset: 0,
-        user_id,
-    };
+/// List `entries` rows matching params (paged, ordered per `params.sort`).
+/// Does not read the `secrets` table.
+pub async fn list_entries(pool: &PgPool, params: SearchParams<'_>) -> Result<Vec<Entry>> {
    fetch_entries_paged(pool, &params).await
 }

-async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<Entry>> {
+/// Count `entries` rows matching the same filters as [`list_entries`] (ignores `sort` / `limit` / `offset`).
+/// Does not read the `secrets` table.
+pub async fn count_entries(pool: &PgPool, a: &SearchParams<'_>) -> Result<i64> {
+    let (where_clause, _) = entry_where_clause_and_next_idx(a);
+    let sql = format!("SELECT COUNT(*)::bigint FROM entries {where_clause}");
+    let mut q = sqlx::query_scalar::<_, i64>(&sql);
+    if let Some(uid) = a.user_id {
+        q = q.bind(uid);
+    }
+    if let Some(v) = a.folder {
+        q = q.bind(v);
+    }
+    if let Some(v) = a.entry_type {
+        q = q.bind(v);
+    }
+    if let Some(v) = a.name {
+        q = q.bind(v);
+    }
+    for tag in a.tags {
+        q = q.bind(tag);
+    }
+    if let Some(v) = a.query {
+        let pattern = format!("%{}%", v.replace('%', "\\%").replace('_', "\\_"));
+        q = q.bind(pattern);
+    }
+    let n = q.fetch_one(pool).await?;
+    Ok(n)
+}
+
+/// Shared WHERE clause and the next `$n` index (for LIMIT/OFFSET in paged queries).
+fn entry_where_clause_and_next_idx(a: &SearchParams<'_>) -> (String, i32) {
    let mut conditions: Vec<String> = Vec::new();
    let mut idx: i32 = 1;

-    // user_id filtering — always comes first when present
    if a.user_id.is_some() {
        conditions.push(format!("user_id = ${}", idx));
        idx += 1;
@@ -115,6 +112,55 @@ async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<
        idx += 1;
    }

+    let where_clause = if conditions.is_empty() {
+        String::new()
+    } else {
+        format!("WHERE {}", conditions.join(" AND "))
+    };
+    (where_clause, idx)
+}
+
+pub async fn run(pool: &PgPool, params: SearchParams<'_>) -> Result<SearchResult> {
+    let entries = fetch_entries_paged(pool, &params).await?;
+    let entry_ids: Vec<Uuid> = entries.iter().map(|e| e.id).collect();
+    let secret_schemas = if !entry_ids.is_empty() {
+        fetch_secret_schemas(pool, &entry_ids).await?
+    } else {
+        HashMap::new()
+    };
+    Ok(SearchResult {
+        entries,
+        secret_schemas,
+    })
+}
+
+/// Fetch entries matching the given filters — returns all matching entries up to FETCH_ALL_LIMIT.
+pub async fn fetch_entries(
+    pool: &PgPool,
+    folder: Option<&str>,
+    entry_type: Option<&str>,
+    name: Option<&str>,
+    tags: &[String],
+    query: Option<&str>,
+    user_id: Option<Uuid>,
+) -> Result<Vec<Entry>> {
+    let params = SearchParams {
+        folder,
+        entry_type,
+        name,
+        tags,
+        query,
+        sort: "name",
+        limit: FETCH_ALL_LIMIT,
+        offset: 0,
+        user_id,
+    };
+    list_entries(pool, params).await
+}
+
+async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<Entry>> {
+    let (where_clause, idx) = entry_where_clause_and_next_idx(a);
+
    let order = match a.sort {
        "updated" => "updated_at DESC",
        "created" => "created_at DESC",
@@ -122,14 +168,7 @@ async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<
    };

    let limit_idx = idx;
-    idx += 1;
-    let offset_idx = idx;
-
-    let where_clause = if conditions.is_empty() {
-        String::new()
-    } else {
-        format!("WHERE {}", conditions.join(" AND "))
-    };
+    let offset_idx = idx + 1;

    let sql = format!(
        "SELECT id, user_id, folder, type, name, notes, tags, metadata, version, \
@@ -138,7 +177,6 @@ async fn fetch_entries_paged(pool: &PgPool, a: &SearchParams<'_>) -> Result<Vec<
    );

    let mut q = sqlx::query_as::<_, EntryRaw>(&sql);
-
    if let Some(uid) = a.user_id {
        q = q.bind(uid);
    }
@@ -208,6 +246,36 @@ pub async fn fetch_secrets_for_entries(
    Ok(map)
 }

+/// Resolve exactly one entry by its UUID primary key.
+///
+/// Returns an error if the entry does not exist or does not belong to the given user.
+pub async fn resolve_entry_by_id(
+    pool: &PgPool,
+    id: Uuid,
+    user_id: Option<Uuid>,
+) -> Result<crate::models::Entry> {
+    let row: Option<EntryRaw> = if let Some(uid) = user_id {
+        sqlx::query_as(
+            "SELECT id, user_id, folder, type, name, notes, tags, metadata, version, \
+             created_at, updated_at FROM entries WHERE id = $1 AND user_id = $2",
+        )
+        .bind(id)
+        .bind(uid)
+        .fetch_optional(pool)
+        .await?
+    } else {
+        sqlx::query_as(
+            "SELECT id, user_id, folder, type, name, notes, tags, metadata, version, \
+             created_at, updated_at FROM entries WHERE id = $1 AND user_id IS NULL",
+        )
+        .bind(id)
+        .fetch_optional(pool)
+        .await?
+    };
+    row.map(Entry::from)
+        .ok_or_else(|| anyhow::anyhow!("Entry with id '{}' not found", id))
+}
+
 /// Resolve exactly one entry by name, with optional folder for disambiguation.
 ///
 /// - If `folder` is provided: exact `(folder, name)` match.
--- a/crates/secrets-mcp/Cargo.toml
+++ b/crates/secrets-mcp/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.3.0"
+version = "0.3.4"
 edition.workspace = true

 [[bin]]
--- a/crates/secrets-mcp/src/main.rs
+++ b/crates/secrets-mcp/src/main.rs
@@ -21,7 +21,7 @@ use tower_sessions_sqlx_store_chrono::PostgresStore;
 use tracing_subscriber::EnvFilter;
 use tracing_subscriber::fmt::time::FormatTime;

-use secrets_core::config::resolve_db_url;
+use secrets_core::config::resolve_db_config;
 use secrets_core::db::{create_pool, migrate};

 use crate::oauth::OAuthConfig;
@@ -78,9 +78,9 @@ async fn main() -> Result<()> {
        .init();

    // ── Database ──────────────────────────────────────────────────────────────
-    let db_url = resolve_db_url("")
+    let db_config = resolve_db_config("")
        .context("Database not configured. Set SECRETS_DATABASE_URL environment variable.")?;
-    let pool = create_pool(&db_url)
+    let pool = create_pool(&db_config)
        .await
        .context("failed to connect to database")?;
    migrate(&pool)
--- a/crates/secrets-mcp/src/tools.rs
+++ b/crates/secrets-mcp/src/tools.rs
@@ -14,6 +14,7 @@ use rmcp::{
 };
 use schemars::JsonSchema;
 use serde::Deserialize;
+use serde_json::{Map, Value};
 use sqlx::PgPool;
 use uuid::Uuid;

@@ -22,10 +23,10 @@ use secrets_core::service::{
    add::{AddParams, run as svc_add},
    delete::{DeleteParams, run as svc_delete},
    export::{ExportParams, export as svc_export},
-    get_secret::{get_all_secrets, get_secret_field},
+    get_secret::{get_all_secrets_by_id, get_secret_field_by_id},
    history::run as svc_history,
    rollback::run as svc_rollback,
-    search::{SearchParams, run as svc_search},
+    search::{SearchParams, resolve_entry_by_id, run as svc_search},
    update::{UpdateParams, run as svc_update},
 };

@@ -153,6 +154,25 @@ impl SecretsService {

 // ── Tool parameter types ──────────────────────────────────────────────────────

+#[derive(Debug, Deserialize, JsonSchema)]
+struct FindInput {
+    #[schemars(
+        description = "Fuzzy search across name, folder, type, notes, tags, and metadata values"
+    )]
+    query: Option<String>,
+    #[schemars(description = "Exact folder filter (e.g. 'refining', 'ricnsmart')")]
+    folder: Option<String>,
+    #[schemars(description = "Exact type filter (e.g. 'server', 'service', 'person', 'key')")]
+    #[serde(rename = "type")]
+    entry_type: Option<String>,
+    #[schemars(description = "Exact name filter")]
+    name: Option<String>,
+    #[schemars(description = "Tag filters (all must match)")]
+    tags: Option<Vec<String>>,
+    #[schemars(description = "Max results (default 20)")]
+    limit: Option<u32>,
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 struct SearchInput {
    #[schemars(description = "Fuzzy search across name, folder, type, notes, tags, metadata")]
@@ -178,12 +198,8 @@ struct SearchInput {

 #[derive(Debug, Deserialize, JsonSchema)]
 struct GetSecretInput {
-    #[schemars(description = "Name of the entry")]
-    name: String,
-    #[schemars(
-        description = "Folder for disambiguation when multiple entries share the same name (optional)"
-    )]
-    folder: Option<String>,
+    #[schemars(description = "Entry UUID obtained from secrets_find results")]
+    id: String,
    #[schemars(description = "Specific field to retrieve. If omitted, returns all fields.")]
    field: Option<String>,
 }
@@ -205,8 +221,16 @@ struct AddInput {
    tags: Option<Vec<String>>,
    #[schemars(description = "Metadata fields as 'key=value' or 'key:=json' strings")]
    meta: Option<Vec<String>>,
+    #[schemars(
+        description = "Metadata fields as a JSON object {\"key\": value}. Merged with 'meta' if both provided."
+    )]
+    meta_obj: Option<Map<String, Value>>,
    #[schemars(description = "Secret fields as 'key=value' strings")]
    secrets: Option<Vec<String>>,
+    #[schemars(
+        description = "Secret fields as a JSON object {\"key\": \"value\"}. Merged with 'secrets' if both provided."
+    )]
+    secrets_obj: Option<Map<String, Value>>,
 }

 #[derive(Debug, Deserialize, JsonSchema)]
@@ -217,6 +241,10 @@ struct UpdateInput {
        description = "Folder for disambiguation when multiple entries share the same name (optional)"
    )]
    folder: Option<String>,
+    #[schemars(
+        description = "Entry UUID (from secrets_find). If provided, name/folder are used for disambiguation only."
+    )]
+    id: Option<String>,
    #[schemars(description = "Update the notes field")]
    notes: Option<String>,
    #[schemars(description = "Tags to add")]
@@ -225,16 +253,29 @@ struct UpdateInput {
    remove_tags: Option<Vec<String>>,
    #[schemars(description = "Metadata fields to update/add as 'key=value' strings")]
    meta: Option<Vec<String>>,
+    #[schemars(
+        description = "Metadata fields to update/add as a JSON object {\"key\": value}. Merged with 'meta' if both provided."
+    )]
+    meta_obj: Option<Map<String, Value>>,
    #[schemars(description = "Metadata field keys to remove")]
    remove_meta: Option<Vec<String>>,
    #[schemars(description = "Secret fields to update/add as 'key=value' strings")]
    secrets: Option<Vec<String>>,
+    #[schemars(
+        description = "Secret fields to update/add as a JSON object {\"key\": \"value\"}. Merged with 'secrets' if both provided."
+    )]
+    secrets_obj: Option<Map<String, Value>>,
    #[schemars(description = "Secret field keys to remove")]
    remove_secrets: Option<Vec<String>>,
 }

 #[derive(Debug, Deserialize, JsonSchema)]
 struct DeleteInput {
+    #[schemars(
+        description = "Entry UUID (from secrets_find). If provided, deletes this specific entry \
+        regardless of name/folder."
+    )]
+    id: Option<String>,
    #[schemars(description = "Name of the entry to delete (single delete). \
        Omit to bulk delete by folder/type filters.")]
    name: Option<String>,
@@ -255,6 +296,10 @@ struct HistoryInput {
        description = "Folder for disambiguation when multiple entries share the same name (optional)"
    )]
    folder: Option<String>,
+    #[schemars(
+        description = "Entry UUID (from secrets_find). If provided, name/folder are ignored."
+    )]
+    id: Option<String>,
    #[schemars(description = "Max history entries to return (default 20)")]
    limit: Option<u32>,
 }
@@ -267,6 +312,10 @@ struct RollbackInput {
        description = "Folder for disambiguation when multiple entries share the same name (optional)"
    )]
    folder: Option<String>,
+    #[schemars(
+        description = "Entry UUID (from secrets_find). If provided, name/folder are ignored."
+    )]
+    id: Option<String>,
    #[schemars(description = "Target version number. Omit to restore the most recent snapshot.")]
    to_version: Option<i64>,
 }
@@ -301,17 +350,118 @@ struct EnvMapInput {
    tags: Option<Vec<String>>,
    #[schemars(description = "Only include these secret fields")]
    only_fields: Option<Vec<String>>,
-    #[schemars(description = "Environment variable name prefix")]
+    #[schemars(description = "Environment variable name prefix. \
+        Variable names are built as UPPER(prefix)_UPPER(entry_name)_UPPER(field_name), \
+        with hyphens and dots replaced by underscores. \
+        Example: entry 'aliyun', field 'access_key_id' → ALIYUN_ACCESS_KEY_ID \
+        (or PREFIX_ALIYUN_ACCESS_KEY_ID with prefix set).")]
    prefix: Option<String>,
 }

+#[derive(Debug, Deserialize, JsonSchema)]
+struct OverviewInput {}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+/// Convert a JSON object map into "key=value" / "key:=json" strings for service-layer parsing.
+fn map_to_kv_strings(map: Map<String, Value>) -> Vec<String> {
+    map.into_iter()
+        .map(|(k, v)| match &v {
+            Value::String(s) => format!("{}={}", k, s),
+            _ => format!("{}:={}", k, v),
+        })
+        .collect()
+}
+
+/// Parse a UUID string, returning an MCP error on failure.
+fn parse_uuid(s: &str) -> Result<Uuid, rmcp::ErrorData> {
+    s.parse::<Uuid>()
+        .map_err(|_| rmcp::ErrorData::invalid_request(format!("Invalid UUID: '{}'", s), None))
+}
+
 // ── Tool implementations ──────────────────────────────────────────────────────

 #[tool_router]
 impl SecretsService {
+    #[tool(
+        description = "Find entries in the secrets store by folder, name, type, tags, or a \
+        fuzzy query that also searches metadata values. Requires Bearer API key. \
+        Returns 0 or more entries with id, metadata, and secret field names (not values). \
+        Use the returned id with secrets_get to decrypt secret values. \
+        Replaces secrets_search for discovery tasks.",
+        annotations(title = "Find Secrets", read_only_hint = true, idempotent_hint = true)
+    )]
+    async fn secrets_find(
+        &self,
+        Parameters(input): Parameters<FindInput>,
+        ctx: RequestContext<RoleServer>,
+    ) -> Result<CallToolResult, rmcp::ErrorData> {
+        let t = Instant::now();
+        let user_id = Self::require_user_id(&ctx)?;
+        tracing::info!(
+            tool = "secrets_find",
+            ?user_id,
+            folder = input.folder.as_deref(),
+            entry_type = input.entry_type.as_deref(),
+            name = input.name.as_deref(),
+            query = input.query.as_deref(),
+            "tool call start",
+        );
+        let tags = input.tags.unwrap_or_default();
+        let result = svc_search(
+            &self.pool,
+            SearchParams {
+                folder: input.folder.as_deref(),
+                entry_type: input.entry_type.as_deref(),
+                name: input.name.as_deref(),
+                tags: &tags,
+                query: input.query.as_deref(),
+                sort: "name",
+                limit: input.limit.unwrap_or(20),
+                offset: 0,
+                user_id: Some(user_id),
+            },
+        )
+        .await
+        .map_err(|e| mcp_err_internal_logged("secrets_find", Some(user_id), e))?;
+
+        let entries: Vec<serde_json::Value> = result
+            .entries
+            .iter()
+            .map(|e| {
+                let schema: Vec<&str> = result
+                    .secret_schemas
+                    .get(&e.id)
+                    .map(|f| f.iter().map(|s| s.field_name.as_str()).collect())
+                    .unwrap_or_default();
+                serde_json::json!({
+                    "id": e.id,
+                    "name": e.name,
+                    "folder": e.folder,
+                    "type": e.entry_type,
+                    "tags": e.tags,
+                    "metadata": e.metadata,
+                    "secret_fields": schema,
+                    "updated_at": e.updated_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+                })
+            })
+            .collect();
+
+        tracing::info!(
+            tool = "secrets_find",
+            ?user_id,
+            result_count = entries.len(),
+            elapsed_ms = t.elapsed().as_millis(),
+            "tool call ok",
+        );
+        let json = serde_json::to_string_pretty(&entries).unwrap_or_else(|_| "[]".to_string());
+        Ok(CallToolResult::success(vec![Content::text(json)]))
+    }
+
    #[tool(
        description = "Search entries in the secrets store. Requires Bearer API key. Returns \
-        entries with metadata and secret field names (not values). Use secrets_get to decrypt secret values.",
+        entries with metadata and secret field names (not values). \
+        Prefer secrets_find for discovery; secrets_search is kept for backward compatibility.",
        annotations(
            title = "Search Secrets",
            read_only_hint = true,
@@ -401,8 +551,8 @@ impl SecretsService {
    }

    #[tool(
-        description = "Get decrypted secret field values for an entry. Requires your \
-        encryption key via X-Encryption-Key header (64 hex chars, PBKDF2-derived). \
+        description = "Get decrypted secret field values for an entry identified by its UUID \
+        (from secrets_find). Requires X-Encryption-Key header. \
        Returns all fields, or a specific field if 'field' is provided.",
        annotations(
            title = "Get Secret Values",
@@ -417,29 +567,23 @@ impl SecretsService {
    ) -> Result<CallToolResult, rmcp::ErrorData> {
        let t = Instant::now();
        let (user_id, user_key) = Self::require_user_and_key(&ctx)?;
+        let entry_id = parse_uuid(&input.id)?;
        tracing::info!(
            tool = "secrets_get",
-            ?user_id,
-            name = %input.name,
+            id = %input.id,
            field = input.field.as_deref(),
            "tool call start",
        );

        if let Some(field_name) = &input.field {
-            let value = get_secret_field(
-                &self.pool,
-                &input.name,
-                input.folder.as_deref(),
-                field_name,
-                &user_key,
-                Some(user_id),
-            )
-            .await
-            .map_err(|e| mcp_err_internal_logged("secrets_get", Some(user_id), e))?;
+            let value =
+                get_secret_field_by_id(&self.pool, entry_id, field_name, &user_key, Some(user_id))
+                    .await
+                    .map_err(|e| mcp_err_internal_logged("secrets_get", None, e))?;

            tracing::info!(
                tool = "secrets_get",
-                ?user_id,
+                id = %input.id,
                elapsed_ms = t.elapsed().as_millis(),
                "tool call ok",
            );
@@ -447,21 +591,14 @@ impl SecretsService {
            let json = serde_json::to_string_pretty(&result).unwrap_or_default();
            Ok(CallToolResult::success(vec![Content::text(json)]))
        } else {
-            let secrets = get_all_secrets(
-                &self.pool,
-                &input.name,
-                input.folder.as_deref(),
-                &user_key,
-                Some(user_id),
-            )
-            .await
-            .map_err(|e| mcp_err_internal_logged("secrets_get", Some(user_id), e))?;
+            let secrets = get_all_secrets_by_id(&self.pool, entry_id, &user_key, Some(user_id))
+                .await
+                .map_err(|e| mcp_err_internal_logged("secrets_get", None, e))?;

-            let count = secrets.len();
            tracing::info!(
-                tool = "secrets_get",
-                ?user_id,
-                field_count = count,
+            tool = "secrets_get",
+            id = %entry_id,
+            field_count = secrets.len(),
                elapsed_ms = t.elapsed().as_millis(),
                "tool call ok",
            );
@@ -473,7 +610,8 @@ impl SecretsService {
    #[tool(
        description = "Add or upsert an entry with metadata and encrypted secret fields. \
        Requires X-Encryption-Key header. \
-        Meta and secret values use 'key=value', 'key=@file', or 'key:=<json>' format.",
+        Meta and secret values use 'key=value', 'key=@file', or 'key:=<json>' format, \
+        or pass a JSON object via meta_obj / secrets_obj.",
        annotations(title = "Add Secret Entry")
    )]
    async fn secrets_add(
@@ -493,8 +631,14 @@ impl SecretsService {
        );

        let tags = input.tags.unwrap_or_default();
-        let meta = input.meta.unwrap_or_default();
-        let secrets = input.secrets.unwrap_or_default();
+        let mut meta = input.meta.unwrap_or_default();
+        if let Some(obj) = input.meta_obj {
+            meta.extend(map_to_kv_strings(obj));
+        }
+        let mut secrets = input.secrets.unwrap_or_default();
+        if let Some(obj) = input.secrets_obj {
+            secrets.extend(map_to_kv_strings(obj));
+        }
        let folder = input.folder.as_deref().unwrap_or("");
        let entry_type = input.entry_type.as_deref().unwrap_or("");
        let notes = input.notes.as_deref().unwrap_or("");
@@ -529,7 +673,8 @@ impl SecretsService {

    #[tool(
        description = "Incrementally update an existing entry. Requires X-Encryption-Key header. \
-        Only the fields you specify are changed; everything else is preserved.",
+        Only the fields you specify are changed; everything else is preserved. \
+        Optionally pass 'id' (from secrets_find) to target the entry directly.",
        annotations(title = "Update Secret Entry")
    )]
    async fn secrets_update(
@@ -543,21 +688,40 @@ impl SecretsService {
            tool = "secrets_update",
            ?user_id,
            name = %input.name,
+            id = ?input.id,
            "tool call start",
        );

+        // When id is provided, resolve to (name, folder) via primary key to skip disambiguation.
+        let (resolved_name, resolved_folder): (String, Option<String>) =
+            if let Some(ref id_str) = input.id {
+                let eid = parse_uuid(id_str)?;
+                let entry = resolve_entry_by_id(&self.pool, eid, Some(user_id))
+                    .await
+                    .map_err(|e| mcp_err_internal_logged("secrets_update", Some(user_id), e))?;
+                (entry.name, Some(entry.folder))
+            } else {
+                (input.name.clone(), input.folder.clone())
+            };
+
        let add_tags = input.add_tags.unwrap_or_default();
        let remove_tags = input.remove_tags.unwrap_or_default();
-        let meta = input.meta.unwrap_or_default();
+        let mut meta = input.meta.unwrap_or_default();
+        if let Some(obj) = input.meta_obj {
+            meta.extend(map_to_kv_strings(obj));
+        }
        let remove_meta = input.remove_meta.unwrap_or_default();
-        let secrets = input.secrets.unwrap_or_default();
+        let mut secrets = input.secrets.unwrap_or_default();
+        if let Some(obj) = input.secrets_obj {
+            secrets.extend(map_to_kv_strings(obj));
+        }
        let remove_secrets = input.remove_secrets.unwrap_or_default();

        let result = svc_update(
            &self.pool,
            UpdateParams {
-                name: &input.name,
-                folder: input.folder.as_deref(),
+                name: &resolved_name,
+                folder: resolved_folder.as_deref(),
                notes: input.notes.as_deref(),
                add_tags: &add_tags,
                remove_tags: &remove_tags,
@@ -575,7 +739,7 @@ impl SecretsService {
        tracing::info!(
            tool = "secrets_update",
            ?user_id,
-            name = %input.name,
+            name = %resolved_name,
            elapsed_ms = t.elapsed().as_millis(),
            "tool call ok",
        );
@@ -584,8 +748,9 @@ impl SecretsService {
    }

    #[tool(
-        description = "Delete one entry by name, or bulk delete entries matching folder and/or type. \
-        Use dry_run=true to preview.",
+        description = "Delete one entry by name (or id), or bulk delete entries matching folder \
+        and/or type. Use dry_run=true to preview. \
+        At least one of id, name, folder, or type must be provided.",
        annotations(title = "Delete Secret Entry", destructive_hint = true)
    )]
    async fn secrets_delete(
@@ -595,9 +760,23 @@ impl SecretsService {
    ) -> Result<CallToolResult, rmcp::ErrorData> {
        let t = Instant::now();
        let user_id = Self::user_id_from_ctx(&ctx)?;
+
+        // Safety: require at least one filter.
+        if input.id.is_none()
+            && input.name.is_none()
+            && input.folder.is_none()
+            && input.entry_type.is_none()
+        {
+            return Err(rmcp::ErrorData::invalid_request(
+                "At least one of id, name, folder, or type must be provided.",
+                None,
+            ));
+        }
+
        tracing::info!(
            tool = "secrets_delete",
            ?user_id,
+            id = ?input.id,
            name = input.name.as_deref(),
            folder = input.folder.as_deref(),
            entry_type = input.entry_type.as_deref(),
@@ -605,11 +784,24 @@ impl SecretsService {
            "tool call start",
        );

+        // When id is provided, resolve to name+folder for the single-entry delete path.
+        let (effective_name, effective_folder): (Option<String>, Option<String>) =
+            if let Some(ref id_str) = input.id {
+                let eid = parse_uuid(id_str)?;
+                let uid = user_id;
+                let entry = resolve_entry_by_id(&self.pool, eid, uid)
+                    .await
+                    .map_err(|e| mcp_err_internal_logged("secrets_delete", uid, e))?;
+                (Some(entry.name), Some(entry.folder))
+            } else {
+                (input.name.clone(), input.folder.clone())
+            };
+
        let result = svc_delete(
            &self.pool,
            DeleteParams {
-                name: input.name.as_deref(),
-                folder: input.folder.as_deref(),
+                name: effective_name.as_deref(),
+                folder: effective_folder.as_deref(),
                entry_type: input.entry_type.as_deref(),
                dry_run: input.dry_run.unwrap_or(false),
                user_id,
@@ -630,7 +822,7 @@ impl SecretsService {

    #[tool(
        description = "View change history for an entry. Returns a list of versions with \
-        actions and timestamps.",
+        actions and timestamps. Optionally pass 'id' (from secrets_find) to target directly.",
        annotations(
            title = "View Secret History",
            read_only_hint = true,
@@ -648,13 +840,25 @@ impl SecretsService {
            tool = "secrets_history",
            ?user_id,
            name = %input.name,
+            id = ?input.id,
            "tool call start",
        );

+        let (resolved_name, resolved_folder): (String, Option<String>) =
+            if let Some(ref id_str) = input.id {
+                let eid = parse_uuid(id_str)?;
+                let entry = resolve_entry_by_id(&self.pool, eid, user_id)
+                    .await
+                    .map_err(|e| mcp_err_internal_logged("secrets_history", user_id, e))?;
+                (entry.name, Some(entry.folder))
+            } else {
+                (input.name.clone(), input.folder.clone())
+            };
+
        let result = svc_history(
            &self.pool,
-            &input.name,
-            input.folder.as_deref(),
+            &resolved_name,
+            resolved_folder.as_deref(),
            input.limit.unwrap_or(20),
            user_id,
        )
@@ -673,7 +877,8 @@ impl SecretsService {

    #[tool(
        description = "Rollback an entry to a previous version. Requires X-Encryption-Key header. \
-        Omit to_version to restore the most recent snapshot.",
+        Omit to_version to restore the most recent snapshot. \
+        Optionally pass 'id' (from secrets_find) to target directly.",
        annotations(title = "Rollback Secret Entry", destructive_hint = true)
    )]
    async fn secrets_rollback(
@@ -687,14 +892,26 @@ impl SecretsService {
            tool = "secrets_rollback",
            ?user_id,
            name = %input.name,
+            id = ?input.id,
            to_version = input.to_version,
            "tool call start",
        );

+        let (resolved_name, resolved_folder): (String, Option<String>) =
+            if let Some(ref id_str) = input.id {
+                let eid = parse_uuid(id_str)?;
+                let entry = resolve_entry_by_id(&self.pool, eid, Some(user_id))
+                    .await
+                    .map_err(|e| mcp_err_internal_logged("secrets_rollback", Some(user_id), e))?;
+                (entry.name, Some(entry.folder))
+            } else {
+                (input.name.clone(), input.folder.clone())
+            };
+
        let result = svc_rollback(
            &self.pool,
-            &input.name,
-            input.folder.as_deref(),
+            &resolved_name,
+            resolved_folder.as_deref(),
            input.to_version,
            &user_key,
            Some(user_id),
@@ -784,7 +1001,10 @@ impl SecretsService {
    #[tool(
        description = "Build the environment variable map from entry secrets with decrypted \
        plaintext values. Requires X-Encryption-Key header. \
-        Returns a JSON object of VAR_NAME -> plaintext_value ready for injection.",
+        Returns a JSON object of VAR_NAME -> plaintext_value ready for injection. \
+        Variable names follow the pattern UPPER(entry_name)_UPPER(field_name), \
+        with hyphens and dots replaced by underscores. \
+        Example: entry 'aliyun', field 'access_key_id' → ALIYUN_ACCESS_KEY_ID.",
        annotations(title = "Build Env Map", read_only_hint = true, idempotent_hint = true)
    )]
    async fn secrets_env_map(
@@ -830,6 +1050,67 @@ impl SecretsService {
        let json = serde_json::to_string_pretty(&env_map).unwrap_or_default();
        Ok(CallToolResult::success(vec![Content::text(json)]))
    }
+
+    #[tool(
+        description = "Get an overview of the secrets store: counts of entries per folder and \
+        per type. Requires Bearer API key. Useful for exploring the store structure.",
+        annotations(
+            title = "Secrets Overview",
+            read_only_hint = true,
+            idempotent_hint = true
+        )
+    )]
+    async fn secrets_overview(
+        &self,
+        Parameters(_input): Parameters<OverviewInput>,
+        ctx: RequestContext<RoleServer>,
+    ) -> Result<CallToolResult, rmcp::ErrorData> {
+        let t = Instant::now();
+        let user_id = Self::require_user_id(&ctx)?;
+        tracing::info!(tool = "secrets_overview", ?user_id, "tool call start");
+
+        #[derive(sqlx::FromRow)]
+        struct CountRow {
+            name: String,
+            count: i64,
+        }
+
+        let folder_rows: Vec<CountRow> = sqlx::query_as(
+            "SELECT folder AS name, COUNT(*) AS count FROM entries \
+             WHERE user_id = $1 GROUP BY folder ORDER BY folder",
+        )
+        .bind(user_id)
+        .fetch_all(&*self.pool)
+        .await
+        .map_err(|e| mcp_err_internal_logged("secrets_overview", Some(user_id), e))?;
+
+        let type_rows: Vec<CountRow> = sqlx::query_as(
+            "SELECT type AS name, COUNT(*) AS count FROM entries \
+             WHERE user_id = $1 GROUP BY type ORDER BY type",
+        )
+        .bind(user_id)
+        .fetch_all(&*self.pool)
+        .await
+        .map_err(|e| mcp_err_internal_logged("secrets_overview", Some(user_id), e))?;
+
+        let total: i64 = folder_rows.iter().map(|r| r.count).sum();
+
+        let result = serde_json::json!({
+            "total": total,
+            "folders": folder_rows.iter().map(|r| serde_json::json!({"name": r.name, "count": r.count})).collect::<Vec<_>>(),
+            "types": type_rows.iter().map(|r| serde_json::json!({"name": r.name, "count": r.count})).collect::<Vec<_>>(),
+        });
+
+        tracing::info!(
+            tool = "secrets_overview",
+            ?user_id,
+            total,
+            elapsed_ms = t.elapsed().as_millis(),
+            "tool call ok",
+        );
+        let json = serde_json::to_string_pretty(&result).unwrap_or_default();
+        Ok(CallToolResult::success(vec![Content::text(json)]))
+    }
 }

 // ── ServerHandler ─────────────────────────────────────────────────────────────
@@ -846,11 +1127,11 @@ impl ServerHandler for SecretsService {
        info.protocol_version = ProtocolVersion::V_2025_06_18;
        info.instructions = Some(
            "Manage cross-device secrets and configuration securely. \
-             Data is encrypted with your passphrase-derived key. \
-             Include your 64-char hex key in the X-Encryption-Key header for all read/write operations. \
-             Use secrets_search to discover entries (Bearer token required; encryption key not needed), \
-             secrets_get to decrypt secret values, \
-             and secrets_add/secrets_update to write encrypted secrets."
+             Use secrets_find to discover entries by folder, name, type, tags, or query \
+             (query also searches metadata values). \
+             Use secrets_get with the entry id (from secrets_find) to decrypt secret values. \
+             Use secrets_add / secrets_update to write entries. \
+             Use secrets_overview for a quick count of entries per folder and type."
                .to_string(),
        );
        info
--- a/crates/secrets-mcp/src/web.rs
+++ b/crates/secrets-mcp/src/web.rs
@@ -19,6 +19,7 @@ use secrets_core::crypto::hex;
 use secrets_core::service::{
    api_key::{ensure_api_key, regenerate_api_key},
    audit_log::list_for_user,
+    search::{SearchParams, count_entries, list_entries},
    user::{
        OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
        unbind_oauth_account, update_user_key_setup,
@@ -78,6 +79,33 @@ struct AuditEntryView {
    detail: String,
 }

+#[derive(Template)]
+#[template(path = "entries.html")]
+struct EntriesPageTemplate {
+    user_name: String,
+    user_email: String,
+    entries: Vec<EntryListItemView>,
+    total_count: i64,
+    shown_count: usize,
+    limit: u32,
+    version: &'static str,
+}
+
+/// Non-sensitive fields only (no `secrets` / ciphertext).
+struct EntryListItemView {
+    folder: String,
+    entry_type: String,
+    name: String,
+    notes: String,
+    tags: String,
+    metadata: String,
+    /// RFC3339 UTC for `<time datetime>`; localized in entries.html.
+    updated_at_iso: String,
+}
+
+/// Cap for HTML list (avoids loading unbounded rows into memory).
+const ENTRIES_PAGE_LIMIT: u32 = 5_000;
+
 // ── App state helpers ─────────────────────────────────────────────────────────

 fn google_cfg(state: &AppState) -> Option<&OAuthConfig> {
@@ -149,6 +177,7 @@ pub fn web_router() -> Router<AppState> {
        .route("/auth/google/callback", get(auth_google_callback))
        .route("/auth/logout", post(auth_logout))
        .route("/dashboard", get(dashboard))
+        .route("/entries", get(entries_page))
        .route("/audit", get(audit_page))
        .route("/account/bind/google", get(account_bind_google))
        .route(
@@ -478,6 +507,72 @@ async fn dashboard(
    render_template(tmpl)
 }

+async fn entries_page(
+    State(state): State<AppState>,
+    session: Session,
+) -> Result<Response, StatusCode> {
+    let Some(user_id) = current_user_id(&session).await else {
+        return Ok(Redirect::to("/login").into_response());
+    };
+
+    let user = match get_user_by_id(&state.pool, user_id).await.map_err(|e| {
+        tracing::error!(error = %e, %user_id, "failed to load user for entries page");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })? {
+        Some(u) => u,
+        None => return Ok(Redirect::to("/login").into_response()),
+    };
+
+    let params = SearchParams {
+        folder: None,
+        entry_type: None,
+        name: None,
+        tags: &[],
+        query: None,
+        sort: "updated",
+        limit: ENTRIES_PAGE_LIMIT,
+        offset: 0,
+        user_id: Some(user_id),
+    };
+
+    let total_count = count_entries(&state.pool, &params).await.map_err(|e| {
+        tracing::error!(error = %e, "failed to count entries for web");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+
+    let rows = list_entries(&state.pool, params).await.map_err(|e| {
+        tracing::error!(error = %e, "failed to load entries list for web");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    let shown_count = rows.len();
+
+    let entries = rows
+        .into_iter()
+        .map(|e| EntryListItemView {
+            folder: e.folder,
+            entry_type: e.entry_type,
+            name: e.name,
+            notes: e.notes,
+            tags: e.tags.join(", "),
+            metadata: serde_json::to_string_pretty(&e.metadata)
+                .unwrap_or_else(|_| "{}".to_string()),
+            updated_at_iso: e.updated_at.to_rfc3339_opts(SecondsFormat::Secs, true),
+        })
+        .collect();
+
+    let tmpl = EntriesPageTemplate {
+        user_name: user.name.clone(),
+        user_email: user.email.clone().unwrap_or_default(),
+        entries,
+        total_count,
+        shown_count,
+        limit: ENTRIES_PAGE_LIMIT,
+        version: env!("CARGO_PKG_VERSION"),
+    };
+
+    render_template(tmpl)
+}
+
 async fn audit_page(
    State(state): State<AppState>,
    session: Session,
--- a/crates/secrets-mcp/templates/audit.html
+++ b/crates/secrets-mcp/templates/audit.html
@@ -92,6 +92,7 @@
    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
    <nav class="sidebar-menu">
        <a href="/dashboard" class="sidebar-link">MCP</a>
+        <a href="/entries" class="sidebar-link">条目</a>
        <a href="/audit" class="sidebar-link active">审计</a>
    </nav>
 </aside>
--- a/crates/secrets-mcp/templates/dashboard.html
+++ b/crates/secrets-mcp/templates/dashboard.html
@@ -174,6 +174,7 @@
    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
    <nav class="sidebar-menu">
        <a href="/dashboard" class="sidebar-link active">MCP</a>
+        <a href="/entries" class="sidebar-link">条目</a>
        <a href="/audit" class="sidebar-link">审计</a>
    </nav>
 </aside>
--- a/crates/secrets-mcp/templates/entries.html
+++ b/crates/secrets-mcp/templates/entries.html
@@ -0,0 +1,170 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link rel="icon" href="/favicon.svg?v={{ version }}" type="image/svg+xml">
+    <title>Secrets — 条目</title>
+    <style>
+        *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+        @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600&family=Inter:wght@400;500;600&display=swap');
+        :root {
+            --bg: #0d1117; --surface: #161b22; --surface2: #21262d;
+            --border: #30363d; --text: #e6edf3; --text-muted: #8b949e;
+            --accent: #58a6ff; --accent-hover: #79b8ff;
+        }
+        body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }
+        .layout { display: flex; min-height: 100vh; }
+        .sidebar {
+            width: 220px; flex-shrink: 0; background: var(--surface); border-right: 1px solid var(--border);
+            padding: 24px 16px; display: flex; flex-direction: column; gap: 20px;
+        }
+        .sidebar-logo { font-family: 'JetBrains Mono', monospace; font-size: 16px; font-weight: 600;
+                        color: var(--text); text-decoration: none; padding: 0 10px; }
+        .sidebar-logo span { color: var(--accent); }
+        .sidebar-menu { display: flex; flex-direction: column; gap: 6px; }
+        .sidebar-link {
+            padding: 10px 12px; border-radius: 8px; color: var(--text-muted); text-decoration: none;
+            border: 1px solid transparent; font-size: 13px; font-weight: 500;
+        }
+        .sidebar-link:hover { background: var(--surface2); color: var(--text); }
+        .sidebar-link.active {
+            background: rgba(88,166,255,0.12); color: var(--text); border-color: rgba(88,166,255,0.35);
+        }
+        .content-shell { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+        .topbar {
+            background: var(--surface); border-bottom: 1px solid var(--border); padding: 0 24px;
+            display: flex; align-items: center; gap: 12px; min-height: 52px;
+        }
+        .topbar-spacer { flex: 1; }
+        .nav-user { font-size: 13px; color: var(--text-muted); }
+        .btn-sign-out {
+            padding: 5px 12px; border-radius: 6px; border: 1px solid var(--border);
+            background: none; color: var(--text); font-size: 12px; text-decoration: none; cursor: pointer;
+        }
+        .btn-sign-out:hover { background: var(--surface2); }
+        .main { padding: 32px 24px 40px; flex: 1; }
+        .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
+                padding: 24px; width: 100%; max-width: 1280px; margin: 0 auto; }
+        .card-title { font-size: 20px; font-weight: 600; margin-bottom: 8px; }
+        .card-subtitle { color: var(--text-muted); font-size: 13px; margin-bottom: 20px; }
+        .empty { color: var(--text-muted); font-size: 14px; padding: 20px 0; }
+        .table-wrap { overflow-x: auto; }
+        table { width: 100%; border-collapse: collapse; min-width: 720px; }
+        th, td { text-align: left; vertical-align: top; padding: 12px 10px; border-top: 1px solid var(--border); }
+        th { color: var(--text-muted); font-size: 12px; font-weight: 600; white-space: nowrap; }
+        td { font-size: 13px; }
+        .mono { font-family: 'JetBrains Mono', monospace; }
+        .cell-notes, .cell-meta {
+            max-width: 280px; word-break: break-word;
+        }
+        .detail {
+            background: var(--bg); border: 1px solid var(--border); border-radius: 8px;
+            padding: 10px; white-space: pre-wrap; word-break: break-word; font-size: 12px;
+            max-width: 320px; max-height: 160px; overflow: auto;
+        }
+        @media (max-width: 900px) {
+            .layout { flex-direction: column; }
+            .sidebar {
+                width: 100%; border-right: none; border-bottom: 1px solid var(--border);
+                padding: 16px; gap: 14px;
+            }
+            .sidebar-menu { flex-direction: row; flex-wrap: wrap; }
+            .sidebar-link { flex: 1; text-align: center; min-width: 72px; }
+            .main { padding: 20px 12px 28px; }
+            .card { padding: 16px; }
+            .topbar { padding: 12px 16px; flex-wrap: wrap; }
+            table, thead, tbody, th, td, tr { display: block; }
+            thead { display: none; }
+            tr { border-top: 1px solid var(--border); padding: 12px 0; }
+            td { border-top: none; padding: 6px 0; max-width: none; }
+            td::before {
+                display: block; color: var(--text-muted); font-size: 11px;
+                margin-bottom: 4px; text-transform: uppercase;
+            }
+            td.col-updated::before { content: "更新"; }
+            td.col-folder::before { content: "Folder"; }
+            td.col-type::before { content: "Type"; }
+            td.col-name::before { content: "Name"; }
+            td.col-notes::before { content: "Notes"; }
+            td.col-tags::before { content: "Tags"; }
+            td.col-meta::before { content: "Metadata"; }
+            .detail { max-width: none; }
+        }
+    </style>
+</head>
+<body>
+<div class="layout">
+<aside class="sidebar">
+    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
+    <nav class="sidebar-menu">
+        <a href="/dashboard" class="sidebar-link">MCP</a>
+        <a href="/entries" class="sidebar-link active">条目</a>
+        <a href="/audit" class="sidebar-link">审计</a>
+    </nav>
+</aside>
+
+<div class="content-shell">
+<div class="topbar">
+    <span class="topbar-spacer"></span>
+    <span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
+    <form action="/auth/logout" method="post" style="display:inline">
+        <button type="submit" class="btn-sign-out">退出</button>
+    </form>
+</div>
+
+<main class="main">
+    <section class="card">
+        <div class="card-title">我的条目</div>
+        <div class="card-subtitle">共 <strong>{{ total_count }}</strong> 条记录；当前列表显示 <strong>{{ shown_count }}</strong> 条（按更新时间降序，单页最多 {{ limit }} 条）。不含密文字段。时间为浏览器本地时区。</div>
+
+        {% if entries.is_empty() %}
+        <div class="empty">暂无条目。</div>
+        {% else %}
+        <div class="table-wrap">
+        <table>
+            <thead>
+                <tr>
+                    <th>更新</th>
+                    <th>Folder</th>
+                    <th>Type</th>
+                    <th>Name</th>
+                    <th>Notes</th>
+                    <th>Tags</th>
+                    <th>Metadata</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for entry in entries %}
+                <tr>
+                    <td class="col-updated mono"><time class="entry-local-time" datetime="{{ entry.updated_at_iso }}">{{ entry.updated_at_iso }}</time></td>
+                    <td class="col-folder mono">{{ entry.folder }}</td>
+                    <td class="col-type mono">{{ entry.entry_type }}</td>
+                    <td class="col-name mono">{{ entry.name }}</td>
+                    <td class="col-notes cell-notes">{{ entry.notes }}</td>
+                    <td class="col-tags mono">{{ entry.tags }}</td>
+                    <td class="col-meta cell-meta"><pre class="detail">{{ entry.metadata }}</pre></td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        </div>
+        {% endif %}
+    </section>
+</main>
+</div>
+</div>
+<script>
+(function () {
+  document.querySelectorAll('time.entry-local-time[datetime]').forEach(function (el) {
+    var raw = el.getAttribute('datetime');
+    var d = raw ? new Date(raw) : null;
+    if (d && !isNaN(d.getTime())) {
+      el.textContent = d.toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'medium' });
+      el.title = raw + ' (UTC)';
+    }
+  });
+})();
+</script>
+</body>
+</html>
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -3,7 +3,13 @@

 # ─── 数据库 ───────────────────────────────────────────────────────────
 # Web 会话（tower-sessions）与业务数据共用此库；启动时会自动 migrate 会话表，无需额外环境变量。
-SECRETS_DATABASE_URL=postgres://postgres:PASSWORD@HOST:PORT/secrets-mcp
+SECRETS_DATABASE_URL=postgres://postgres:PASSWORD@db.refining.ltd:5432/secrets-mcp
+# 强烈建议生产使用 verify-full（至少 verify-ca）
+SECRETS_DATABASE_SSL_MODE=verify-full
+# 私有 CA 或自建链路时填写 CA 根证书路径；使用公共受信 CA 可留空
+# SECRETS_DATABASE_SSL_ROOT_CERT=/etc/secrets/pg-ca.crt
+# 当设为 prod/production 时，服务会拒绝弱 TLS 模式（prefer/disable/allow/require）
+SECRETS_ENV=production

 # ─── 服务地址 ─────────────────────────────────────────────────────────
 # 内网监听地址（Cloudflare / Nginx 反代时填内网端口）
--- a/deploy/postgres-tls-hardening.md
+++ b/deploy/postgres-tls-hardening.md
@@ -0,0 +1,92 @@
+# PostgreSQL TLS Hardening Runbook
+
+This runbook applies to:
+
+- PostgreSQL server: `47.117.131.22` (`db.refining.ltd`)
+- `secrets-mcp` app server: `47.238.146.244` (`secrets.refining.app`)
+
+## 1) Issue certificate for `db.refining.ltd` (Let's Encrypt + Cloudflare DNS-01)
+
+Install `acme.sh` on the PostgreSQL server and use a Cloudflare API token with DNS edit permission for the target zone.
+
+```bash
+curl https://get.acme.sh | sh -s email=ops@refining.ltd
+export CF_Token="your_cloudflare_dns_token"
+export CF_Zone_ID="your_zone_id"
+~/.acme.sh/acme.sh --issue --dns dns_cf -d db.refining.ltd --keylength ec-256
+```
+
+Install cert/key into a PostgreSQL-readable path:
+
+```bash
+sudo mkdir -p /etc/postgresql/tls
+sudo ~/.acme.sh/acme.sh --install-cert -d db.refining.ltd --ecc \
+  --fullchain-file /etc/postgresql/tls/fullchain.pem \
+  --key-file /etc/postgresql/tls/privkey.pem \
+  --reloadcmd "systemctl reload postgresql || systemctl restart postgresql"
+sudo chown -R postgres:postgres /etc/postgresql/tls
+sudo chmod 600 /etc/postgresql/tls/privkey.pem
+sudo chmod 644 /etc/postgresql/tls/fullchain.pem
+```
+
+## 2) Configure PostgreSQL TLS and access rules
+
+In `postgresql.conf`:
+
+```conf
+ssl = on
+ssl_cert_file = '/etc/postgresql/tls/fullchain.pem'
+ssl_key_file = '/etc/postgresql/tls/privkey.pem'
+```
+
+In `pg_hba.conf`, allow app traffic via TLS only (example):
+
+```conf
+hostssl  secrets-mcp  postgres  47.238.146.244/32  scram-sha-256
+```
+
+Keep a safe admin path (`local` socket or restricted source CIDR) before removing old plaintext `host` rules.
+
+Reload PostgreSQL:
+
+```bash
+sudo systemctl reload postgresql
+```
+
+## 3) Verify server-side TLS
+
+```bash
+openssl s_client -starttls postgres -connect db.refining.ltd:5432 -servername db.refining.ltd
+```
+
+The handshake should succeed and the certificate should match `db.refining.ltd`.
+
+## 4) Update `secrets-mcp` app server env
+
+Use environment values like:
+
+```bash
+SECRETS_DATABASE_URL=postgres://postgres:***@db.refining.ltd:5432/secrets-mcp
+SECRETS_DATABASE_SSL_MODE=verify-full
+SECRETS_ENV=production
+```
+
+If you use private CA instead of public CA, also set:
+
+```bash
+SECRETS_DATABASE_SSL_ROOT_CERT=/etc/secrets/pg-ca.crt
+```
+
+Restart `secrets-mcp` after updating env.
+
+## 5) Verify from app server
+
+Run positive and negative checks:
+
+- Positive: app starts, migrations pass, dashboard + MCP API work.
+- Negative:
+  - wrong hostname -> connection fails
+  - wrong CA file -> connection fails
+  - disable TLS on DB -> connection fails
+
+This ensures no silent downgrade to weak TLS in production.
Author	SHA1	Message	Date
agent	87a29af82d	feat(web): 条目列表页 /entries 与总条数统计 All checks were successful Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 3m56s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Successful in 6s Details - 新增受会话保护的 GET /entries，仅展示 entries 非敏感列 - search: list_entries、count_entries 共享筛选条件；分页与计数不读 secrets - 侧边栏在 dashboard/audit 增加「条目」入口 - secrets-mcp 0.3.4（tag 尚未存在） Made-with: Cursor	2026-04-02 11:26:51 +08:00
agent	1b11f7e976	release(secrets-mcp): v0.3.3 — 强制 PostgreSQL TLS 校验 Some checks failed Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 3m54s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Failing after 7s Details 显式引入数据库 TLS 配置并在生产环境拒绝弱 sslmode，避免连接静默降级。同步更新 deploy/README 与运维 runbook，落地 db.refining.ltd 的证书与服务器配置流程。 Made-with: Cursor	2026-04-01 15:18:14 +08:00
agent	08e81363c9	release(secrets-mcp): v0.3.2 — 修复 key_ref 多租户与歧义 All checks were successful Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 3m41s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Successful in 6s Details - env_map：key_ref 解析传入 user_id；支持 folder/name；多条匹配时报错 - 文档同步 key_ref 说明 - bump secrets-mcp 0.3.1 → 0.3.2，更新 Cargo.lock Made-with: Cursor	2026-03-27 10:45:12 +08:00
voson	beade4503d	release(secrets-mcp): v0.3.1 All checks were successful Secrets MCP — Build & Release / 检查 / 构建 / 发版 (push) Successful in 3m45s Details Secrets MCP — Build & Release / 部署 secrets-mcp (push) Successful in 5s Details - MCP: secrets_find, secrets_overview; secrets_get id-only; id on update/delete/history/rollback - Add meta_obj/secrets_obj; delete guard; env_map/instructions updates - Core: resolve_entry_by_id; get_*_by_id validates entry + tenant before decrypt Made-with: Cursor	2026-03-26 17:35:56 +08:00