bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-10-02 12:54:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

feat(credentials): encrypt the vault at rest (#121)
Some checks failed
CI / build (push) Has been cancelled
Details
test / test (push) Has been cancelled
Details

Browse source 
The vault holds the target's prior values so a bad rotation can be undone
— the one place raw credentials touch disk. It was written as plain JSON
at mode 0600, and a permission bit is all that was protecting it. That
stops another user on the same box. It does nothing about a backup, a
synced home directory, a lifted disk, or any process running as the
owner, and those are the cases where a credential store is worth reading.

Each run is now sealed to this machine's identity: a fresh DEK per write,
the payload sealed with it, the DEK sealed to the identity public key. So
the file opens with the secret key in identity.json and nothing else. The
key names go inside the ciphertext along with the values — knowing that
an endpoint holds STRIPE_LIVE_KEY is worth something by itself.

A DEK per run rather than one for the store: reusing a key would make a
single compromise open every rollback ever captured, and there is nothing
to gain by it, since the wrapped DEK travels in the file.

Plaintext vaults written before this still open. Refusing them would
strand the rollback data they exist to hold, and a vault reader that
cannot read yesterday's vault takes away the thing the vault is for.

The store's vault methods become async, which the three callers in the
engine already sat inside async functions to accommodate.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-07-31 22:55:38 -07:00 • committed by GitHub
parent 36236eb1a3
commit 1e4e9def70
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 178 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

6
plugins/credential-sharing/src/engine.ts
View file

@ -197,7 +197,7 @@ export class CredentialEngine {
const runId = this.id("cred_run");
if (reversible && !dryRun && target.readValues) {
const preImage = await target.readValues(plan.to, [...upsertKeys, ...deleteKeys]);
this.store.saveVault(runId, preImage);
await this.store.saveVault(runId, preImage);
}
const writeResults = await target.write({ endpoint: plan.to, upserts, deletes: deleteKeys, dryRun });
@ -272,7 +272,7 @@ export class CredentialEngine {
if (!run.reversible) {
throw new Error(`Run ${runId} was not reversible (no pre-image captured). Rollbacks require a value-readable target.`);
}
const preImage = this.store.getVault(runId);
const preImage = await this.store.getVault(runId);
if (!preImage) {
throw new Error(`No rollback pre-image found for run ${runId}.`);
}
@ -334,7 +334,7 @@ export class CredentialEngine {
return {};
}
if (plan.rollbackOfRunId) {
const preImage = this.store.getVault(plan.rollbackOfRunId);
const preImage = await this.store.getVault(plan.rollbackOfRunId);
if (!preImage) {
throw new Error(`Rollback plan ${plan.id} references missing vault for run ${plan.rollbackOfRunId}.`);
}