mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-14 06:47:28 +00:00
407 lines
22 KiB
JavaScript
407 lines
22 KiB
JavaScript
// LogicSRC credential sharing API (end-to-end encrypted team vaults).
|
|
//
|
|
// Zero-knowledge: this server only ever stores ciphertext, per-member sealed
|
|
// vault keys, and member identity public keys. All crypto happens in the CLI.
|
|
//
|
|
// Auth: the acting user comes from a browser session (req.user) OR a
|
|
// `Bearer lsk_…` API key (the logicsrc CLI). Mounted at /api/credshare.
|
|
import { Router } from "express";
|
|
import { get, all, run, batch } from "../db.mjs";
|
|
import { id, sha256 } from "../lib/crypto.mjs";
|
|
import { bearer, userForApiKey } from "../lib/apikey.mjs";
|
|
import {
|
|
TeamMemberError,
|
|
normEmail,
|
|
issueTeamInvite,
|
|
changeMemberRole,
|
|
removeTeamMember
|
|
} from "../lib/team-members.mjs";
|
|
|
|
export const credshareRouter = Router();
|
|
|
|
const norm = normEmail;
|
|
const slugify = (s) => {
|
|
const v = String(s || "").trim().toLowerCase();
|
|
return /^[a-z0-9][a-z0-9-]{0,62}$/.test(v) ? v : null;
|
|
};
|
|
|
|
// Resolve the acting user from session or API key.
|
|
async function actor(req) {
|
|
if (req.user) return req.user;
|
|
return userForApiKey(bearer(req));
|
|
}
|
|
function api(handler) {
|
|
return async (req, res) => {
|
|
const user = await actor(req);
|
|
if (!user) return res.status(401).json({ error: "Not authenticated. Run: logicsrc login" });
|
|
try {
|
|
await handler(req, res, user);
|
|
} catch (e) {
|
|
console.error("credshare:", e);
|
|
res.status(500).json({ error: e.message || String(e) });
|
|
}
|
|
};
|
|
}
|
|
|
|
async function requireMember(res, slug, userId) {
|
|
const team = await get(`SELECT * FROM credshare_teams WHERE slug = ?`, [slug]);
|
|
if (!team) { res.status(404).json({ error: `Unknown team: ${slug}` }); return null; }
|
|
const member = await get(`SELECT * FROM credshare_members WHERE team_id = ? AND user_id = ?`, [team.id, userId]);
|
|
if (!member || member.status !== "active") { res.status(403).json({ error: "You are not a member of this team." }); return null; }
|
|
return { team, member };
|
|
}
|
|
|
|
async function publicKeyFor(userId) {
|
|
const r = await get(`SELECT public_key FROM credshare_keys WHERE user_id = ?`, [userId]);
|
|
return r?.public_key ?? null;
|
|
}
|
|
|
|
async function audit(ev) {
|
|
await run(`INSERT INTO credshare_audit (id, team_id, vault_id, actor_user_id, action, key_name, fingerprint, created_at) VALUES (?,?,?,?,?,?,?,?)`,
|
|
[id(), ev.teamId ?? null, ev.vaultId ?? null, ev.actorUserId, ev.action, ev.keyName ?? null, ev.fingerprint ?? null, Date.now()]);
|
|
}
|
|
|
|
// ---- identity key + lookup ----
|
|
credshareRouter.post("/api/credshare/keys", api(async (req, res, user) => {
|
|
const publicKey = req.body?.publicKey;
|
|
if (typeof publicKey !== "string" || !publicKey) return res.status(422).json({ error: "Expected { publicKey }." });
|
|
await run(`INSERT INTO credshare_keys (user_id, public_key, updated_at) VALUES (?,?,?) ON CONFLICT(user_id) DO UPDATE SET public_key = excluded.public_key, updated_at = excluded.updated_at`,
|
|
[user.id, publicKey, Date.now()]);
|
|
res.json({ email: user.email, publicKey });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/me", api(async (_req, res, user) => {
|
|
const teams = await all(`SELECT t.id, t.slug, t.name FROM credshare_teams t JOIN credshare_members m ON m.team_id = t.id WHERE m.user_id = ? AND m.status = 'active'`, [user.id]);
|
|
res.json({ user: { id: user.id, email: user.email, publicKey: await publicKeyFor(user.id) }, teams });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/users", api(async (req, res) => {
|
|
const email = norm(req.query.email);
|
|
if (!email) return res.status(422).json({ error: "Expected ?email=" });
|
|
const u = await get(`SELECT id FROM users WHERE email = ?`, [email]);
|
|
res.json({ email, userId: u?.id ?? null, publicKey: u ? await publicKeyFor(u.id) : null });
|
|
}));
|
|
|
|
// ---- teams / members / invites ----
|
|
credshareRouter.post("/api/credshare/teams", api(async (req, res, user) => {
|
|
const slug = slugify(req.body?.slug);
|
|
if (!slug) return res.status(422).json({ error: "Slug must be lowercase letters, numbers, and dashes." });
|
|
if (await get(`SELECT 1 FROM credshare_teams WHERE slug = ?`, [slug])) return res.status(409).json({ error: `Team slug "${slug}" is taken.` });
|
|
const team = { id: id(), slug, name: (req.body?.name && String(req.body.name)) || slug, createdBy: user.id, createdAt: Date.now() };
|
|
await run(`INSERT INTO credshare_teams (id, slug, name, created_by, created_at) VALUES (?,?,?,?,?)`, [team.id, team.slug, team.name, team.createdBy, team.createdAt]);
|
|
await run(`INSERT INTO credshare_members (id, team_id, user_id, email, role, status, joined_at, created_at) VALUES (?,?,?,?,?,?,?,?)`,
|
|
[id(), team.id, user.id, norm(user.email) || user.id, "owner", "active", Date.now(), Date.now()]);
|
|
await audit({ teamId: team.id, actorUserId: user.id, action: "team:create" });
|
|
res.status(201).json({ team: { id: team.id, slug: team.slug, name: team.name } });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/teams", api(async (_req, res, user) => {
|
|
const teams = await all(`SELECT t.id, t.slug, t.name FROM credshare_teams t JOIN credshare_members m ON m.team_id = t.id WHERE m.user_id = ? AND m.status = 'active' ORDER BY t.created_at`, [user.id]);
|
|
res.json({ teams });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/teams/:slug/members", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
const rows = await all(`SELECT * FROM credshare_members WHERE team_id = ? ORDER BY created_at`, [ctx.team.id]);
|
|
const members = [];
|
|
for (const m of rows) members.push({ id: m.id, email: m.email, role: m.role, status: m.status, hasPublicKey: m.user_id ? Boolean(await publicKeyFor(m.user_id)) : false, joinedAt: m.joined_at });
|
|
res.json({ members });
|
|
}));
|
|
|
|
credshareRouter.post("/api/credshare/teams/:slug/invites", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
try {
|
|
const result = await issueTeamInvite({
|
|
team: ctx.team,
|
|
actor: { ...ctx.member, email: user.email },
|
|
email: req.body?.email,
|
|
role: req.body?.role
|
|
});
|
|
res.status(201).json({
|
|
invite: result.invite,
|
|
emailSent: result.emailSent,
|
|
resent: result.resent,
|
|
...(result.emailSent ? {} : { token: result.token })
|
|
});
|
|
} catch (error) {
|
|
if (error instanceof TeamMemberError) return res.status(error.status).json({ error: error.message, code: error.code });
|
|
throw error;
|
|
}
|
|
}));
|
|
|
|
credshareRouter.patch("/api/credshare/teams/:slug/members/:memberId", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
try {
|
|
const member = await changeMemberRole({
|
|
team: ctx.team,
|
|
actor: ctx.member,
|
|
memberId: req.params.memberId,
|
|
role: req.body?.role
|
|
});
|
|
res.json({ member: { id: member.id, email: member.email, role: member.role, status: member.status } });
|
|
} catch (error) {
|
|
if (error instanceof TeamMemberError) return res.status(error.status).json({ error: error.message, code: error.code });
|
|
throw error;
|
|
}
|
|
}));
|
|
|
|
credshareRouter.delete("/api/credshare/teams/:slug/members/:memberId", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
try {
|
|
const result = await removeTeamMember({ team: ctx.team, actor: ctx.member, memberId: req.params.memberId });
|
|
res.json({
|
|
ok: true,
|
|
removed: result.member.email,
|
|
revokedVaultGrants: result.revokedVaultGrants,
|
|
rotationRequired: result.rotationRequired
|
|
});
|
|
} catch (error) {
|
|
if (error instanceof TeamMemberError) return res.status(error.status).json({ error: error.message, code: error.code });
|
|
throw error;
|
|
}
|
|
}));
|
|
|
|
credshareRouter.post("/api/credshare/invites/accept", api(async (req, res, user) => {
|
|
const raw = req.body?.token;
|
|
if (!raw) return res.status(422).json({ error: "Expected { token }." });
|
|
const invite = await get(`SELECT * FROM credshare_invites WHERE token_hash = ?`, [sha256(String(raw))]);
|
|
if (!invite) return res.status(404).json({ error: "Invite not found." });
|
|
if (invite.accepted_at) return res.status(409).json({ error: "Invite already used." });
|
|
if (invite.expires_at < Date.now()) return res.status(410).json({ error: "Invite expired." });
|
|
if (norm(invite.email) !== norm(user.email)) return res.status(403).json({ error: `This invite is for ${invite.email}, not ${user.email}.` });
|
|
await run(`UPDATE credshare_members SET user_id = ?, status = 'active', joined_at = ? WHERE team_id = ? AND email = ?`, [user.id, Date.now(), invite.team_id, norm(invite.email)]);
|
|
await run(`UPDATE credshare_invites SET accepted_at = ? WHERE id = ?`, [Date.now(), invite.id]);
|
|
await audit({ teamId: invite.team_id, actorUserId: user.id, action: "team:join" });
|
|
const team = await get(`SELECT id, slug, name FROM credshare_teams WHERE id = ?`, [invite.team_id]);
|
|
res.json({ ok: true, team });
|
|
}));
|
|
|
|
// ---- vaults ----
|
|
credshareRouter.get("/api/credshare/teams/:slug/vaults", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
// One statement, not one per vault. libSQL is remote, so every execute() is a
|
|
// network round trip: the previous loop cost 2N+1 of them, and a team with 176
|
|
// vaults spent ~10s here -- doubled by `teams pull`, which resolves the vault
|
|
// id twice. Both correlated subqueries are covered by existing primary keys
|
|
// (credshare_secrets is keyed (vault_id, name), grants (vault_id, user_id)),
|
|
// so this is an index scan per vault inside the database rather than a
|
|
// round trip per vault across the network.
|
|
const vaults = await all(
|
|
`SELECT v.id,
|
|
v.name,
|
|
(SELECT COUNT(*) FROM credshare_secrets s
|
|
WHERE s.vault_id = v.id) AS secret_count,
|
|
EXISTS(SELECT 1 FROM credshare_vault_grants g
|
|
WHERE g.vault_id = v.id AND g.user_id = ?) AS has_access
|
|
FROM credshare_vaults v
|
|
WHERE v.team_id = ?
|
|
ORDER BY v.name`,
|
|
[user.id, ctx.team.id]
|
|
);
|
|
res.json({
|
|
vaults: vaults.map((v) => ({
|
|
id: v.id,
|
|
name: v.name,
|
|
hasAccess: Boolean(v.has_access),
|
|
secretCount: Number(v.secret_count || 0)
|
|
}))
|
|
});
|
|
}));
|
|
|
|
credshareRouter.post("/api/credshare/teams/:slug/vaults", api(async (req, res, user) => {
|
|
const ctx = await requireMember(res, req.params.slug, user.id); if (!ctx) return;
|
|
const name = slugify(req.body?.name);
|
|
if (!name) return res.status(422).json({ error: "Vault name must be lowercase letters, numbers, and dashes." });
|
|
const existing = await get(`SELECT id, name FROM credshare_vaults WHERE team_id = ? AND name = ?`, [ctx.team.id, name]);
|
|
if (existing) return res.json({ vault: { id: existing.id, name: existing.name } });
|
|
const vault = { id: id(), name };
|
|
await run(`INSERT INTO credshare_vaults (id, team_id, name, created_by, created_at) VALUES (?,?,?,?,?)`, [vault.id, ctx.team.id, name, user.id, Date.now()]);
|
|
await audit({ teamId: ctx.team.id, vaultId: vault.id, actorUserId: user.id, action: "vault:create" });
|
|
res.status(201).json({ vault });
|
|
}));
|
|
|
|
// ---- vault grants / secrets / audit (by vault id) ----
|
|
async function vaultCtx(res, vaultId, userId) {
|
|
const vault = await get(`SELECT * FROM credshare_vaults WHERE id = ?`, [vaultId]);
|
|
if (!vault) { res.status(404).json({ error: "Unknown vault." }); return null; }
|
|
const member = await get(`SELECT * FROM credshare_members WHERE team_id = ? AND user_id = ?`, [vault.team_id, userId]);
|
|
if (!member || member.status !== "active") { res.status(403).json({ error: "You are not a member of this vault's team." }); return null; }
|
|
return vault;
|
|
}
|
|
|
|
credshareRouter.get("/api/credshare/vaults/:id/grant", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const grant = await get(`SELECT wrapped_dek FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, [vault.id, user.id]);
|
|
if (!grant) return res.status(403).json({ error: "You do not have access to this vault yet. Ask a member to grant you." });
|
|
res.json({ wrappedDek: grant.wrapped_dek });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/vaults/:id/grants", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const granted = new Set((await all(`SELECT user_id FROM credshare_vault_grants WHERE vault_id = ?`, [vault.id])).map((r) => r.user_id));
|
|
const members = await all(`SELECT * FROM credshare_members WHERE team_id = ?`, [vault.team_id]);
|
|
const grants = [];
|
|
for (const m of members) {
|
|
// The public key is included so a client can re-seal the vault key to every
|
|
// member in one pass (see rekey). Public keys are public by construction --
|
|
// they exist to be sealed against -- and this route is already member-only.
|
|
const publicKey = m.user_id ? await publicKeyFor(m.user_id) : null;
|
|
grants.push({
|
|
email: m.email,
|
|
publicKey,
|
|
status: m.status,
|
|
hasPublicKey: Boolean(publicKey),
|
|
hasAccess: Boolean(m.user_id && granted.has(m.user_id))
|
|
});
|
|
}
|
|
res.json({ grants });
|
|
}));
|
|
|
|
// Re-key a vault: swap in a fresh DEK, re-seal it to the members who keep
|
|
// access, and re-encrypt every secret under it. Values do not change, which the
|
|
// server enforces by requiring each submitted fingerprint to equal the stored
|
|
// one -- it cannot see values, but it can prove they were not swapped.
|
|
//
|
|
// This is ONE transaction on purpose. The DEK is recoverable only through the
|
|
// grants, so a half-applied rotation (new grants over old ciphertext, or the
|
|
// reverse) would make the vault permanently unreadable by everyone.
|
|
credshareRouter.post("/api/credshare/vaults/:id/rekey", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const iHold = await get(`SELECT 1 FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, [vault.id, user.id]);
|
|
if (!iHold) return res.status(403).json({ error: "Only a member with vault access can re-key it." });
|
|
|
|
const grants = Array.isArray(req.body?.grants) ? req.body.grants : null;
|
|
const secrets = Array.isArray(req.body?.secrets) ? req.body.secrets : null;
|
|
const revoke = Array.isArray(req.body?.revoke) ? req.body.revoke.map(norm) : [];
|
|
if (!grants || !secrets) return res.status(422).json({ error: "Expected { grants, secrets, revoke? }." });
|
|
if (grants.length === 0) return res.status(422).json({ error: "A re-key must keep at least one member, or the vault becomes unreadable." });
|
|
|
|
// The caller must keep their own access; otherwise they lock themselves out
|
|
// the moment the transaction commits.
|
|
const me = await get(`SELECT email FROM users WHERE id = ?`, [user.id]);
|
|
if (!grants.some((g) => norm(g?.email) === norm(me?.email))) {
|
|
return res.status(422).json({ error: "A re-key must include your own grant." });
|
|
}
|
|
|
|
// Every secret must be accounted for, with an unchanged fingerprint. This is
|
|
// what makes "re-key" distinct from "write": no value may change here.
|
|
const stored = await all(`SELECT name, fingerprint FROM credshare_secrets WHERE vault_id = ?`, [vault.id]);
|
|
const storedByName = new Map(stored.map((s) => [s.name, s.fingerprint]));
|
|
if (secrets.length !== stored.length) {
|
|
return res.status(409).json({ error: `Re-key covers ${secrets.length} secret(s) but the vault holds ${stored.length}. Re-read the vault and retry.` });
|
|
}
|
|
for (const s of secrets) {
|
|
if (!s || typeof s.name !== "string" || typeof s.nonce !== "string" || typeof s.ciphertext !== "string" || typeof s.fingerprint !== "string") {
|
|
return res.status(422).json({ error: "Each secret needs { name, nonce, ciphertext, fingerprint }." });
|
|
}
|
|
if (!storedByName.has(s.name)) {
|
|
return res.status(409).json({ error: `"${s.name}" is not in this vault. Re-read the vault and retry.` });
|
|
}
|
|
if (storedByName.get(s.name) !== s.fingerprint) {
|
|
return res.status(409).json({ error: `Re-key would change the value of "${s.name}". A re-key re-encrypts; it never changes values.` });
|
|
}
|
|
}
|
|
|
|
// Resolve grant targets before writing anything.
|
|
const resolved = [];
|
|
for (const g of grants) {
|
|
const email = norm(g?.email);
|
|
if (!email || typeof g?.wrappedDek !== "string" || !g.wrappedDek) {
|
|
return res.status(422).json({ error: "Each grant needs { email, wrappedDek }." });
|
|
}
|
|
const target = await get(`SELECT id FROM users WHERE email = ?`, [email]);
|
|
if (!target) return res.status(409).json({ error: `${email} has not logged in yet, so the vault key cannot be sealed to them.` });
|
|
resolved.push({ email, userId: target.id, wrappedDek: g.wrappedDek });
|
|
}
|
|
|
|
const revokedUsers = [];
|
|
for (const email of revoke) {
|
|
const target = await get(`SELECT id FROM users WHERE email = ?`, [email]);
|
|
if (target) revokedUsers.push({ email, userId: target.id });
|
|
}
|
|
|
|
const now = Date.now();
|
|
const statements = [];
|
|
for (const s of secrets) {
|
|
statements.push({
|
|
sql: `UPDATE credshare_secrets SET nonce = ?, ciphertext = ?, version = version + 1, updated_by = ?, updated_at = ? WHERE vault_id = ? AND name = ?`,
|
|
args: [s.nonce, s.ciphertext, user.id, now, vault.id, s.name]
|
|
});
|
|
}
|
|
for (const g of resolved) {
|
|
statements.push({
|
|
sql: `INSERT INTO credshare_vault_grants (vault_id, user_id, wrapped_dek, granted_by, created_at) VALUES (?,?,?,?,?) ON CONFLICT(vault_id, user_id) DO UPDATE SET wrapped_dek = excluded.wrapped_dek, granted_by = excluded.granted_by, created_at = excluded.created_at`,
|
|
args: [vault.id, g.userId, g.wrappedDek, user.id, now]
|
|
});
|
|
}
|
|
for (const r of revokedUsers) {
|
|
statements.push({ sql: `DELETE FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, args: [vault.id, r.userId] });
|
|
}
|
|
statements.push({
|
|
sql: `INSERT INTO credshare_audit (id, team_id, vault_id, actor_user_id, action, key_name, fingerprint, created_at) VALUES (?,?,?,?,?,?,?,?)`,
|
|
args: [id(), vault.team_id, vault.id, user.id, "vault:rekey", null, null, now]
|
|
});
|
|
for (const r of revokedUsers) {
|
|
statements.push({
|
|
sql: `INSERT INTO credshare_audit (id, team_id, vault_id, actor_user_id, action, key_name, fingerprint, created_at) VALUES (?,?,?,?,?,?,?,?)`,
|
|
args: [id(), vault.team_id, vault.id, user.id, "vault:revoke", r.email, null, now]
|
|
});
|
|
}
|
|
|
|
await batch(statements);
|
|
res.json({ ok: true, rekeyed: secrets.length, granted: resolved.map((g) => g.email), revoked: revokedUsers.map((r) => r.email) });
|
|
}));
|
|
|
|
credshareRouter.post("/api/credshare/vaults/:id/grants", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const iHold = await get(`SELECT 1 FROM credshare_vault_grants WHERE vault_id = ? AND user_id = ?`, [vault.id, user.id]);
|
|
const anyGrants = await get(`SELECT 1 FROM credshare_vault_grants WHERE vault_id = ?`, [vault.id]);
|
|
if (!iHold && anyGrants) return res.status(403).json({ error: "Only a member with vault access can grant others." });
|
|
const email = norm(req.body?.email), wrappedDek = req.body?.wrappedDek;
|
|
if (!email || typeof wrappedDek !== "string" || !wrappedDek) return res.status(422).json({ error: "Expected { email, wrappedDek }." });
|
|
const target = await get(`SELECT id FROM users WHERE email = ?`, [email]);
|
|
if (!target) return res.status(404).json({ error: "Target user has not logged in yet." });
|
|
if (!(await publicKeyFor(target.id))) return res.status(409).json({ error: "Target user has not uploaded a public key yet." });
|
|
await run(`INSERT INTO credshare_vault_grants (vault_id, user_id, wrapped_dek, granted_by, created_at) VALUES (?,?,?,?,?) ON CONFLICT(vault_id, user_id) DO UPDATE SET wrapped_dek = excluded.wrapped_dek, granted_by = excluded.granted_by, created_at = excluded.created_at`,
|
|
[vault.id, target.id, wrappedDek, user.id, Date.now()]);
|
|
await audit({ teamId: vault.team_id, vaultId: vault.id, actorUserId: user.id, action: "vault:grant", keyName: email });
|
|
res.status(201).json({ ok: true });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/vaults/:id/secrets", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const rows = await all(`SELECT * FROM credshare_secrets WHERE vault_id = ? ORDER BY name`, [vault.id]);
|
|
res.json({ vaultId: vault.id, secrets: rows.map((s) => ({ name: s.name, nonce: s.nonce, ciphertext: s.ciphertext, fingerprint: s.fingerprint, version: s.version, updatedAt: s.updated_at })) });
|
|
}));
|
|
|
|
credshareRouter.put("/api/credshare/vaults/:id/secrets", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const upserts = Array.isArray(req.body?.upserts) ? req.body.upserts : [];
|
|
const deletes = Array.isArray(req.body?.deletes) ? req.body.deletes : [];
|
|
const applied = [];
|
|
for (const u of upserts) {
|
|
if (!u || typeof u.name !== "string" || typeof u.nonce !== "string" || typeof u.ciphertext !== "string" || typeof u.fingerprint !== "string") {
|
|
return res.status(422).json({ error: "Each upsert needs { name, nonce, ciphertext, fingerprint }." });
|
|
}
|
|
const prev = await get(`SELECT version FROM credshare_secrets WHERE vault_id = ? AND name = ?`, [vault.id, u.name]);
|
|
const version = (prev?.version ?? 0) + 1;
|
|
await run(`INSERT INTO credshare_secrets (vault_id, name, nonce, ciphertext, fingerprint, version, updated_by, updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(vault_id, name) DO UPDATE SET nonce = excluded.nonce, ciphertext = excluded.ciphertext, fingerprint = excluded.fingerprint, version = excluded.version, updated_by = excluded.updated_by, updated_at = excluded.updated_at`,
|
|
[vault.id, u.name, u.nonce, u.ciphertext, u.fingerprint, version, user.id, Date.now()]);
|
|
await audit({ teamId: vault.team_id, vaultId: vault.id, actorUserId: user.id, action: prev ? "secret:update" : "secret:add", keyName: u.name, fingerprint: u.fingerprint });
|
|
applied.push(u.name);
|
|
}
|
|
for (const raw of deletes) {
|
|
const name = typeof raw === "string" ? raw : null;
|
|
if (!name) continue;
|
|
await run(`DELETE FROM credshare_secrets WHERE vault_id = ? AND name = ?`, [vault.id, name]);
|
|
await audit({ teamId: vault.team_id, vaultId: vault.id, actorUserId: user.id, action: "secret:remove", keyName: name });
|
|
applied.push(name);
|
|
}
|
|
res.json({ ok: true, applied });
|
|
}));
|
|
|
|
credshareRouter.get("/api/credshare/vaults/:id/audit", api(async (req, res, user) => {
|
|
const vault = await vaultCtx(res, req.params.id, user.id); if (!vault) return;
|
|
const auditRows = await all(`SELECT * FROM credshare_audit WHERE vault_id = ? ORDER BY created_at DESC`, [vault.id]);
|
|
res.json({ audit: auditRows });
|
|
}));
|