mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 14:37:26 +00:00
Anthony Ettinger
6f23dbdb0f
Two additions to Credential Sharing. `logicsrc credentials rotate` (alias `logicsrc secrets rotate`) re-keys a team vault: fresh DEK, re-sealed to the members who keep access, every secret re-encrypted under it. Values do not change, so nothing that consumes them breaks; what changes is that every wrapped key issued before the rotation is dead. --active (the default) keeps only active members and revokes the rest -- the "someone left" rotation. --all keeps everyone who holds access, for plain hygiene. Dry run by default, like `sync`. The DEK is recoverable ONLY through the grants, so a half-applied rotation makes a vault permanently unreadable by everyone. The whole next state therefore goes to the server in one request and commits in one transaction (new db.batch helper). The server also requires every submitted fingerprint to equal the stored one: it cannot see values, but it can prove a re-key did not swap any. Rotations that would leave the caller ungranted, grant nobody, or cover the wrong secret count are rejected before anything is written. GET /vaults/:id/grants now returns publicKey and status so a client can re-seal in one pass instead of N+1 user lookups, and revocation finally deletes the grant row rather than leaving one that reports access it no longer confers. The sh1pt adapter is the fifth provider. It is the only one driven through a CLI rather than HTTP, because sh1pt publishes `sh1pt secret set|get|list|rm` as the interface to its vault and documents no REST endpoint. Values go over the child's stdin, never argv -- a secret in argv is readable by any user on the host via ps. Since `sh1pt secret get` needs interactive confirmation it cannot be scripted, so the adapter is write-only for values like github-secrets: a sync target, never a source, no value-restoring rollback. Tests drive a real fake sh1pt binary rather than a mocked execFile, which is how the hang surfaced: with nothing to pipe, stdin was left open and any subcommand that reads it would wait forever. It is now always closed. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| test | ||
| .env.example | ||
| .gitignore | ||
| package.json | ||
| Procfile | ||
| railway.json | ||
| README.md | ||
@logicsrc/pwa — LogicSRC credentials
Express + libSQL/Turso app for team credential sharing: auth (email/password,
passkeys, CoinPay OAuth, sessions, lsk_ CLI API keys) + end-to-end-encrypted
team vaults. Zero-knowledge — the server only stores ciphertext, per-member
sealed vault keys, and identity public keys. Decryption happens in the
logicsrc CLI.
cp .env.example .env # set SESSION_SECRET; TURSO_* for prod (else local file db)
npm install
npm start # migrates on boot, serves on :8080
The CLI connects with LOGICSRC_API=<origin> logicsrc login (browser OAuth-PKCE
loopback → an lsk_ key). See docs/credential-sharing.md in the repo root.