mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 14:37:26 +00:00
Anthony Ettinger
1e4e9def70
The vault holds the target's prior values so a bad rotation can be undone — the one place raw credentials touch disk. It was written as plain JSON at mode 0600, and a permission bit is all that was protecting it. That stops another user on the same box. It does nothing about a backup, a synced home directory, a lifted disk, or any process running as the owner, and those are the cases where a credential store is worth reading. Each run is now sealed to this machine's identity: a fresh DEK per write, the payload sealed with it, the DEK sealed to the identity public key. So the file opens with the secret key in identity.json and nothing else. The key names go inside the ciphertext along with the values — knowing that an endpoint holds STRIPE_LIVE_KEY is worth something by itself. A DEK per run rather than one for the store: reusing a key would make a single compromise open every rollback ever captured, and there is nothing to gain by it, since the wrapped DEK travels in the file. Plaintext vaults written before this still open. Refusing them would strand the rollback data they exist to hold, and a vault reader that cannot read yesterday's vault takes away the thing the vault is for. The store's vault methods become async, which the three callers in the engine already sat inside async functions to accommodate. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| package.json | ||
| tsconfig.json | ||