Anthony Ettinger
d38db62e8b
`logicsrc vault` (OpenCreds) lived only in ~/.config/logicsrc/opencreds. Lose the machine and the vault went with it, and a second machine had no way to get it. It now syncs to the logged-in account. Server (apps/pwa, /api/opencreds, session or lsk_ bearer): - opencreds_vaults: one per user. meta (key material already wrapped under the master password) + an encrypted folder list, each with a revision. - opencreds_items: one row per item, as the spec asks; envelope NULL is a tombstone so purges propagate; seq for incremental pulls. - Every write names its base revision; a stale one gets 409 with the current row. Writes are conditional and read back (each envelope's random IV identifies our write), so this needs nothing dialect-specific from SQLite or Postgres. - Stores ciphertext only. The server learns item count and type codes, as OpenCreds security.md already accepts. Client (@logicsrc/opencreds sync.ts, key-free except where noted): - Pull before every vault command, push after. Offline, the command still works and the change goes up next time. - Conflicts never lose data: the account's edit keeps the id and this machine's becomes "<name> (conflict copy)" (needs the unlocked key, so it waits otherwise). An edit beats a purge. Byte-identical envelopes are adopted, not split, so a lost sync.json is harmless. - Two different vaults (meta.createdAt differs) are never merged: refused, with `vault sync --use-remote` (backs this machine's up to .bak-NNN) or `--use-local`. - Remote item ids must be plain ids; anything else is ignored and never becomes a path. - Folder names are AES-GCM encrypted under the user key before upload. CLI (0.6.0): `logicsrc vault sync [--status|--use-remote|--use-local]`. Only the default vault syncs, and only when logged in; a --home or OPENCREDS_HOME vault stays local unless LOGICSRC_VAULT_SYNC=on; LOGICSRC_VAULT_SYNC=off disables it. The standalone `opencreds` binary gets no remote and never syncs. `init` on a machine that just downloaded the account's vault says to unlock it instead of suggesting --force. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| test | ||
| .env.example | ||
| .gitignore | ||
| package.json | ||
| Procfile | ||
| railway.json | ||
| README.md | ||
@logicsrc/pwa — LogicSRC credentials
Express app on Postgres for team credential sharing: auth (email/password,
passkeys, CoinPay OAuth, sessions, lsk_ CLI API keys) + end-to-end-encrypted
team vaults. Zero-knowledge — the server only stores ciphertext, per-member
sealed vault keys, and identity public keys. Decryption happens in the
logicsrc CLI.
cp .env.example .env # set SESSION_SECRET; DATABASE_URL=postgres://… for prod (else a local libSQL file db)
npm install
npm start # migrates on boot, serves on :8080
Database
Production runs on Postgres: DATABASE_URL must be a postgres:// URL and the
app refuses to start on anything else there (a leftover libsql:// value is
called out by name). The client is
@profullstack/libsql-pg, which
keeps the @libsql/client surface the code was written against and rewrites
the remaining SQLite idioms per statement. Development and the tests use libSQL
itself (file:./data/local.db by default, :memory: in tests).
Migrations run at boot and live in two dialect copies with the same file names:
src/migrations/ (SQLite) and src/migrations-pg/ (Postgres, generated with
npx libsql-pg convert-schema and reviewed). npm run migrate applies the copy
matching DATABASE_URL. To move an existing Turso database:
DATABASE_URL=postgres://… npm run migrate # schema
npx libsql-pg copy --from "$TURSO_DATABASE_URL" --token "$TURSO_AUTH_TOKEN" \
--to "$DATABASE_URL" --verify # rows
Set PWA_TEST_DATABASE_URL=postgres://… to run the test suite against a real
Postgres (it drops and recreates the public schema of that database).
The CLI connects with LOGICSRC_API=<origin> logicsrc login (browser OAuth-PKCE
loopback → an lsk_ key). See docs/credential-sharing.md in the repo root.