mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-10-05 06:05:28 +00:00
Anthony Ettinger
d38db62e8b
`logicsrc vault` (OpenCreds) lived only in ~/.config/logicsrc/opencreds. Lose the machine and the vault went with it, and a second machine had no way to get it. It now syncs to the logged-in account. Server (apps/pwa, /api/opencreds, session or lsk_ bearer): - opencreds_vaults: one per user. meta (key material already wrapped under the master password) + an encrypted folder list, each with a revision. - opencreds_items: one row per item, as the spec asks; envelope NULL is a tombstone so purges propagate; seq for incremental pulls. - Every write names its base revision; a stale one gets 409 with the current row. Writes are conditional and read back (each envelope's random IV identifies our write), so this needs nothing dialect-specific from SQLite or Postgres. - Stores ciphertext only. The server learns item count and type codes, as OpenCreds security.md already accepts. Client (@logicsrc/opencreds sync.ts, key-free except where noted): - Pull before every vault command, push after. Offline, the command still works and the change goes up next time. - Conflicts never lose data: the account's edit keeps the id and this machine's becomes "<name> (conflict copy)" (needs the unlocked key, so it waits otherwise). An edit beats a purge. Byte-identical envelopes are adopted, not split, so a lost sync.json is harmless. - Two different vaults (meta.createdAt differs) are never merged: refused, with `vault sync --use-remote` (backs this machine's up to .bak-NNN) or `--use-local`. - Remote item ids must be plain ids; anything else is ignored and never becomes a path. - Folder names are AES-GCM encrypted under the user key before upload. CLI (0.6.0): `logicsrc vault sync [--status|--use-remote|--use-local]`. Only the default vault syncs, and only when logged in; a --home or OPENCREDS_HOME vault stays local unless LOGICSRC_VAULT_SYNC=on; LOGICSRC_VAULT_SYNC=off disables it. The standalone `opencreds` binary gets no remote and never syncs. `init` on a machine that just downloaded the account's vault says to unlock it instead of suggesting --force. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
3.6 KiB
TypeScript
71 lines
3.6 KiB
TypeScript
import type { Command } from "commander";
|
|
import { registerCredsCommands } from "@logicsrc/opencreds/commands";
|
|
import { accountRemoteFor } from "./vault-sync.js";
|
|
|
|
/**
|
|
* `logicsrc vault …`
|
|
*
|
|
* The commands themselves live in `@logicsrc/opencreds` and are shared verbatim
|
|
* with the standalone `opencreds` binary, so the two can never drift. That
|
|
* matters because the specification treats CLI behaviour — flags, output shapes
|
|
* and exit codes — as a conformance surface, and a subcommand that quietly
|
|
* diverged would make `logicsrc vault validate` and `opencreds validate` two
|
|
* different contracts.
|
|
*
|
|
* Named `vault` rather than `creds` because `creds` is already an alias of
|
|
* `logicsrc credentials`, and the two are genuinely different things:
|
|
* `credentials` moves a key/value pair *between providers*, while `vault`
|
|
* *stores a record* — a login, a card, an identity, a note, a key or an
|
|
* account — encrypted end to end and portable as one file rather than a
|
|
* plaintext CSV. They meet at the `key` item: a synced .env entry, stored.
|
|
*/
|
|
export const VAULT_GUIDE = `
|
|
There are two vaults. Pick the one you need:
|
|
|
|
Team secrets .env keys shared with your team (DATABASE_URL, STRIPE_SECRET_KEY, …)
|
|
-> logicsrc teams … (this is where the company secrets are)
|
|
Personal vault your own logins, cards, SSH keys, notes
|
|
-> logicsrc vault …
|
|
|
|
Team secrets, the everyday commands:
|
|
logicsrc login once per machine
|
|
logicsrc teams list the teams you are in
|
|
logicsrc teams secrets <team> every secret name + its category
|
|
logicsrc teams secrets <team> --category db only database secrets
|
|
logicsrc teams secrets <team> -s stripe names containing "stripe"
|
|
logicsrc teams export <team> --category db -o db.csv decrypt them into a CSV
|
|
logicsrc teams pull <team> <project> <env> write one vault into ./.env
|
|
logicsrc teams categories db, social, server, api, cloud, …
|
|
|
|
Personal vault:
|
|
logicsrc vault init create it (once)
|
|
eval "$(logicsrc vault unlock)" unlock for this shell
|
|
logicsrc vault add login --name GitHub --username me --password -
|
|
logicsrc vault list --category social never shows values
|
|
logicsrc vault get GitHub --field login.password --reveal
|
|
logicsrc vault export --format csv --category db --out db.csv --yes
|
|
logicsrc vault import bitwarden.csv
|
|
|
|
Your personal vault syncs to your account (after logicsrc login), end to end
|
|
encrypted: every vault command pulls first and pushes after. A new machine
|
|
gets it with: logicsrc login, then logicsrc vault sync.
|
|
logicsrc vault sync --status what is synced, what is waiting
|
|
LOGICSRC_VAULT_SYNC=off turn it off (a --home vault never syncs)
|
|
|
|
Help for any command: logicsrc vault <command> --help (or: logicsrc vault help <command>)
|
|
`;
|
|
|
|
export function registerOpenCredsCommands(program: Command): void {
|
|
const vault = program
|
|
.command("vault")
|
|
.description(
|
|
"Your personal encrypted vault (logins, cards, keys, notes). " +
|
|
"Team .env secrets are under `logicsrc teams` — examples below.",
|
|
)
|
|
// Most people typing `logicsrc vault` want the TEAM secrets, which live
|
|
// under `teams`. Say so first, with commands they can paste.
|
|
.addHelpText("after", VAULT_GUIDE);
|
|
|
|
// Logged in: the vault syncs to the account around every command.
|
|
registerCredsCommands(vault, { remote: accountRemoteFor });
|
|
}
|