mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 14:37:26 +00:00
Anthony Ettinger
f057589d66
Adds a `team` credential provider + team/member management so teammates can share secrets by email instead of passing .env files over chat. Fully E2E: the server only ever stores ciphertext, per-member sealed vault keys, and public keys — it never sees a plaintext value or the vault DEK. Plugin (@logicsrc/plugin-credential-sharing) - crypto.ts: X25519 identity keys, per-vault DEK (secretbox), DEK sealed to each member's pubkey (crypto_box_seal), value encrypt/decrypt (libsodium) - identity.ts: local ~/.logicsrc/identity.json (0600) holding the device key + API token; never uploads the secret key - client.ts: typed /api/credshare client - providers/team.ts: `team:<slug>/<vault>` CredentialProvider (inspect, readValues=decrypt, write=encrypt, rollback); fingerprints match env so env<->team diffs line up - fixes latent libsodium-wrappers ESM load bug (createRequire) here + in github-secrets Server (commandboard-api /api/credshare) - zero-knowledge router: email-code auth, keys, teams, members, invites, vaults, sealed grants, ciphertext secrets, audit; membership authz in app - CredShareStore abstraction: in-memory (dev/tests) + Supabase (prod) - Resend email transport for login codes + invites (no-op -> echoes locally) - supabase migration: credshare_* tables, deny-by-default RLS CLI - real `logicsrc login` (email code -> token + key upload) - `logicsrc teams create/list/invite/accept/members/vaults/grant/push/pull` Web (logicsrc.com/teams + /teams/accept) - management surface only (browser holds no private key, never decrypts): login, view teams/members/vaults, invite, accept Tests: crypto round-trip, server contract (invite->accept->push->grant->pull + authz boundaries), and a real HTTP+client+crypto E2E asserting the server never holds plaintext. Full workspace build + tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.4 KiB
JSON
37 lines
1.4 KiB
JSON
{
|
|
"name": "@logicsrc/commandboard-api",
|
|
"version": "0.1.0",
|
|
"description": "CommandBoard.run REST API reference service.",
|
|
"type": "module",
|
|
"main": "./dist/index.js",
|
|
"scripts": {
|
|
"build": "tsc -p tsconfig.json",
|
|
"dev": "tsx src/index.ts",
|
|
"start": "node dist/index.js",
|
|
"test": "vitest run src",
|
|
"test:contract": "vitest run src/contract.test.ts"
|
|
},
|
|
"dependencies": {
|
|
"@logicsrc/plugin-core": "file:../../packages/plugin-core",
|
|
"@logicsrc/plugin-agentmail": "file:../../plugins/agentmail",
|
|
"@logicsrc/plugin-c0mpute": "file:../../plugins/c0mpute",
|
|
"@logicsrc/plugin-coinpay": "file:../../plugins/coinpay",
|
|
"@logicsrc/plugin-email-accounts": "file:../../plugins/email-accounts",
|
|
"@logicsrc/plugin-feed-discovery": "file:../../plugins/feed-discovery",
|
|
"@logicsrc/plugin-sh1pt": "file:../../plugins/sh1pt",
|
|
"@logicsrc/plugin-social-accounts": "file:../../plugins/social-accounts",
|
|
"@logicsrc/plugin-ugig": "file:../../plugins/ugig",
|
|
"@logicsrc/validators": "file:../../packages/validators",
|
|
"@supabase/supabase-js": "^2.105.4",
|
|
"imapflow": "^1.4.3",
|
|
"mailparser": "^3.9.12",
|
|
"nodemailer": "^9.0.1"
|
|
},
|
|
"devDependencies": {
|
|
"@logicsrc/plugin-credential-sharing": "file:../../plugins/credential-sharing",
|
|
"@types/mailparser": "^3.4.6",
|
|
"@types/nodemailer": "^8.0.1",
|
|
"tsx": "^4.21.0",
|
|
"vitest": "^4.0.8"
|
|
}
|
|
}
|