mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
37 lines
818 B
SQL
37 lines
818 B
SQL
-- name: ListProjectSecrets :many
|
|
SELECT id, project_id, name, url, notes, created_at, updated_at
|
|
FROM core.project_secrets
|
|
WHERE project_id = $1
|
|
ORDER BY name ASC;
|
|
|
|
-- name: GetProjectSecret :one
|
|
SELECT * FROM core.project_secrets
|
|
WHERE project_id = $1
|
|
AND name = $2;
|
|
|
|
-- name: UpsertProjectSecret :one
|
|
INSERT INTO core.project_secrets (
|
|
project_id,
|
|
name,
|
|
ciphertext,
|
|
url,
|
|
notes
|
|
) VALUES ($1, $2, $3, $4, $5)
|
|
ON CONFLICT (project_id, name) DO UPDATE SET
|
|
ciphertext = EXCLUDED.ciphertext,
|
|
url = EXCLUDED.url,
|
|
notes = EXCLUDED.notes,
|
|
updated_at = NOW()
|
|
RETURNING *;
|
|
|
|
-- name: DeleteProjectSecret :one
|
|
DELETE FROM core.project_secrets
|
|
WHERE project_id = $1
|
|
AND name = $2
|
|
RETURNING id;
|
|
|
|
-- name: ListProjectSecretValues :many
|
|
SELECT name, ciphertext
|
|
FROM core.project_secrets
|
|
WHERE project_id = $1;
|