mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
585bb04ab2
Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
20 lines
756 B
SQL
20 lines
756 B
SQL
-- +goose Up
|
|
-- Project-level secrets: AES-256-GCM ciphertext produced by the backend's
|
|
-- Encryptor. Values are write-once — list/read expose metadata only; a
|
|
-- dedicated reveal endpoint decrypts and is audit-logged. secret://NAME
|
|
-- references in job payloads resolve at delivery time.
|
|
CREATE TABLE core.project_secrets (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
project_id UUID NOT NULL REFERENCES core.projects(id) ON DELETE CASCADE,
|
|
name TEXT NOT NULL,
|
|
ciphertext BYTEA NOT NULL,
|
|
url TEXT NOT NULL DEFAULT '',
|
|
notes TEXT NOT NULL DEFAULT '',
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
UNIQUE (project_id, name)
|
|
);
|
|
|
|
-- +goose Down
|
|
DROP TABLE IF EXISTS core.project_secrets;
|