umputun / stash / 20475595066

84%

Build Type

push

github

Committed by web-flow

Commit Message

feat: implement secrets vault with encrypted storage (#45)

* docs: add secrets vault implementation plan

Related to encrypted secrets storage feature

* docs: simplify secrets plan to unified API approach

- Same /kv/* API with ?secret=true flag
- Same table with secret boolean column
- Less code duplication, simpler mental model

* docs: switch to path-based secret detection

- secrets/ segment in path = encrypted automatically
- supports nested paths: app/secrets/foo, blah/secrets/bar
- no schema change needed, same API
- permissions use standard prefix patterns

* docs: require explicit permission grant for secrets

- wildcards like app/* do NOT match app/secrets/*
- even * does not grant secrets access
- must explicitly add secrets-containing prefix
- secure by default, opt-in for secrets

* docs: add lock icon SVG to iteration 6

* feat: implement secrets vault with encrypted storage

- add crypto.go with NaCl secretbox + Argon2id encryption
- path-based secret detection (keys containing secrets segment)
- SecretsFilter enum for list filtering (all/secrets/keys)
- explicit permission model - wildcards do not grant secrets access
- 400 error when secrets path used but key not configured
- lock icon in web UI for secret keys
- update documentation (README.md, CLAUDE.md)

Related to secrets-vault plan

* test(e2e): add secrets vault UI tests

- lock icon visibility for secret keys
- permission enforcement (user without secrets access)
- card view lock icon display
- scoped secrets access verification

* feat(web): add secrets filter toggle (All/Secrets/Keys)

- add SecretsFilter enum with Next() and Label() methods
- add filter button in header (only when secrets enabled)
- cycles through All → Secrets → Keys → All
- refactor handleKeyList to use getListParams helper (reduces complexity)
- add e2e test for filter toggle functionality
- fix SecretsEnabledFunc in all test mocks

* refactor: address code review findings for secrets vault

- fix build... (continued)

Run Details

342 of 389 new or added lines in 9 files covered. (87.92%)

2 existing lines in 2 files now uncovered.

3125 of 3730 relevant lines covered (83.78%)

81.67 hits per line