feat: add secret store foundation

2026-04-06 01:13:10 +03:00
parent 420074f96a
commit d7e5ae95d6
23 changed files with 954 additions and 48 deletions
@@ -27,6 +27,7 @@ use crate::{
            list_grpc_services, list_operations, publish_operation, run_test, update_operation,
            upload_descriptor_set, upload_input_json, upload_output_json, upload_proto_descriptor,
        },
+        secrets::{create_secret, delete_secret, get_secret, list_secrets, rotate_secret},
        workspaces::{create_workspace, get_workspace, list_workspaces, update_workspace},
    },
    state::AppState,
@@ -99,6 +100,12 @@ pub fn build_app(state: AppState) -> Router {
            get(list_auth_profiles).post(create_auth_profile),
        )
        .route("/auth-profiles/{auth_profile_id}", get(get_auth_profile))
+        .route("/secrets", get(list_secrets).post(create_secret))
+        .route(
+            "/secrets/{secret_id}",
+            get(get_secret).delete(delete_secret),
+        )
+        .route("/secrets/{secret_id}/rotate", post(rotate_secret))
        .route("/members", get(list_memberships))
        .route(
            "/members/{user_id}",
@@ -187,7 +194,7 @@ mod tests {
    use crank_adapter_grpc::test_support as grpc_test_support;
    use crank_core::{
        DescriptorId, ExecutionConfig, GraphqlOperationType, GraphqlTarget, GrpcTarget, HttpMethod,
-        MembershipRole, Protocol, RestTarget, Target, ToolDescription, WorkspaceId,
+        MembershipRole, Protocol, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
    };
    use crank_mapping::{MappingRule, MappingSet};
    use crank_registry::PostgresRegistry;
@@ -200,6 +207,7 @@ mod tests {
    use crate::{
        app::build_app,
        auth::{AuthSettings, BootstrapAdminConfig, hash_password},
+        secret_crypto::SecretCrypto,
        service::{AdminService, OperationPayload},
        state::AppState,
    };
@@ -209,6 +217,7 @@ mod tests {
    const TEST_AUTH_PASSWORD: &str = "test-password";
    const TEST_PASSWORD_PEPPER: &str = "test-password-pepper";
    const TEST_SESSION_SECRET: &str = "test-session-secret";
+    const TEST_MASTER_KEY: &str = "test-master-key";

    struct TestServer {
        base_url: String,
@@ -981,7 +990,12 @@ mod tests {
    async fn seeds_demo_assets_for_live_ui() {
        let registry = test_registry().await;
        let storage_root = test_storage_root("demo_seed");
-        let service = AdminService::new(registry.clone(), storage_root, test_auth_settings());
+        let service = AdminService::new(
+            registry.clone(),
+            storage_root,
+            test_auth_settings(),
+            test_secret_crypto(),
+        );

        service.bootstrap_admin_user().await.unwrap();
        service.seed_demo_assets().await.unwrap();
@@ -1462,6 +1476,79 @@ mod tests {
        assert_eq!(imported["import_mode"], "upsert");
    }

+    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
+    async fn manages_workspace_secrets_without_exposing_plaintext() {
+        let registry = test_registry().await;
+        let storage_root = test_storage_root("secrets");
+        let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
+        let client = authorized_client(&base_url).await;
+
+        let created = client
+            .post(format!("{base_url}/secrets"))
+            .json(&json!({
+                "name": "crm-api-token",
+                "kind": SecretKind::Token,
+                "value": { "token": "super-secret-token" }
+            }))
+            .send()
+            .await
+            .unwrap();
+        let created = assert_success_json(created).await;
+        let secret_id = created["id"].as_str().unwrap().to_owned();
+
+        let listed = client
+            .get(format!("{base_url}/secrets"))
+            .send()
+            .await
+            .unwrap();
+        let listed = assert_success_json(listed).await;
+
+        let fetched = client
+            .get(format!("{base_url}/secrets/{secret_id}"))
+            .send()
+            .await
+            .unwrap();
+        let fetched = assert_success_json(fetched).await;
+
+        let rotated = client
+            .post(format!("{base_url}/secrets/{secret_id}/rotate"))
+            .json(&json!({
+                "value": { "token": "rotated-token" }
+            }))
+            .send()
+            .await
+            .unwrap();
+        let rotated = assert_success_json(rotated).await;
+
+        let deleted = client
+            .delete(format!("{base_url}/secrets/{secret_id}"))
+            .send()
+            .await
+            .unwrap();
+        let deleted = assert_success_json(deleted).await;
+
+        let missing = client
+            .get(format!("{base_url}/secrets/{secret_id}"))
+            .send()
+            .await
+            .unwrap();
+        let missing_status = missing.status();
+        let missing = missing.json::<Value>().await.unwrap();
+
+        assert_eq!(created["name"], "crm-api-token");
+        assert_eq!(created["kind"], "token");
+        assert_eq!(created["current_version"], 1);
+        assert!(created.get("value").is_none());
+        assert_eq!(listed["items"].as_array().unwrap().len(), 1);
+        assert_eq!(fetched["id"], secret_id);
+        assert!(fetched.get("value").is_none());
+        assert_eq!(rotated["current_version"], 2);
+        assert_eq!(deleted["ok"], true);
+        assert_eq!(missing_status, reqwest::StatusCode::NOT_FOUND);
+        assert_eq!(missing["error"]["code"], "not_found");
+    }
+
    #[tokio::test(flavor = "multi_thread")]
    #[serial]
    async fn roundtrips_graphql_operation_through_yaml_upsert() {
@@ -1644,7 +1731,12 @@ mod tests {

    fn build_test_app(registry: PostgresRegistry, storage_root: std::path::PathBuf) -> Router {
        build_app(AppState {
-            service: AdminService::new(registry, storage_root, test_auth_settings()),
+            service: AdminService::new(
+                registry,
+                storage_root,
+                test_auth_settings(),
+                test_secret_crypto(),
+            ),
        })
    }

@@ -1823,6 +1915,10 @@ mod tests {
        }
    }

+    fn test_secret_crypto() -> SecretCrypto {
+        SecretCrypto::new(TEST_MASTER_KEY).unwrap()
+    }
+
    fn test_operation_payload(base_url: &str, name: &str) -> OperationPayload {
        OperationPayload {
            name: name.to_owned(),