feat: add secret store foundation

apps/admin-api/src/service.rs

@@ -12,21 +12,22 @@ use crank_core::{
     InvitationId, InvitationStatus, InvitationToken, InvocationLevel, InvocationLog,
     InvocationLogId, InvocationSource, InvocationStatus, MembershipRole, OperationId,
     OperationStatus, PlatformApiKey, PlatformApiKeyId, PlatformApiKeyScope, PlatformApiKeyStatus,
-    Protocol, SampleId, Samples, Target, UsagePeriod, UserSessionId, Workspace, WorkspaceId,
-    WorkspaceStatus,
+    Protocol, SampleId, Samples, Secret, SecretId, SecretKind, SecretStatus, Target, UsagePeriod,
+    UserId, UserSessionId, Workspace, WorkspaceId, WorkspaceStatus,
 };
 use crank_mapping::{JsonPathRoot, MappingSet, infer_mapping_from_samples};
 use crank_proto::{ProtoService, services_from_descriptor_set_bytes};
 use crank_registry::{
     AgentSummary, AgentVersionRecord, CreateAgentRequest, CreateInvitationRequest,
-    CreateInvocationLogRequest, CreatePlatformApiKeyRequest, CreateVersionRequest,
-    CreateWorkspaceRequest, InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery,
-    MembershipRecord, OperationAgentRef, OperationSampleMetadata, OperationSummary,
-    OperationUsageSummary, OperationVersionRecord, PlatformApiKeyRecord, PostgresRegistry,
-    PublishAgentRequest, PublishRequest, RegistryOperation, SampleKind, SaveAgentBindingsRequest,
-    SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-    UpdateWorkspaceRequest, UsageAgentBreakdown, UsageBucket, UsageOperationBreakdown, UsageQuery,
-    UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord, WorkspaceRecord,
+    CreateInvocationLogRequest, CreatePlatformApiKeyRequest, CreateSecretRequest,
+    CreateVersionRequest, CreateWorkspaceRequest, InvitationRecord, InvocationLogRecord,
+    ListInvocationLogsQuery, MembershipRecord, OperationAgentRef, OperationSampleMetadata,
+    OperationSummary, OperationUsageSummary, OperationVersionRecord, PlatformApiKeyRecord,
+    PostgresRegistry, PublishAgentRequest, PublishRequest, RegistryOperation, RotateSecretRequest,
+    SampleKind, SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
+    SaveSampleMetadataRequest, UpdateWorkspaceRequest, UsageAgentBreakdown, UsageBucket,
+    UsageOperationBreakdown, UsageQuery, UsageSummary, UsageTimelinePoint,
+    WorkspaceMembershipRecord, WorkspaceRecord,
 };
 use crank_runtime::{PreparedRequest, RuntimeError, RuntimeExecutor, RuntimeOperation};
 use crank_schema::Schema;
@@ -43,6 +44,7 @@ use crate::{
         hash_session_secret, verify_password,
     },
     error::ApiError,
+    secret_crypto::SecretCrypto,
     storage::LocalArtifactStorage,
 };
 
@@ -52,6 +54,7 @@ pub struct AdminService {
     runtime: RuntimeExecutor,
     storage: LocalArtifactStorage,
     auth_settings: AuthSettings,
+    secret_crypto: SecretCrypto,
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -134,6 +137,18 @@ pub struct AuthProfilePayload {
     pub config: AuthConfig,
 }
 
+#[derive(Clone, Debug, Deserialize)]
+pub struct SecretPayload {
+    pub name: String,
+    pub kind: SecretKind,
+    pub value: Value,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+pub struct RotateSecretPayload {
+    pub value: Value,
+}
+
 #[derive(Clone, Debug, Deserialize)]
 pub struct WorkspacePayload {
     pub slug: String,
@@ -484,12 +499,14 @@ impl AdminService {
         registry: PostgresRegistry,
         storage_root: PathBuf,
         auth_settings: AuthSettings,
+        secret_crypto: SecretCrypto,
     ) -> Self {
         Self {
             registry,
             runtime: RuntimeExecutor::new(),
             storage: LocalArtifactStorage::new(storage_root),
             auth_settings,
+            secret_crypto,
         }
     }
 
@@ -1704,6 +1721,114 @@ impl AdminService {
         Ok(self.registry.list_auth_profiles(workspace_id).await?)
     }
 
+    #[instrument(skip(self))]
+    pub async fn list_secrets(&self, workspace_id: &WorkspaceId) -> Result<Vec<Secret>, ApiError> {
+        self.ensure_workspace_exists(workspace_id).await?;
+        Ok(self
+            .registry
+            .list_secrets(workspace_id)
+            .await?
+            .into_iter()
+            .map(|record| record.secret)
+            .collect())
+    }
+
+    #[instrument(skip(self))]
+    pub async fn get_secret(
+        &self,
+        workspace_id: &WorkspaceId,
+        secret_id: &SecretId,
+    ) -> Result<Secret, ApiError> {
+        self.ensure_workspace_exists(workspace_id).await?;
+        self.registry
+            .get_secret(workspace_id, secret_id)
+            .await?
+            .map(|record| record.secret)
+            .ok_or_else(|| {
+                ApiError::not_found(format!("secret {} was not found", secret_id.as_str()))
+            })
+    }
+
+    #[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str(), secret_name = %payload.name))]
+    pub async fn create_secret(
+        &self,
+        workspace_id: &WorkspaceId,
+        created_by: Option<&UserId>,
+        payload: SecretPayload,
+    ) -> Result<Secret, ApiError> {
+        self.ensure_workspace_exists(workspace_id).await?;
+        validate_secret_payload(&payload)?;
+
+        let now = now_string()?;
+        let secret = Secret {
+            id: SecretId::new(new_prefixed_id("secret")),
+            workspace_id: workspace_id.clone(),
+            name: payload.name.trim().to_owned(),
+            kind: payload.kind,
+            status: SecretStatus::Active,
+            current_version: 1,
+            created_at: now.clone(),
+            updated_at: now,
+            last_used_at: None,
+        };
+        let ciphertext = self.secret_crypto.encrypt(&payload.value)?;
+
+        self.registry
+            .create_secret(CreateSecretRequest {
+                secret: &secret,
+                ciphertext: &ciphertext,
+                key_version: self.secret_crypto.key_version(),
+                created_by,
+            })
+            .await?;
+        info!(secret_id = %secret.id.as_str(), "secret created");
+
+        Ok(secret)
+    }
+
+    #[instrument(skip(self, payload), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
+    pub async fn rotate_secret(
+        &self,
+        workspace_id: &WorkspaceId,
+        secret_id: &SecretId,
+        created_by: Option<&UserId>,
+        payload: RotateSecretPayload,
+    ) -> Result<Secret, ApiError> {
+        self.ensure_workspace_exists(workspace_id).await?;
+        if payload.value.is_null() {
+            return Err(ApiError::validation("secret value must not be null"));
+        }
+
+        let now = now_string()?;
+        let ciphertext = self.secret_crypto.encrypt(&payload.value)?;
+        self.registry
+            .rotate_secret(RotateSecretRequest {
+                workspace_id,
+                secret_id,
+                ciphertext: &ciphertext,
+                key_version: self.secret_crypto.key_version(),
+                created_at: &now,
+                updated_at: &now,
+                created_by,
+            })
+            .await?;
+        info!(secret_id = %secret_id.as_str(), "secret rotated");
+
+        self.get_secret(workspace_id, secret_id).await
+    }
+
+    #[instrument(skip(self), fields(workspace_id = %workspace_id.as_str(), secret_id = %secret_id.as_str()))]
+    pub async fn delete_secret(
+        &self,
+        workspace_id: &WorkspaceId,
+        secret_id: &SecretId,
+    ) -> Result<(), ApiError> {
+        self.ensure_workspace_exists(workspace_id).await?;
+        self.registry.delete_secret(workspace_id, secret_id).await?;
+        info!(secret_id = %secret_id.as_str(), "secret deleted");
+        Ok(())
+    }
+
     #[instrument(skip(self))]
     pub async fn list_agents(
         &self,
@@ -3249,6 +3374,18 @@ fn validate_auth_profile_kind(kind: AuthKind, config: &AuthConfig) -> Result<(),
     Err(ApiError::validation("auth kind and config must match"))
 }
 
+fn validate_secret_payload(payload: &SecretPayload) -> Result<(), ApiError> {
+    if payload.name.trim().is_empty() {
+        return Err(ApiError::validation("secret name must not be empty"));
+    }
+
+    if payload.value.is_null() {
+        return Err(ApiError::validation("secret value must not be null"));
+    }
+
+    Ok(())
+}
+
 fn latest_sample_ref(
     samples: &[OperationSampleMetadata],
     sample_kind: SampleKind,