feat: resolve upstream auth at runtime

crates/crank-registry/src/postgres.rs

@@ -710,6 +710,32 @@ impl PostgresRegistry {
         row.as_ref().map(map_secret_record).transpose()
     }
 
+    pub async fn get_current_secret_version(
+        &self,
+        workspace_id: &WorkspaceId,
+        secret_id: &SecretId,
+    ) -> Result<Option<SecretVersionRecord>, RegistryError> {
+        let row = sqlx::query(
+            "select
+                sv.secret_id,
+                sv.version,
+                sv.ciphertext,
+                sv.key_version,
+                to_char(sv.created_at at time zone 'UTC', 'YYYY-MM-DD\"T\"HH24:MI:SS\"Z\"') as created_at,
+                sv.created_by
+             from secrets s
+             join secret_versions sv
+               on sv.secret_id = s.id and sv.version = s.current_version
+             where s.workspace_id = $1 and s.id = $2",
+        )
+        .bind(workspace_id.as_str())
+        .bind(secret_id.as_str())
+        .fetch_optional(&self.pool)
+        .await?;
+
+        row.as_ref().map(map_secret_version_record).transpose()
+    }
+
     pub async fn create_secret(
         &self,
         request: CreateSecretRequest<'_>,
@@ -863,6 +889,32 @@ impl PostgresRegistry {
         Ok(())
     }
 
+    pub async fn touch_secret(
+        &self,
+        workspace_id: &WorkspaceId,
+        secret_id: &SecretId,
+        used_at: &str,
+    ) -> Result<(), RegistryError> {
+        let result = sqlx::query(
+            "update secrets
+                set last_used_at = $3::timestamptz
+              where workspace_id = $1 and id = $2",
+        )
+        .bind(workspace_id.as_str())
+        .bind(secret_id.as_str())
+        .bind(used_at)
+        .execute(&self.pool)
+        .await?;
+
+        if result.rows_affected() == 0 {
+            return Err(RegistryError::SecretNotFound {
+                secret_id: secret_id.as_str().to_owned(),
+            });
+        }
+
+        Ok(())
+    }
+
     pub async fn create_stream_session(
         &self,
         request: CreateStreamSessionRequest<'_>,
@@ -3812,6 +3864,19 @@ fn map_secret_record(row: &PgRow) -> Result<SecretRecord, RegistryError> {
     })
 }
 
+fn map_secret_version_record(row: &PgRow) -> Result<SecretVersionRecord, RegistryError> {
+    Ok(SecretVersionRecord {
+        secret_version: SecretVersion {
+            secret_id: SecretId::new(row.try_get::<String, _>("secret_id")?),
+            version: from_db_version(row.try_get::<i32, _>("version")?, "version")?,
+            ciphertext: row.try_get("ciphertext")?,
+            key_version: row.try_get("key_version")?,
+            created_at: row.try_get("created_at")?,
+            created_by: row.try_get::<Option<String>, _>("created_by")?.map(UserId::new),
+        },
+    })
+}
+
 fn map_stream_session(row: &PgRow) -> Result<StreamSession, RegistryError> {
     Ok(StreamSession {
         id: StreamSessionId::new(row.try_get::<String, _>("id")?),