keeper_secrets_manager 17.1.0 → 17.2.0

data/lib/keeper_secrets_manager/crypto.rb

@@ -30,7 +30,7 @@ module KeeperSecretsManager
 
       # Convert URL-safe base64 string to bytes
       def url_safe_str_to_bytes(str)
-        # Add padding if needed
+        raise CryptoError, 'url_safe_str_to_bytes: received nil' if str.nil?
         str += '=' * (4 - str.length % 4) if str.length % 4 != 0
         Base64.urlsafe_decode64(str)
       end
@@ -42,6 +42,7 @@ module KeeperSecretsManager
 
       # Convert base64 to bytes
       def base64_to_bytes(str)
+        raise CryptoError, 'base64_to_bytes: received nil' if str.nil?
         Base64.strict_decode64(str)
       end
 
@@ -116,10 +117,7 @@ module KeeperSecretsManager
         end
       end
 
-      # Decrypt with AES-GCM or fallback to CBC
       def decrypt_aes_gcm(encrypted_data, key)
-        # Try GCM first
-        # Extract components
         iv = encrypted_data[0...GCM_IV_LENGTH]
         tag = encrypted_data[-GCM_TAG_LENGTH..]
         ciphertext = encrypted_data[GCM_IV_LENGTH...-GCM_TAG_LENGTH]
@@ -133,18 +131,12 @@ module KeeperSecretsManager
         cipher.update(ciphertext) + cipher.final
       rescue RuntimeError => e
         if e.message.include?('unsupported cipher')
-          # Fallback to AES-CBC
           decrypt_aes_cbc(encrypted_data, key)
         else
           raise e
         end
       rescue OpenSSL::Cipher::CipherError => e
-        # Maybe it's CBC encrypted?
-        begin
-          decrypt_aes_cbc(encrypted_data, key)
-        rescue StandardError
-          raise DecryptionError, "Failed to decrypt data: #{e.message}"
-        end
+        raise DecryptionError, "Failed to decrypt data: #{e.message}"
       end
 
       # Legacy AES-CBC encryption (for compatibility)

data/lib/keeper_secrets_manager/dto/payload.rb

@@ -35,13 +35,14 @@ module KeeperSecretsManager
 
     # Get secrets payload
     class GetPayload < BasePayload
-      attr_accessor :public_key, :requested_records, :requested_folders, :file_uids
+      attr_accessor :public_key, :requested_records, :requested_folders, :file_uids, :request_links
 
       def initialize
         super()
         @requested_records = nil
         @requested_folders = nil
         @file_uids = nil
+        @request_links = nil
       end
     end
 
@@ -57,7 +58,7 @@ module KeeperSecretsManager
 
     # Update record payload
     class UpdatePayload < BasePayload
-      attr_accessor :record_uid, :data, :revision, :transaction_type
+      attr_accessor :record_uid, :data, :revision, :transaction_type, :links2_remove
 
       def initialize
         super()

data/lib/keeper_secrets_manager/dto.rb

@@ -1,12 +1,13 @@
 require 'json'
-require 'ostruct'
 require_relative 'dto/payload'
+require_relative 'utils'
+require_relative 'crypto'
 
 module KeeperSecretsManager
   module Dto
     # Base class for dynamic record handling
     class KeeperRecord
-      attr_accessor :uid, :title, :type, :fields, :custom, :notes, :folder_uid, :data, :revision, :files
+      attr_accessor :uid, :title, :type, :fields, :custom, :notes, :folder_uid, :inner_folder_uid, :data, :revision, :files, :links, :is_editable
       attr_reader :record_key  # Internal - stores decrypted record key (bytes) for file upload operations
 
       def initialize(attrs = {})
@@ -14,6 +15,7 @@ module KeeperSecretsManager
           # Support both raw API response and user-friendly creation
           @uid = attrs['recordUid'] || attrs['uid'] || attrs[:uid]
           @folder_uid = attrs['folderUid'] || attrs['folder_uid'] || attrs[:folder_uid]
+          @inner_folder_uid = attrs['innerFolderUid'] || attrs['inner_folder_uid'] || attrs[:inner_folder_uid]
           @revision = attrs['revision'] || attrs[:revision] || 0
 
           # Handle encrypted data or direct attributes
@@ -33,6 +35,19 @@ module KeeperSecretsManager
           end
 
           @files = attrs['files'] || attrs[:files] || []
+          @links = attrs['links'] || attrs[:links] || []
+
+          # Handle is_editable (can be false, so use has_key? check)
+          if attrs.key?('isEditable')
+            @is_editable = attrs['isEditable']
+          elsif attrs.key?('is_editable')
+            @is_editable = attrs['is_editable']
+          elsif attrs.key?(:is_editable)
+            @is_editable = attrs[:is_editable]
+          else
+            @is_editable = true  # Default to true if not specified
+          end
+
           @data = attrs
         end
 
@@ -50,8 +65,7 @@ module KeeperSecretsManager
           'fields' => fields
         }
 
-        # Only include custom if it has entries (server doesn't send empty arrays)
-        result['custom'] = custom if custom && !custom.empty?
+        result['custom'] = custom unless custom.nil?
 
         # Only include notes if present
         result['notes'] = notes if notes && !notes.empty?
@@ -108,6 +122,22 @@ module KeeperSecretsManager
         end
       end
 
+      # Return this record's linked-credential entries as typed KeeperRecordLink objects.
+      #
+      # Typed view over the raw `links` list (populated when secrets are fetched with
+      # QueryOptions(..., request_links: true)). The raw `links` list is left unchanged
+      # for backward compatibility; entries without a String recordUid are skipped.
+      def get_links
+        (links || []).each_with_object([]) do |link_dict, result|
+          next unless link_dict.is_a?(Hash)
+
+          record_uid = link_dict['recordUid']
+          next unless record_uid.is_a?(String) && !record_uid.empty?
+
+          result << KeeperRecordLink.new(link_dict)
+        end
+      end
+
       # Dynamic field access methods
       def method_missing(method, *args, &block)
         method_name = method.to_s
@@ -154,6 +184,279 @@ module KeeperSecretsManager
       end
     end
 
+    # Typed view over a single linked-credential entry of a record (`record.links`).
+    #
+    # A link entry carries `recordUid`, optional base64 `data`, and an optional `path`
+    # discriminator. Observed payload shapes (verified against the live backend):
+    #
+    # - path "meta" (self-link, recordUid == owning record): plain base64 JSON with
+    #   `allowedSettings` (rotation, connections, portForwards, sessionRecording,
+    #   typescriptRecording, aiEnabled, aiSessionTerminate, remoteBrowserIsolation),
+    #   plus `rotateOnTermination`, `version` and `no_update_services`.
+    # - path nil (credential link to another record): plain base64 JSON with
+    #   `is_admin`, `is_launch_credential`, `is_iam_user`, `belongs_to` and
+    #   `rotation_settings`; or no data at all (pure record reference).
+    # - path "ai_settings" / "jit_settings" (self-links): data is AES-256-GCM
+    #   encrypted under the owning record's key - see #get_decrypted_data.
+    #
+    # Accessors never raise: parse, decode or decryption failures yield nil/false.
+    # The original link hash is kept untouched in `raw`, and #get_link_data returns the
+    # complete parsed payload, so fields unknown to this SDK version are preserved.
+    #
+    # Naming: Ruby predicates take a trailing `?` and drop the redundant `is_` prefix
+    # (house style), so the Python reference's is_admin_user/is_launch_credential/
+    # is_iam_user map to admin_user?/launch_credential?/iam_user? here.
+    class KeeperRecordLink
+      attr_reader :raw, :record_uid, :data, :path
+
+      def initialize(link_dict = {})
+        link_dict = {} unless link_dict.is_a?(Hash)
+        @raw = link_dict.dup
+        @record_uid = link_dict['recordUid']
+        @data = link_dict['data']
+        @path = link_dict['path']
+      end
+
+      def to_s
+        "[KeeperRecordLink: record_uid=#{@record_uid}, path=#{@path}]"
+      end
+
+      def admin_user?
+        boolean_value('is_admin')
+      end
+
+      def launch_credential?
+        boolean_value('is_launch_credential')
+      end
+
+      def iam_user?
+        boolean_value('is_iam_user')
+      end
+
+      def belongs_to?
+        boolean_value('belongs_to')
+      end
+
+      def no_update_services?
+        boolean_value('no_update_services')
+      end
+
+      def allows_rotation?
+        boolean_value('rotation', true)
+      end
+
+      def allows_connections?
+        boolean_value('connections', true)
+      end
+
+      def allows_port_forwards?
+        boolean_value('portForwards', true)
+      end
+
+      def allows_session_recording?
+        boolean_value('sessionRecording', true)
+      end
+
+      def allows_typescript_recording?
+        boolean_value('typescriptRecording', true)
+      end
+
+      def allows_remote_browser_isolation?
+        boolean_value('remoteBrowserIsolation', true)
+      end
+
+      def ai_enabled?
+        boolean_value('aiEnabled', true)
+      end
+
+      def ai_session_terminate?
+        boolean_value('aiSessionTerminate', true)
+      end
+
+      def rotates_on_termination?
+        boolean_value('rotateOnTermination')
+      end
+
+      # The link data schema version (`version`) when it is an integer, else nil.
+      def get_link_data_version
+        int_value('version')
+      end
+
+      # The `allowedSettings` object from the link data (empty hash when absent).
+      def get_allowed_settings
+        parsed = parse_json_data
+        allowed = parsed ? parsed['allowedSettings'] : nil
+        allowed.is_a?(Hash) ? allowed : {}
+      end
+
+      # The `rotation_settings` object from the link data, or nil when absent.
+      def get_rotation_settings
+        parsed = parse_json_data
+        rotation = parsed ? parsed['rotation_settings'] : nil
+        rotation.is_a?(Hash) ? rotation : nil
+      end
+
+      # Base64-decode `data` to a string (for debugging/advanced use), or nil.
+      def get_decoded_data
+        return nil if @data.nil?
+
+        Utils.base64_to_bytes(@data).force_encoding('UTF-8').scrub
+      rescue StandardError
+        nil
+      end
+
+      # Whether the link has readable JSON data (vs. encrypted/binary data).
+      def has_readable_data?
+        decoded = get_decoded_data
+        !decoded.nil? && (decoded.start_with?('{') || decoded.start_with?('['))
+      end
+
+      # Whether this link's path indicates potentially encrypted data (currently
+      # ai_settings / jit_settings; other paths carry plain base64 JSON).
+      def might_be_encrypted?
+        %w[ai_settings jit_settings].include?(@path)
+      end
+
+      # Whether the data appears encrypted, by inspecting the actual content (non-JSON
+      # and mostly non-printable) rather than path naming conventions.
+      def has_encrypted_data?
+        decoded = get_decoded_data
+        return false if decoded.nil?
+        return false if decoded.start_with?('{') || decoded.start_with?('[')
+
+        !printable_text?(decoded)
+      end
+
+      # Decrypt the link data with the owning record's key (AES-256-GCM). record_key is
+      # the record's decrypted key bytes (record.record_key). Returns the decrypted
+      # string, or nil if data/key is missing or decryption fails.
+      def get_decrypted_data(record_key = nil)
+        return nil if @data.nil? || record_key.nil?
+
+        encrypted = Utils.base64_to_bytes(@data)
+        Crypto.decrypt_aes_gcm(encrypted, record_key).force_encoding('UTF-8').scrub
+      rescue StandardError
+        nil
+      end
+
+      # The complete link data payload, handling both plain and encrypted JSON. Plain
+      # base64 JSON parses without a key; encrypted data requires the owning record's
+      # key. Ciphertext can coincidentally start with "{" or "[", so a failed
+      # plain-JSON parse falls through to decryption rather than giving up. The returned
+      # hash preserves all fields sent by the server, including ones this SDK version
+      # doesn't know about yet.
+      def get_link_data(record_key = nil)
+        decoded = get_decoded_data
+        return nil if decoded.nil?
+
+        if decoded.start_with?('{') || decoded.start_with?('[')
+          parsed = parse_json_to_dict(decoded)
+          return parsed unless parsed.nil?
+          # Leading {/[ was coincidental ciphertext - fall through to decryption.
+        end
+
+        decrypted = get_decrypted_data(record_key)
+        return nil if decrypted.nil?
+
+        parse_json_to_dict(decrypted)
+      end
+
+      # PAM settings data from this link - only when path == "meta" (plain JSON today;
+      # the key is accepted for forward compatibility).
+      def get_meta_data(record_key = nil)
+        get_settings_for_path('meta', record_key)
+      end
+
+      # AI settings data from this link - only when path == "ai_settings" (encrypted
+      # under the owning record's key). Returns nil for any other path.
+      def get_ai_settings_data(record_key = nil)
+        return nil unless @path == 'ai_settings'
+
+        get_link_data(record_key)
+      end
+
+      # JIT settings data from this link - only when path == "jit_settings" (encrypted
+      # under the owning record's key). Returns nil for any other path.
+      def get_jit_settings_data(record_key = nil)
+        return nil unless @path == 'jit_settings'
+
+        get_link_data(record_key)
+      end
+
+      # Settings data for any path, current or future. Automatically detects whether the
+      # data is plain or encrypted and handles it appropriately. Returns nil when the
+      # path doesn't match or parsing fails.
+      def get_settings_for_path(settings_path, record_key = nil)
+        return nil unless @path == settings_path
+
+        get_link_data(record_key)
+      end
+
+      private
+
+      # Decode `data` and parse it as a JSON object, handling errors gracefully.
+      def parse_json_data
+        decoded = get_decoded_data
+        return nil if decoded.nil? || !(decoded.start_with?('{') || decoded.start_with?('['))
+
+        parsed = JSON.parse(decoded)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      # Read a strict boolean from the link data; missing or non-bool values are false.
+      # With check_allowed_settings the nested `allowedSettings` object is consulted when
+      # the key is absent at the top level (a top-level boolean wins).
+      def boolean_value(key, check_allowed_settings = false)
+        parsed = parse_json_data
+        return false if parsed.nil?
+
+        value = parsed[key]
+        return value if strict_boolean?(value)
+
+        if check_allowed_settings
+          allowed = parsed['allowedSettings']
+          if allowed.is_a?(Hash)
+            nested = allowed[key]
+            return nested if strict_boolean?(nested)
+          end
+        end
+        false
+      end
+
+      # Read a strict integer from the link data; strings and booleans yield nil.
+      def int_value(key)
+        parsed = parse_json_data
+        value = parsed ? parsed[key] : nil
+        return value if value.is_a?(Integer) && !strict_boolean?(value)
+
+        nil
+      end
+
+      def strict_boolean?(value)
+        value == true || value == false
+      end
+
+      # Parse a JSON string, returning a hash only for JSON objects.
+      def parse_json_to_dict(json_str)
+        parsed = JSON.parse(json_str)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      # Whether a string is mostly printable text (>90% of the first 100 chars), used to
+      # distinguish encrypted bytes from plain text.
+      def printable_text?(text)
+        return false if text.nil? || text.empty?
+
+        sample = text[0, 100]
+        printable = sample.each_char.count { |c| (c >= ' ' && c <= '~') || ["\n", "\r", "\t"].include?(c) }
+        (printable.to_f / sample.length) > 0.9
+      end
+    end
+
     # Folder representation
     class KeeperFolder
       attr_accessor :uid, :name, :parent_uid, :folder_type, :folder_key, :records
@@ -179,7 +482,7 @@ module KeeperSecretsManager
 
     # File attachment representation
     class KeeperFile
-      attr_accessor :uid, :name, :title, :mime_type, :size, :data, :url
+      attr_accessor :uid, :name, :title, :mime_type, :size, :data, :url, :thumbnail_url, :last_modified, :file_key
 
       def initialize(attrs = {})
         @uid = attrs['fileUid'] || attrs['uid'] || attrs[:uid]
@@ -189,6 +492,9 @@ module KeeperSecretsManager
         @size = attrs['size'] || attrs[:size]
         @data = attrs['data'] || attrs[:data]
         @url = attrs['url'] || attrs[:url]
+        @thumbnail_url = attrs['thumbnailUrl'] || attrs['thumbnail_url'] || attrs[:thumbnail_url]
+        @last_modified = attrs['lastModified'] || attrs['last_modified'] || attrs[:last_modified]
+        @file_key = attrs['fileKey'] || attrs['file_key'] || attrs[:file_key]
       end
 
       def to_h
@@ -204,7 +510,7 @@ module KeeperSecretsManager
 
     # Response wrapper
     class SecretsManagerResponse
-      attr_accessor :records, :folders, :app_data, :warnings, :errors, :just_bound
+      attr_accessor :records, :folders, :app_data, :warnings, :errors, :just_bound, :expires_on
 
       def initialize(attrs = {})
         @records = attrs[:records] || []
@@ -213,16 +519,18 @@ module KeeperSecretsManager
         @warnings = attrs[:warnings] || []
         @errors = attrs[:errors] || []
         @just_bound = attrs[:just_bound] || false
+        @expires_on = attrs[:expires_on]
       end
     end
 
     # Query options
     class QueryOptions
-      attr_accessor :records_filter, :folders_filter
+      attr_accessor :records_filter, :folders_filter, :request_links
 
-      def initialize(records: nil, folders: nil)
+      def initialize(records: nil, folders: nil, request_links: nil)
         @records_filter = records
         @folders_filter = folders
+        @request_links = request_links
       end
     end
 
@@ -235,5 +543,15 @@ module KeeperSecretsManager
         @subfolder_uid = subfolder_uid
       end
     end
+
+    # Update options
+    class UpdateOptions
+      attr_accessor :transaction_type, :links_to_remove
+
+      def initialize(transaction_type: 'general', links_to_remove: nil)
+        @transaction_type = transaction_type
+        @links_to_remove = links_to_remove || []
+      end
+    end
   end
 end

data/lib/keeper_secrets_manager/keeper_globals.rb

@@ -2,12 +2,10 @@ require_relative 'version'
 
 module KeeperSecretsManager
   module KeeperGlobals
-    # Client version prefix - 'mb' for Ruby SDK
-    CLIENT_VERSION_PREFIX = 'mr'.freeze
+    CLIENT_VERSION_PREFIX = 'mb'.freeze
 
-    # Get client version dynamically from VERSION constant
     def self.client_version
-      "#{CLIENT_VERSION_PREFIX}17.91.0"
+      "#{CLIENT_VERSION_PREFIX}#{KeeperSecretsManager::VERSION}"
     end
 
     # Keeper public keys by ID
@@ -28,7 +26,8 @@ module KeeperSecretsManager
       '14' => 'BJFF8j-dH7pDEw_U347w2CBM6xYM8Dk5fPPAktjib-opOqzvvbsER-WDHM4ONCSBf9O_obAHzCyygxmtpktDuiE',
       '15' => 'BDKyWBvLbyZ-jMueORl3JwJnnEpCiZdN7yUvT0vOyjwpPBCDf6zfL4RWzvSkhAAFnwOni_1tQSl8dfXHbXqXsQ8',
       '16' => 'BDXyZZnrl0tc2jdC5I61JjwkjK2kr7uet9tZjt8StTiJTAQQmnVOYBgbtP08PWDbecxnHghx3kJ8QXq1XE68y8c',
-      '17' => 'BFX68cb97m9_sweGdOVavFM3j5ot6gveg6xT4BtGahfGhKib-zdZyO9pwvv1cBda9ahkSzo1BQ4NVXp9qRyqVGU'
+      '17' => 'BFX68cb97m9_sweGdOVavFM3j5ot6gveg6xT4BtGahfGhKib-zdZyO9pwvv1cBda9ahkSzo1BQ4NVXp9qRyqVGU',
+      '18' => 'BNhngQqTT1bPKxGuB6FhbPTAeNVFl8PKGGSGo5W06xWIReutm6ix6JPivqnbvkydY-1uDQTr-5e6t70G01Bb5JA'
     }.freeze
 
     # Keeper servers by region
@@ -38,7 +37,8 @@ module KeeperSecretsManager
       'AU' => 'keepersecurity.com.au',
       'GOV' => 'govcloud.keepersecurity.us',
       'JP' => 'keepersecurity.jp',
-      'CA' => 'keepersecurity.ca'
+      'CA' => 'keepersecurity.ca',
+      'IL5' => 'il5.keepersecurity.us'
     }.freeze
 
     # Default server (US)

data/lib/keeper_secrets_manager/notation.rb

@@ -11,12 +11,52 @@ module KeeperSecretsManager
         @secrets_manager = secrets_manager
       end
 
+      def get_notation_results(notation)
+        return [] if notation.nil? || !notation.is_a?(String) || notation.empty?
+
+        parsed = parse_notation(notation)
+        raise NotationError, "Invalid notation: #{notation}" if parsed.length < 3
+
+        record_token = parsed[1].text&.first
+        selector     = parsed[2].text&.first
+        raise NotationError, 'Invalid notation: missing record' unless record_token
+        raise NotationError, 'Invalid notation: missing selector' unless selector
+
+        records = @secrets_manager.get_secrets([record_token])
+        if records.empty?
+          all     = @secrets_manager.get_secrets
+          records = all.select { |r| r.title == record_token }
+        end
+        records = records.uniq { |r| r.uid } if records.size > 1
+        raise NotationError, "Multiple records match '#{record_token}'" if records.size > 1
+        raise NotationError, "No records match '#{record_token}'"       if records.empty?
+
+        record    = records.first
+        parameter = parsed[2].parameter&.first
+        index1    = parsed[2].index1&.first
+        index2    = parsed[2].index2&.first
+
+        case selector.downcase
+        when 'type'
+          record.type ? [record.type] : []
+        when 'title'
+          record.title ? [record.title] : []
+        when 'notes'
+          (record.notes && !record.notes.empty?) ? [record.notes] : []
+        when 'file'
+          notation_results_file(record, parameter, record_token)
+        when 'field', 'custom_field'
+          notation_results_field(record, parameter, index1, index2, parsed[2])
+        else
+          raise NotationError, "Invalid selector: #{selector}"
+        end
+      end
+
       # Parse notation and return value
       def parse(notation)
-        return nil if notation.nil? || notation.empty?
-
-        # Validate notation format before parsing
+        return nil if notation.nil?
         raise NotationError, 'Invalid notation format: must be a string' unless notation.is_a?(String)
+        return nil if notation.empty?
 
         # Parse notation URI
         begin
@@ -44,6 +84,10 @@ module KeeperSecretsManager
           records = all_records.select { |r| r.title == record_token }
         end
 
+        # Remove duplicate UIDs - shortcuts/linked records both shared to same KSM App
+        records = records.uniq { |r| r.uid } if records.size > 1
+
+        # Now check for genuine ambiguity (different records with same title)
         raise NotationError, "Multiple records match '#{record_token}'" if records.size > 1
         raise NotationError, "No records match '#{record_token}'" if records.empty?
 
@@ -73,6 +117,64 @@ module KeeperSecretsManager
 
       private
 
+      def value_to_string(v)
+        v.is_a?(String) ? v : v.to_json
+      end
+
+      # Unlike handle_field_selector: no first-element shortcut when no index is given.
+      def notation_results_field(record, parameter, index1, index2, parsed_section)
+        raise NotationError, 'Missing required parameter for field' unless parameter
+
+        field = record.get_field(parameter)
+        raise NotationError, "Field '#{parameter}' not found" unless field
+
+        values = field['value'] || []
+        idx    = parse_index(index1)
+
+        if idx == -1 && index1 && !index1.empty?
+          # index1 is a property name (e.g. [hostName])
+          if values.first.is_a?(Hash)
+            raise NotationError, "Property '#{index1}' not found" unless values.first.key?(index1)
+
+            return [value_to_string(values.first[index1])]
+          else
+            raise NotationError, 'Cannot extract property from non-object value'
+          end
+        end
+
+        raise NotationError, "Field index out of bounds: #{idx} >= #{values.size}" if idx != -1 && idx >= values.size
+
+        selected = idx >= 0 ? [values[idx]] : values
+
+        if index2 && !index2.empty? && index2 != '[]'
+          selected.filter_map do |v|
+            next nil unless v.is_a?(Hash) && v.key?(index2)
+
+            value_to_string(v[index2])
+          end
+        else
+          selected.map { |v| value_to_string(v) }
+        end
+      end
+
+      def notation_results_file(record, parameter, record_token)
+        file = handle_file_selector(record, parameter, record_token)
+
+        file_hash = if file.is_a?(KeeperSecretsManager::Dto::KeeperFile)
+                      {
+                        'fileUid' => file.uid,
+                        'url'     => file.url,
+                        'fileKey' => file.file_key,
+                        'name'    => file.name
+                      }
+                    else
+                      file
+                    end
+
+        content = @secrets_manager.download_file(file_hash)
+        [KeeperSecretsManager::Utils.bytes_to_url_safe_str(content['data'])]
+      end
+
       # Handle file selector
       def handle_file_selector(record, parameter, record_token)
         raise NotationError, 'Missing required parameter: filename or file UID' unless parameter

data/lib/keeper_secrets_manager/notation_enhancements.rb

@@ -6,6 +6,8 @@ module KeeperSecretsManager
       # Get value with enhanced functionality
       # This method extends the basic parse method to handle special cases
       def get_value(notation, options = {})
+        return nil if notation.nil? || !notation.is_a?(String) || notation.empty?
+
         value = parse(notation)
 
         # Check if we should process special types

data/lib/keeper_secrets_manager/storage.rb

@@ -160,14 +160,15 @@ module KeeperSecretsManager
 
         # Write atomically to avoid corruption
         temp_file = "#{@filename}.tmp"
-        File.open(temp_file, 'w') do |f|
+        # Create temp file with secure permissions (0600)
+        File.open(temp_file, 'w', 0o600) do |f|
           f.write(JSON.pretty_generate(@data))
         end
 
         # Move atomically
         File.rename(temp_file, @filename)
 
-        # Set restrictive permissions (owner read/write only)
+        # Ensure final file has restrictive permissions (owner read/write only)
         File.chmod(0o600, @filename)
       rescue StandardError => e
         raise Error, "Failed to save config file: #{e.message}"