@seekrit/cli 0.15.0 → 0.16.0

package/dist/index.js

@@ -13,7 +13,8 @@ z.enum([
 	"ssh",
 	"redis",
 	"aws",
-	"gcp"
+	"gcp",
+	"mongodb"
 ]);
 const executorModeSchema = z.enum(["in_do", "remote"]);
 /**
@@ -113,6 +114,22 @@ const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
 		return false;
 	}
 }, "must be a JWK-serialized P-256 public key");
+z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+/**
+* A MongoDB database name — the db a preset role is granted on, or the
+* authentication database a leased user is created in. MongoDB forbids
+* `/\. "$*<>:|?` and the empty string in db names; we keep to a safe subset.
+*/
+const mongoDatabaseNameSchema = z.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
+/**
+* A single MongoDB role grant `{ role, db }` for a `custom` target — e.g.
+* `{ role: "readWrite", db: "app" }` or a user-defined role. Admin-supplied
+* trusted input, set once at registration; still bounded structurally.
+*/
+const mongoRoleSchema = z.object({
+	role: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
+	db: mongoDatabaseNameSchema
+});
 const postgresAccessLevelSchema = z.enum([
 	"readonly",
 	"readwrite",
@@ -133,6 +150,11 @@ const redisAccessLevelSchema = z.enum([
 	"readwrite",
 	"custom"
 ]);
+const mongoAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
 const connectionSchema = z.object({
 	host: z.string().min(1),
 	port: z.number().int().min(1).max(65535),
@@ -210,13 +232,24 @@ const gcpTargetConfigSchema = z.object({
 	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
 	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
 });
+const mongoTargetConfigSchema = z.object({
+	provider: z.literal("mongodb"),
+	executor: z.literal("in_do"),
+	accessLevel: mongoAccessLevelSchema.optional(),
+	connection: connectionSchema,
+	authSource: mongoDatabaseNameSchema.optional(),
+	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
+	tls: z.boolean().optional(),
+	maxTtlSeconds: z.number().int().min(60).max(3600 * 24 * 7).optional()
+});
 const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
 	sshTargetConfigSchema,
 	awsTargetConfigSchema,
-	gcpTargetConfigSchema
+	gcpTargetConfigSchema,
+	mongoTargetConfigSchema
 ]);
 z.object({
 	name: z.string().trim().min(1).max(128),
@@ -309,13 +342,27 @@ const mintGcpLeaseSchema = z.object({
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
 });
+/**
+* Client → API: mint a MongoDB lease. Like AWS (tier 2), the client generates
+* an ephemeral P-256 keypair locally and sends only the public key; the broker
+* generates the password, runs `createUser`, and returns the credential wrapped
+* to that key. The private key never leaves the requesting machine, so the
+* plaintext credential is only decryptable there.
+*/
+const mintMongoLeaseSchema = z.object({
+	provider: z.literal("mongodb"),
+	targetId: z.string().min(1),
+	recipientPublicKey: p256PublicKeyJwkSchema,
+	ttlSeconds: ttlSecondsSchema
+});
 z.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
 	mintSshLeaseSchema,
 	mintAwsLeaseSchema,
-	mintGcpLeaseSchema
+	mintGcpLeaseSchema,
+	mintMongoLeaseSchema
 ]);
 //#endregion
 //#region ../../packages/core/src/providers/aws.ts
@@ -369,6 +416,32 @@ function gcpSetupInstructions(config) {
 	].join("\n");
 }
 //#endregion
+//#region ../../packages/core/src/providers/mongodb.ts
+/**
+* The one-time setup an admin performs so seekrit can provision users: create a
+* dedicated provisioning user with `userAdmin` on the target database (or
+* `userAdminAnyDatabase` if leases span databases). Printed for the admin to run
+* in `mongosh`, never executed by seekrit — the analogue of
+* `awsTrustPolicyInstructions` / `sshHostSetupInstructions`.
+*/
+function mongoAdminSetupInstructions(config) {
+	const authSource = config.authSource ?? "admin";
+	const db = config.connection.database;
+	return [
+		`// Run once in mongosh against the "${authSource}" database. Creates the`,
+		"// provisioning user whose connection string you register as the admin secret.",
+		`use ${authSource}`,
+		"db.createUser({",
+		"  user: \"seekrit_provisioner\",",
+		"  pwd: passwordPrompt(),",
+		`  roles: [{ role: "userAdmin", db: "${db}" }],`,
+		"})",
+		"",
+		`// Register it: seekrit mongodb target add --name ${db} \\`,
+		`//   --uri "mongodb://seekrit_provisioner:<pwd>@${config.connection.host}:${config.connection.port}/?authSource=${authSource}"`
+	].join("\n");
+}
+//#endregion
 //#region ../../packages/core/src/providers/postgres.ts
 /**
 * The one-time setup SQL an admin runs to create the shared group role that a
@@ -445,6 +518,8 @@ const NOTIFICATION_TYPES = [
 /** URL-safe identifier segment: `my-app`, `production`, … */
 const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
 const nameSchema = z.string().trim().min(1).max(128);
+/** An email address, normalized to trimmed lowercase before validation. */
+const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
 const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
 z.enum([
@@ -452,6 +527,8 @@ z.enum([
 	"admin",
 	"member"
 ]);
+/** Role a person may be invited at — never `owner` (ownership isn't invitable). */
+const inviteRoleSchema = z.enum(["admin", "member"]);
 const principalTypeSchema = z.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
 const serviceTokenRoleSchema = z.enum(["admin", "member"]);
@@ -463,6 +540,10 @@ z.object({
 	name: nameSchema,
 	slug: slugSchema
 });
+z.object({
+	email: emailSchema,
+	role: inviteRoleSchema.default("member")
+});
 z.object({
 	name: nameSchema,
 	slug: slugSchema
@@ -784,6 +865,41 @@ async function unwrapGcpCredential(wrapped, privateKeyJwk) {
 	};
 }
 //#endregion
+//#region ../../packages/crypto/src/mongodb.ts
+/** Generate the ephemeral P-256 keypair a client uses to receive one MongoDB lease. */
+async function generateMongoRecipientKeyPair() {
+	return generateKeyPair();
+}
+/**
+* Unwrap the `wd1.` blob returned by a MongoDB lease mint using the ephemeral
+* private key generated for that lease, yielding the plaintext credential.
+*/
+async function unwrapMongoCredential(wrapped, privateKeyJwk) {
+	const bytes = await unwrapDek(wrapped, await importPrivateKey(privateKeyJwk));
+	let parsed;
+	try {
+		parsed = JSON.parse(utf8Decode(bytes));
+	} catch {
+		throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential was not valid JSON");
+	}
+	const c = parsed;
+	if (typeof c.username !== "string" || typeof c.password !== "string" || typeof c.database !== "string" || typeof c.authSource !== "string" || typeof c.host !== "string" || typeof c.port !== "number" || typeof c.expiration !== "string") throw new SeekritCryptoError("DECRYPT_FAILED", "unwrapped MongoDB credential is missing fields");
+	return {
+		username: c.username,
+		password: c.password,
+		database: c.database,
+		authSource: c.authSource,
+		host: c.host,
+		port: c.port,
+		expiration: c.expiration,
+		uri: mongoConnectionUri(c)
+	};
+}
+/** Build a `mongodb://user:pass@host:port/db?authSource=…` URI from a credential. */
+function mongoConnectionUri(cred) {
+	return `mongodb://${encodeURIComponent(cred.username)}:${encodeURIComponent(cred.password)}@${cred.host}:${cred.port}/${cred.database}?authSource=${cred.authSource}`;
+}
+//#endregion
 //#region ../../packages/crypto/src/mysql.ts
 /**
 * Client-side construction of a MySQL/MariaDB `mysql_native_password`
@@ -1228,7 +1344,7 @@ function isServiceToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.15.0";
+var version = "0.16.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -1301,6 +1417,15 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	listInvites(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/invites`);
+	}
+	createInvite(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/invites`, input);
+	}
+	revokeInvite(orgId, inviteId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/invites/${inviteId}`);
+	}
 	listApps(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/apps`);
 	}
@@ -1677,7 +1802,7 @@ async function resolveGroup(ctx, opts) {
 * `sts:AssumeRole` on the target role.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$5(input) {
+function parseTtlSeconds$6(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1717,7 +1842,7 @@ function registerAwsCommands(program) {
 			region: options.region,
 			...options.externalId ? { externalId: options.externalId } : {},
 			...sessionPolicy ? { sessionPolicy } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$6(options.maxTtl) } : {}
 		};
 		const baseCredential = resolveBaseCredential(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1765,7 +1890,7 @@ function registerAwsCommands(program) {
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		const cfg = t.config;
 		if (cfg.provider !== "aws") fail(`"${t.name}" is not an aws target (see \`seekrit pg\`)`);
-		const ttlSeconds = parseTtlSeconds$5(options.ttl);
+		const ttlSeconds = parseTtlSeconds$6(options.ttl);
 		if (ttlSeconds < 900) fail(`--ttl must be at least ${900 / 60}m (STS minimum)`);
 		const recipient = await generateAwsRecipientKeyPair();
 		const { aws: leased } = await ctx.client.mintLease(org.id, {
@@ -1870,7 +1995,7 @@ function formatSecrets(values, format) {
 * `roles/iam.serviceAccountTokenCreator` on the target.
 */
 /** Parse a duration like `30m`, `1h`, or a bare seconds count. */
-function parseTtlSeconds$4(input) {
+function parseTtlSeconds$5(input) {
 	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
 	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 12h)`);
 	return Number(m[1]) * ({
@@ -1914,7 +2039,7 @@ function registerGcpCommands(program) {
 			serviceAccount: options.serviceAccount,
 			...options.scope?.length ? { scopes: options.scope } : {},
 			...options.delegate?.length ? { delegates: options.delegate } : {},
-			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$4(options.maxTtl) } : {}
+			...options.maxTtl ? { maxTtlSeconds: parseTtlSeconds$5(options.maxTtl) } : {}
 		};
 		const keyJson = resolveServiceAccountKey(options);
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
@@ -1961,7 +2086,7 @@ function registerGcpCommands(program) {
 		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
 		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
 		if (t.config.provider !== "gcp") fail(`"${t.name}" is not a gcp target (see \`seekrit aws\`)`);
-		const ttlSeconds = parseTtlSeconds$4(options.ttl);
+		const ttlSeconds = parseTtlSeconds$5(options.ttl);
 		if (ttlSeconds < 60) fail(`--ttl must be at least 60s`);
 		if (ttlSeconds > 43200) fail(`--ttl must be at most ${GCP_MAX_TTL_SECONDS / 3600}h`);
 		const recipient = await generateGcpRecipientKeyPair();
@@ -1996,6 +2121,139 @@ function registerGcpCommands(program) {
 	});
 }
 //#endregion
+//#region src/mongodb.ts
+/**
+* `seekrit mongodb` — temporary MongoDB credentials (Vault-style dynamic
+* secrets), the tier-2 sibling of `seekrit aws`.
+*
+* MongoDB hashes the password server-side (no verifier injection), so minting
+* generates an ephemeral P-256 keypair on THIS machine and sends only the public
+* key; the broker creates the user and returns the credential wrapped to that
+* key, so the control plane only ever relays ciphertext and only this machine
+* can unwrap it. Registering a target wraps the admin connection string to the
+* broker's public key locally, so the control plane never sees it either.
+*/
+/** Parse a duration like `30m`, `1h`, or a bare seconds count. */
+function parseTtlSeconds$4(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 8h)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** Collect a repeatable option into an array. */
+function collect$4(value, previous) {
+	return [...previous, value];
+}
+/** Parse `readWrite@app` → { role, db } for a custom target. */
+function parseRole(spec) {
+	const [role, db] = spec.split("@");
+	if (!role || !db) fail(`invalid --role "${spec}" (use role@database, e.g. readWrite@app)`);
+	return {
+		role,
+		db
+	};
+}
+/**
+* The admin connection string the broker provisions with. From `--uri` or
+* SEEKRIT_MONGODB_ADMIN_URL; never leaves this machine unwrapped — it is wrapped
+* to the broker key. Needs `userAdmin` on the target database.
+*/
+function resolveAdminUri(uri) {
+	const value = uri ?? process.env.SEEKRIT_MONGODB_ADMIN_URL;
+	if (!value) fail("provide the admin connection string via --uri or SEEKRIT_MONGODB_ADMIN_URL (mongodb://user:pass@host:port/?authSource=admin; needs userAdmin on the database)");
+	return value;
+}
+function registerMongoCommands(program) {
+	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
+	const target = mongo.command("target").description("manage MongoDB targets");
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const adminUri = resolveAdminUri(options.uri);
+		const url = new URL(adminUri);
+		const accessLevel = options.access;
+		if (accessLevel === "custom" && options.role.length === 0) fail("--access custom requires at least one --role role@db");
+		const config = {
+			provider: "mongodb",
+			executor: "in_do",
+			accessLevel,
+			connection: {
+				host: url.hostname,
+				port: url.port ? Number(url.port) : 27017,
+				database: options.database
+			},
+			...options.authSource ? { authSource: options.authSource } : {},
+			...accessLevel === "custom" ? { roles: options.role.map(parseRole) } : {},
+			...options.tls ? {} : { tls: false }
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminUri), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered MongoDB target ${created.name} (${created.id})`);
+		console.error("\nEnsure a provisioning user exists, then `seekrit mongodb lease`:\n");
+		console.log(mongoAdminSetupInstructions(config));
+	});
+	target.command("list").description("list MongoDB targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "mongodb") continue;
+			const host = `${cfg.connection.host}:${cfg.connection.port}`;
+			console.log(`${t.id}\t${t.name}\t${host}\t${cfg.connection.database}\t${cfg.accessLevel ?? "readonly"}`);
+		}
+	});
+	target.command("rm <targetId>").description("delete a MongoDB target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`deleted ${targetId}`);
+	});
+	mongo.command("lease <target>").description("mint short-lived MongoDB credentials; prints a ready-to-use connection URI").option("--org <slug>").option("--ttl <duration>", "credential lifetime, e.g. 30m, 1h, 8h", "1h").option("--json", "print the full credential as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetRef || x.name === targetRef);
+		if (!t) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (t.config.provider !== "mongodb") fail(`"${t?.name}" is not a mongodb target (see \`seekrit aws\`)`);
+		const recipient = await generateMongoRecipientKeyPair();
+		const { mongodb: leased } = await ctx.client.mintLease(org.id, {
+			provider: "mongodb",
+			targetId: t.id,
+			recipientPublicKey: recipient.publicKeyJwk,
+			ttlSeconds: parseTtlSeconds$4(options.ttl)
+		});
+		const cred = await unwrapMongoCredential(leased.wrappedCredential, recipient.privateKeyJwk);
+		console.error(`leased ${cred.username} on ${cred.host}:${cred.port}/${cred.database} — expires ${cred.expiration}`);
+		if (options.json) console.log(JSON.stringify(cred, null, 2));
+		else console.log(`export MONGODB_URI='${cred.uri}'`);
+	});
+	mongo.command("leases").description("list MongoDB leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mongodb") continue;
+			console.log(`${l.id}\t${l.status}\texpires ${l.expiresAt}`);
+		}
+	});
+	mongo.command("revoke <leaseId>").description("revoke a lease now (drops the MongoDB user immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId} (the MongoDB user has been dropped)`);
+	});
+}
+//#endregion
 //#region src/provisioner.ts
 /**
 * `seekrit provisioner` — helpers for the self-hosted **remote executor**
@@ -3087,6 +3345,7 @@ registerProvisionerCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
+registerMongoCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
 	const { runMcpServer } = await import("./mcp-ARBuneH3.js");
 	await runMcpServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {