@seekrit/cli 0.5.0 → 0.6.0

package/dist/index.js

@@ -6,6 +6,7 @@ import { homedir } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
+import { z } from "zod";
 //#region ../../packages/crypto/src/encoding.ts
 const CHUNK = 32768;
 /** Base64url (no padding) — portable across browsers, Workers, and Node. */
@@ -384,7 +385,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.5.0";
+var version = "0.6.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -732,6 +733,176 @@ function formatSecrets(values, format) {
 		case "dotenv": return names.map((name) => `${name}=${dotenvQuote(values[name] ?? "")}`).join("\n");
 	}
 }
+z.enum(["postgres"]);
+const executorModeSchema = z.enum(["in_do", "remote"]);
+/**
+* A Postgres role name we are willing to create. Deliberately strict — this
+* value is interpolated into a SQL template, so it must be a bare identifier
+* with no way to break out of quoting (no quotes, whitespace, or semicolons).
+*/
+const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
+/**
+* A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
+* it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
+* base64 + the fixed structural characters, none of which is a single quote).
+*/
+const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+const postgresAccessLevelSchema = z.enum([
+	"readonly",
+	"readwrite",
+	"custom"
+]);
+/** The group role each preset's leased credentials inherit. */
+const POSTGRES_GROUP_ROLES = {
+	readonly: "seekrit_readonly",
+	readwrite: "seekrit_readwrite"
+};
+const connectionSchema = z.object({
+	host: z.string().min(1),
+	port: z.number().int().min(1).max(65535),
+	database: z.string().min(1)
+});
+/** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
+const statementSchema = z.string().min(1).max(4e3);
+/** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
+const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
+const leaseTargetConfigSchema = z.object({
+	provider: z.literal("postgres"),
+	executor: executorModeSchema,
+	accessLevel: postgresAccessLevelSchema.optional(),
+	schema: identifierSchema.optional(),
+	connection: connectionSchema,
+	provisionerUrl: z.url().optional(),
+	createStatements: z.array(statementSchema).max(16).optional(),
+	revokeStatements: z.array(statementSchema).max(16).optional()
+});
+z.object({
+	name: z.string().trim().min(1).max(128),
+	config: leaseTargetConfigSchema,
+	/**
+	* The admin/provisioning credential (e.g. a Postgres connection string),
+	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
+	* control plane stores only this ciphertext — it never sees the plaintext.
+	*/
+	wrappedAdminSecret: z.string().min(1)
+});
+z.object({
+	targetId: z.string().min(1),
+	roleName: postgresRoleNameSchema,
+	verifier: scramVerifierSchema,
+	ttlSeconds: z.number().int().min(60).max(3600 * 24 * 7)
+});
+//#endregion
+//#region ../../packages/core/src/providers/postgres.ts
+/**
+* The one-time setup SQL an admin runs to create the shared group role that a
+* read-only / read-write target's leased credentials inherit. Idempotent (safe
+* to re-run). Returns null for custom targets (the admin owns their own SQL).
+*
+* Identifiers are interpolated from admin-supplied config (database/schema) and
+* fixed group-role constants — this SQL is displayed for the admin to run in
+* their own database, not executed by seekrit.
+*/
+function postgresGroupBootstrapSql(config) {
+	if (config.accessLevel !== "readonly" && config.accessLevel !== "readwrite") return null;
+	const group = POSTGRES_GROUP_ROLES[config.accessLevel];
+	const schema = config.schema ?? "public";
+	const db = config.connection.database;
+	const privileges = config.accessLevel === "readonly" ? "SELECT" : "SELECT, INSERT, UPDATE, DELETE";
+	const lines = [
+		`-- Run once as an admin on "${db}". Temporary ${config.accessLevel} credentials inherit this role.`,
+		"DO $$ BEGIN",
+		`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${group}') THEN`,
+		`    CREATE ROLE ${group} NOLOGIN;`,
+		"  END IF;",
+		"END $$;",
+		`GRANT CONNECT ON DATABASE "${db}" TO ${group};`,
+		`GRANT USAGE ON SCHEMA "${schema}" TO ${group};`,
+		`GRANT ${privileges} ON ALL TABLES IN SCHEMA "${schema}" TO ${group};`,
+		`ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT ${privileges} ON TABLES TO ${group};`
+	];
+	if (config.accessLevel === "readwrite") lines.push(`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA "${schema}" TO ${group};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA "${schema}" GRANT USAGE, SELECT ON SEQUENCES TO ${group};`);
+	return lines.join("\n");
+}
+//#endregion
+//#region ../../packages/core/src/schemas.ts
+/** URL-safe identifier segment: `my-app`, `production`, … */
+const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
+const nameSchema = z.string().trim().min(1).max(128);
+z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
+z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+const principalTypeSchema = z.enum(["user", "service_token"]);
+/** Org-level capability a service token can hold (never `owner`). */
+const serviceTokenRoleSchema = z.enum(["admin", "member"]);
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema
+});
+z.object({
+	groupId: z.string().min(1),
+	/** Precedence among an env's groups (higher wins). Appended if omitted. */
+	position: z.number().int().min(0).optional()
+});
+z.object({
+	name: nameSchema,
+	slug: slugSchema,
+	/** Environment DEK wrapped to the creator's public key — created client-side. */
+	wrappedDek: z.string().min(1)
+});
+z.object({ 
+/** Opaque versioned ciphertext blob from @seekrit/crypto. */
+ciphertext: z.string().min(1).max(65536) });
+z.object({
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Private key encrypted with a passphrase-derived KEK; opaque to the
+	* server. Self-contained blob (embeds KDF salt + iterations).
+	*/
+	encryptedPrivateKey: z.string().min(1)
+});
+z.object({
+	principalType: principalTypeSchema,
+	principalId: z.string().min(1),
+	wrappedDek: z.string().min(1)
+});
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	publicKeyJwk: z.string().min(1),
+	/**
+	* Org-level capability. Defaults to `member` (a runtime credential); pass
+	* `admin` to mint a headless provisioning token. Only an admin caller may
+	* create an `admin` token, so capability cannot escalate itself.
+	*/
+	role: serviceTokenRoleSchema.default("member"),
+	/**
+	* The application environment this token is bound to (org + app + env).
+	* Optional so org-admin tokens can exist, but required for runtime tokens
+	* that resolve secrets via `GET /v1/resolve`.
+	*/
+	environmentId: z.string().min(1).nullish(),
+	expiresAt: z.iso.datetime().nullish()
+});
+z.object({
+	cursor: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(200).default(50),
+	action: z.string().optional(),
+	resourceType: z.string().optional()
+});
 //#endregion
 //#region src/target.ts
 /** Resolve the target org from a flag, the committed config, or a lone org. */
@@ -853,24 +1024,33 @@ function generateRoleName(prefix = "tmp") {
 function registerPgCommands(program) {
 	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
 	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect, []).action(async (options) => {
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--admin-url <url>", "admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
 		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
 		const adminSecret = options.adminUrl ?? process.env.SEEKRIT_PG_ADMIN_URL;
 		if (!adminSecret) fail(executor === "remote" ? "provide the shared HMAC key via --admin-url or SEEKRIT_PG_ADMIN_URL" : "provide the admin connection string via --admin-url or SEEKRIT_PG_ADMIN_URL");
 		const config = {
 			provider: "postgres",
 			executor,
+			accessLevel,
 			connection: {
 				host: options.host,
 				port: Number.parseInt(options.port, 10),
 				database: options.database
 			},
-			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {},
-			...options.createStatement.length ? { createStatements: options.createStatement } : {},
-			...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : { schema: options.schema },
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
 		};
 		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
 		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
@@ -879,7 +1059,12 @@ function registerPgCommands(program) {
 			config,
 			wrappedAdminSecret
 		});
-		console.error(`registered target ${created.name} (${created.id})`);
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+		const bootstrap = postgresGroupBootstrapSql(config);
+		if (bootstrap) {
+			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
+			console.log(bootstrap);
+		}
 	});
 	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
 		const ctx = buildContext();
@@ -887,9 +1072,19 @@ function registerPgCommands(program) {
 		const { targets } = await ctx.client.listLeaseTargets(org.id);
 		for (const t of targets) {
 			const cfg = t.config;
-			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.executor}`);
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
 	});
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const bootstrap = postgresGroupBootstrapSql(t.config);
+		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
+		console.log(bootstrap);
+	});
 	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
@@ -1397,7 +1592,7 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 });
 registerPgCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-CAX4E0Zg.js");
+	const { runMcpServer } = await import("./mcp-Dw3hVhbC.js");
 	await runMcpServer();
 });
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {

package/dist/{mcp-CAX4E0Zg.js → mcp-Dw3hVhbC.js}

@@ -1,8 +1,8 @@
 import { _ as parseServiceToken, a as resolveEnvTarget, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveAppEnv, l as isTokenAuth, m as wrapDek, n as fetchDecryptedSecrets, o as resolveGroup, p as version, r as materializeEnv, s as resolveOrg, t as encryptAndSetSecret, u as tryBuildContext, v as generatePostgresCredential, y as generateDek } from "./index.js";
 import { spawn } from "node:child_process";
+import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
 //#region src/mcp.ts
 /** Lowercase-alphanumeric string for a fresh Postgres role name. */
 function randomLower(length) {