meyi-vault-server-dev 1.0.1

package/README.md

@@ -0,0 +1,95 @@
+# vault-server
+
+> Self-hosted AES-256-GCM encrypted password manager — Express plugin for MeyiConnect
+
+## Installation
+
+```bash
+npm install vault-server
+```
+
+## MeyiConnect plugin integration
+
+Copy the wrapper into your MeyiConnect backend:
+
+```
+backend/src/plugins/vault/index.mjs
+```
+
+```js
+import { install, start, stop } from 'vault-server'
+import { verifyToken } from '../../middleware/auth.mjs'
+
+export async function install() {
+  await install()
+}
+
+export async function start(app, config, db) {
+  await start(app, config, db, verifyToken)
+}
+
+export async function stop() {
+  await stop()
+}
+```
+
+MeyiConnect's `pluginService` will call `install()` once and `start()` on each boot.
+
+## Standalone usage
+
+```js
+import express from 'express'
+import { install, start } from 'vault-server'
+
+const app = express()
+
+// Your own auth middleware that sets req.user = { id, role, email }
+const myAuth = (req, res, next) => { /* ... */ next() }
+
+await install()                    // create DB tables
+await start(app, {}, null, myAuth) // mount at /api/v1/vault
+
+app.listen(4000)
+```
+
+## Environment variables
+
+| Variable          | Default          | Description                          |
+|-------------------|------------------|--------------------------------------|
+| `DATABASE_URL`    | required         | PostgreSQL connection string         |
+| `VAULT_DB_SCHEMA` | `meyiconnect`    | PostgreSQL schema for vault tables   |
+| `VAULT_MOUNT_PATH`| `/api/v1/vault`  | Express mount path                   |
+
+## API routes
+
+All routes require `req.user` set by the injected auth middleware.
+
+```
+GET    /api/v1/vault/vaults
+POST   /api/v1/vault/vaults
+DELETE /api/v1/vault/vaults/:id
+
+GET    /api/v1/vault/vaults/:vaultId/groups
+POST   /api/v1/vault/vaults/:vaultId/groups
+PUT    /api/v1/vault/vaults/:vaultId/groups/:id
+DELETE /api/v1/vault/vaults/:vaultId/groups/:id
+
+GET    /api/v1/vault/groups/:groupId/entries
+POST   /api/v1/vault/groups/:groupId/entries
+PUT    /api/v1/vault/groups/:groupId/entries/:id
+DELETE /api/v1/vault/groups/:groupId/entries/:id   (soft delete)
+
+POST   /api/v1/vault/grants
+GET    /api/v1/vault/grants
+GET    /api/v1/vault/grants/received
+DELETE /api/v1/vault/grants/:id
+
+GET    /api/v1/vault/stats
+```
+
+## Security
+
+- **AES-256-GCM** — authenticated encryption, throws on tampered ciphertext
+- **Per-vault keys** — each vault has its own random 32-byte key
+- **Soft deletes** — entries are never hard-deleted; `deleted_at` timestamp set
+- **No auth code** — delegates entirely to the host's auth middleware via `verifyToken` injection

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "meyi-vault-server-dev",
+  "version": "1.0.1",
+  "description": "Self-hosted encrypted password manager — server plugin for MeyiConnect",
+  "type": "module",
+  "main": "src/index.mjs",
+  "exports": {
+    ".": "./src/index.mjs",
+    "./database": "./src/database/schema.mjs",
+    "./plugin": "./src/plugin.mjs"
+  },
+  "scripts": {
+    "dev": "node --watch src/index.mjs",
+    "build": "esbuild src/index.mjs --bundle --platform=node --format=esm --outfile=dist/index.mjs",
+    "test": "node --test src/**/*.test.mjs"
+  },
+  "keywords": ["password-manager", "vault", "meyiconnect", "plugin", "encrypted"],
+  "author": "Meyi Technologies",
+  "license": "MIT",
+  "dependencies": {
+    "drizzle-orm": "^0.44.7",
+    "pg": "^8.18.0"
+  },
+  "devDependencies": {
+    "esbuild": "0.25.5"
+  },
+  "peerDependencies": {
+    "express": "^4.x"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/scratch/migrate-up.mjs

@@ -0,0 +1,17 @@
+import { Pool } from 'pg'
+import { runMigrations } from '../src/database/migrate.mjs'
+
+const pool = new Pool({
+  connectionString: "postgresql://postgres:root@localhost:5432/postgres",
+})
+
+console.log('Running migrations...')
+runMigrations(pool, 'meyiconnect')
+  .then(() => {
+    console.log('Done')
+    process.exit(0)
+  })
+  .catch(err => {
+    console.error('Migration failed:', err)
+    process.exit(1)
+  })

package/src/database/migrate.mjs

@@ -0,0 +1,138 @@
+/**
+ * Creates all vault tables inside the host's PostgreSQL schema.
+ * Uses raw SQL (IF NOT EXISTS) so it is safe to run multiple times.
+ * Called by the plugin's install() lifecycle method.
+ */
+
+export async function runMigrations(pool, schemaName = 'meyiconnect') {
+  const client = await pool.connect()
+  try {
+    await client.query(`SET search_path TO "${schemaName}", public`)
+
+    await client.query(`
+      -- Vaults: top-level container, one AES key per vault
+      CREATE TABLE IF NOT EXISTS "${schemaName}".vault_vaults (
+        id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        name          TEXT NOT NULL,
+        owner_id      UUID NOT NULL,
+        key_material  TEXT NOT NULL DEFAULT '',
+        created_at    TIMESTAMPTZ DEFAULT NOW()
+      );
+
+      -- Entries: AES-256-GCM encrypted credentials
+      -- Columns are initially created with the new naming/optionality
+      CREATE TABLE IF NOT EXISTS "${schemaName}".vault_entries (
+        id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        vault_id       UUID NOT NULL REFERENCES "${schemaName}".vault_vaults(id) ON DELETE CASCADE,
+        domain         TEXT DEFAULT '',
+        username       TEXT,
+        encrypted_data TEXT,
+        iv             TEXT,
+        auth_tag       TEXT,
+        alias          TEXT,
+        deleted_at     TIMESTAMPTZ,
+        created_at     TIMESTAMPTZ DEFAULT NOW(),
+        updated_at     TIMESTAMPTZ DEFAULT NOW()
+      );
+
+      -- Migration Logic: Handle existing tables from previous versions
+      DO $$ 
+      BEGIN 
+        -- 1. Rename title to alias if title exists
+        IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = '${schemaName}' AND table_name = 'vault_entries' AND column_name = 'title') THEN
+          ALTER TABLE "${schemaName}".vault_entries RENAME COLUMN title TO alias;
+        END IF;
+
+        -- 2. Make columns nullable for optional fields
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN domain DROP NOT NULL;
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN username DROP NOT NULL;
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN encrypted_data DROP NOT NULL;
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN iv DROP NOT NULL;
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN auth_tag DROP NOT NULL;
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN alias DROP NOT NULL;
+
+        -- 3. Add vault_id if it doesn't exist (from older group-based schema)
+        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = '${schemaName}' AND table_name = 'vault_entries' AND column_name = 'vault_id') THEN
+          ALTER TABLE "${schemaName}".vault_entries ADD COLUMN vault_id UUID REFERENCES "${schemaName}".vault_vaults(id) ON DELETE CASCADE;
+        END IF;
+
+        -- 4. If group_id still exists, try to backfill vault_id and domain from vault_groups
+        IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = '${schemaName}' AND table_name = 'vault_entries' AND column_name = 'group_id') THEN
+          UPDATE "${schemaName}".vault_entries e
+          SET vault_id = g.vault_id,
+              domain = g.domain
+          FROM "${schemaName}".vault_groups g
+          WHERE e.group_id = g.id AND e.vault_id IS NULL;
+
+          -- Drop old references
+          DROP INDEX IF EXISTS idx_vault_entries_group_active;
+          ALTER TABLE "${schemaName}".vault_entries DROP COLUMN group_id;
+        END IF;
+
+        -- Ensure vault_id is NOT NULL
+        ALTER TABLE "${schemaName}".vault_entries ALTER COLUMN vault_id SET NOT NULL;
+      END $$;
+
+      -- Grants: time-limited shared access
+      CREATE TABLE IF NOT EXISTS "${schemaName}".vault_grants (
+        id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        scope          TEXT NOT NULL CHECK (scope IN ('vault','entry')),
+        scope_id       UUID NOT NULL,
+        grantee_id     UUID NOT NULL,
+        granted_by_id  UUID NOT NULL,
+        expires_at     TIMESTAMPTZ,
+        revoked_at     TIMESTAMPTZ,
+        created_at     TIMESTAMPTZ DEFAULT NOW(),
+        UNIQUE(scope, scope_id, grantee_id)
+      );
+
+      -- Index for fast grant lookups by grantee
+      CREATE INDEX IF NOT EXISTS idx_vault_grants_grantee
+        ON "${schemaName}".vault_grants (grantee_id)
+        WHERE revoked_at IS NULL;
+
+      -- Index for soft-delete queries on entries
+      CREATE INDEX IF NOT EXISTS idx_vault_entries_vault_active
+        ON "${schemaName}".vault_entries (vault_id)
+        WHERE deleted_at IS NULL;
+
+      -- Audit logs: immutable activity trail
+      CREATE TABLE IF NOT EXISTS "${schemaName}".vault_audit_logs (
+        id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        actor_id     TEXT NOT NULL,
+        actor_name   TEXT NOT NULL DEFAULT '',
+        actor_email  TEXT NOT NULL DEFAULT '',
+        action       TEXT NOT NULL,
+        module       TEXT NOT NULL,
+        item_id      TEXT NOT NULL DEFAULT '',
+        item_label   TEXT NOT NULL DEFAULT '',
+        meta         TEXT,
+        created_at   TIMESTAMPTZ DEFAULT NOW()
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_vault_audit_created
+        ON "${schemaName}".vault_audit_logs (created_at DESC);
+
+      -- Cleanup old groups table
+      DROP TABLE IF EXISTS "${schemaName}".vault_groups;
+    `)
+
+    console.log(`[vault-server] ✅ Migrations complete (schema: ${schemaName})`)
+  } finally {
+    client.release()
+  }
+}
+
+export async function dropTables(pool, schemaName = 'meyiconnect') {
+  const client = await pool.connect()
+  try {
+    await client.query(`
+      DROP TABLE IF EXISTS "${schemaName}".vault_grants;
+      DROP TABLE IF EXISTS "${schemaName}".vault_entries;
+      DROP TABLE IF EXISTS "${schemaName}".vault_vaults;
+    `)
+    console.log(`[vault-server] Tables dropped (schema: ${schemaName})`)
+  } finally {
+    client.release()
+  }
+}

package/src/database/schema.mjs

@@ -0,0 +1,75 @@
+import { pgSchema, text, timestamp, uuid, unique } from 'drizzle-orm/pg-core'
+
+/**
+ * Vault Schema Definitions
+ * ─────────────────────────────────────────
+ * We use a dedicated schema 'meyiconnect' (or configurable) to avoid
+ * polluting the public namespace.
+ */
+
+export const vaultSchema = pgSchema('meyiconnect')
+
+// ── vault_vaults ──────────────────────────────────────────────────────────────
+// Top-level container for credentials. Each vault has its own AES-256 master key.
+export const vaultVaults = vaultSchema.table('vault_vaults', {
+  id:           uuid('id').defaultRandom().primaryKey(),
+  name:         text('name').notNull(),
+  owner_id:     uuid('owner_id').notNull(),
+  key_material: text('key_material').notNull().default(''), // The "Vault Key" (hex)
+  created_at:   timestamp('created_at').defaultNow(),
+})
+
+// ── vault_entries ─────────────────────────────────────────────────────────────
+// One credential per entry. password+notes encrypted with AES-256-GCM.
+export const vaultEntries = vaultSchema.table('vault_entries', {
+  id:             uuid('id').defaultRandom().primaryKey(),
+  vault_id:       uuid('vault_id').notNull().references(() => vaultVaults.id, { onDelete: 'cascade' }),
+  domain:         text('domain').default(''),       // e.g. "console.aws.amazon.com"
+  username:       text('username'),                  // plaintext — not a secret
+  encrypted_data: text('encrypted_data'),            // base64 AES-GCM ciphertext
+  iv:             text('iv'),                        // base64 12-byte IV
+  auth_tag:       text('auth_tag'),                  // base64 16-byte GCM auth tag
+  alias:          text('alias'),                     // was 'title', now at the end
+  deleted_at:     timestamp('deleted_at'),          // soft delete — never hard delete
+  created_at:     timestamp('created_at').defaultNow(),
+  updated_at:     timestamp('updated_at').defaultNow(),
+})
+
+// ── vault_grants ──────────────────────────────────────────────────────────────
+// Fine-grained sharing. Users can grant access to a whole vault or just one entry.
+export const vaultGrants = vaultSchema.table('vault_grants', {
+  id:            uuid('id').defaultRandom().primaryKey(),
+  // vault | entry
+  scope:         text('scope').notNull(),
+  scope_id:      uuid('scope_id').notNull(),
+  // User receiving the access
+  grantee_id:    uuid('grantee_id').notNull(),
+  // User who granted the access
+  granted_by_id: uuid('granted_by_id').notNull(),
+  expires_at:    timestamp('expires_at'),     // null = no expiry
+  revoked_at:    timestamp('revoked_at'),     // null = still active
+  created_at:    timestamp('created_at').defaultNow(),
+}, (t) => ({
+  unq: unique().on(t.scope, t.scope_id, t.grantee_id)
+}))
+
+// ── vault_audit_logs ──────────────────────────────────────────────────────────
+// Immutable audit trail — never updated or deleted.
+// Every mutation in vaults/entries/grants writes one row here.
+export const vaultAuditLogs = vaultSchema.table('vault_audit_logs', {
+  id:           uuid('id').defaultRandom().primaryKey(),
+  // Who performed the action
+  actor_id:     text('actor_id').notNull(),
+  actor_name:   text('actor_name').notNull().default(''),
+  actor_email:  text('actor_email').notNull().default(''),
+  // What happened: VAULT_CREATED | ENTRY_CREATED | GRANT_CREATED etc.
+  action:       text('action').notNull(),
+  // Which module: vault | entry | grant
+  module:       text('module').notNull(),
+  // The resource that was acted on
+  item_id:      text('item_id').notNull().default(''),
+  item_label:   text('item_label').notNull().default(''),
+  // Extra context (JSON)
+  meta:         text('meta'),
+  created_at:   timestamp('created_at').defaultNow(),
+})

package/src/index.mjs

@@ -0,0 +1,135 @@
+/**
+ * vault-server — MeyiConnect plugin entry point
+ * ─────────────────────────────────────────────
+ * Implements the MeyiConnect plugin contract:
+ *
+ *   install()           → create DB tables (idempotent)
+ *   start(app, cfg, db) → mount Express routes at /api/v1/vault
+ *   stop()              → teardown (optional cleanup)
+ *
+ * The host (MeyiConnect) calls these from pluginService.mjs.
+ * Auth is handled by the host's verifyToken middleware — this
+ * package does NOT ship its own auth.
+ *
+ * Environment variables:
+ *   DATABASE_URL      — PostgreSQL connection string (from host)
+ *   VAULT_DB_SCHEMA   — override schema name (default: 'meyiconnect')
+ *   VAULT_MOUNT_PATH  — override mount path   (default: '/api/v1/vault')
+ */
+
+import { Router } from 'express'
+import { Pool } from 'pg'
+import { drizzle } from 'drizzle-orm/node-postgres'
+import { runMigrations } from './database/migrate.mjs'
+import { createVaultsRouter } from './routes/vaults.mjs'
+import { createEntriesRouter } from './routes/entries.mjs'
+import { createGrantsRouter } from './routes/grants.mjs'
+import { createStatsRouter } from './routes/stats.mjs'
+import { createAuditRouter } from './routes/audit.mjs'
+import * as schema from './database/schema.mjs'
+
+const SCHEMA = process.env.VAULT_DB_SCHEMA || 'meyiconnect'
+const MOUNT  = process.env.VAULT_MOUNT_PATH || '/api/v1/vault'
+
+// Module-level singletons — pool lives for the process lifetime
+let _pool = null
+let _db   = null
+let _mounted = false
+
+function getPool() {
+  if (!_pool) {
+    if (!process.env.DATABASE_URL) {
+      throw new Error('[vault-server] DATABASE_URL is not set')
+    }
+    _pool = new Pool({
+      connectionString: process.env.DATABASE_URL,
+      max: 10,
+      idleTimeoutMillis: 30_000,
+    })
+    _pool.on('error', (err) => {
+      console.error('[vault-server] Pool error:', err.message)
+    })
+  }
+  return _pool
+}
+
+function getDb() {
+  if (!_db) {
+    _db = drizzle(getPool(), { schema })
+  }
+  return _db
+}
+
+// ── Plugin lifecycle ──────────────────────────────────────────────────────────
+
+/**
+ * install() — idempotent table creation.
+ * Safe to run on every app start; uses CREATE TABLE IF NOT EXISTS.
+ */
+export async function install() {
+  console.log('[vault-server] install() — running migrations...')
+  await runMigrations(getPool(), SCHEMA)
+}
+
+/**
+ * start(app, config, hostDb) — mount all vault routes.
+ *
+ * @param {import('express').Application} app       — Express app from host
+ * @param {object}  config   — plugin config row from DB (unused, reserved)
+ * @param {object}  hostDb   — host's Drizzle instance (not used; we use own pool)
+ * @param {Function} verifyToken — host's auth middleware (injected by host)
+ */
+export async function start(app, config = {}, hostDb = null, verifyToken) {
+  if (_mounted) {
+    console.log('[vault-server] Already mounted, skipping')
+    return
+  }
+
+  const db = getDb()
+  const router = Router()
+
+  // Vault CRUD
+  router.use('/vaults', createVaultsRouter(db))
+
+  // Entry CRUD (nested under vault param)
+  router.use('/vaults/:vaultId/entries', createEntriesRouter(db))
+
+  // Access grants
+  router.use('/grants', createGrantsRouter(db))
+
+  // Dashboard stats widget
+  router.use('/stats', createStatsRouter(db))
+
+  // Audit logs
+  router.use('/audit', createAuditRouter(db))
+
+  // Mount on Express app
+  // verifyToken is injected by the host so we don't couple to its internals
+  if (verifyToken) {
+    app.use(MOUNT, verifyToken, router)
+  } else {
+    // Fallback: mount without auth (host should protect at a higher level)
+    console.warn('[vault-server] ⚠️  No verifyToken provided — routes are unprotected!')
+    app.use(MOUNT, router)
+  }
+
+  _mounted = true
+  console.log(`[vault-server] ✅ Mounted at ${MOUNT}`)
+}
+
+/**
+ * stop() — graceful teardown on plugin disable / app shutdown.
+ */
+export async function stop() {
+  if (_pool) {
+    await _pool.end()
+    _pool = null
+    _db   = null
+  }
+  _mounted = false
+  console.log('[vault-server] stopped')
+}
+
+// Named export for direct use outside MeyiConnect
+export { schema as vaultSchema }
+export { encrypt, decrypt, generateVaultKey } from './utils/crypto.mjs'

package/src/routes/audit.mjs

@@ -0,0 +1,80 @@
+import { Router } from 'express'
+import { eq, and, ilike, or, desc, sql, count } from 'drizzle-orm'
+import { vaultAuditLogs } from '../database/schema.mjs'
+
+export function createAuditRouter(db) {
+  const router = Router()
+
+  /**
+   * GET /audit
+   */
+  router.get('/', async (req, res) => {
+    try {
+      // Only admins can see audit logs
+      if (req.user?.role !== 'admin') {
+        return res.status(403).json({ error: 'Forbidden: Admin access required' })
+      }
+
+      const page   = Math.max(1, parseInt(req.query.page)  || 1)
+      const limit  = Math.min(100, parseInt(req.query.limit) || 25)
+      const offset = (page - 1) * limit
+
+      const conditions = []
+
+      if (req.query.module) {
+        conditions.push(eq(vaultAuditLogs.module, req.query.module))
+      }
+      if (req.query.action) {
+        conditions.push(eq(vaultAuditLogs.action, req.query.action))
+      }
+      if (req.query.actor_id) {
+        conditions.push(eq(vaultAuditLogs.actor_id, req.query.actor_id))
+      }
+      if (req.query.search) {
+        const pattern = `%${req.query.search}%`
+        conditions.push(
+          or(
+            ilike(vaultAuditLogs.actor_name, pattern),
+            ilike(vaultAuditLogs.actor_email, pattern),
+            ilike(vaultAuditLogs.item_label, pattern)
+          )
+        )
+      }
+
+      const where = conditions.length > 0 ? and(...conditions) : undefined
+
+      // Get total count
+      const [countRes] = await db
+        .select({ total: count() })
+        .from(vaultAuditLogs)
+        .where(where)
+      
+      const total = countRes.total
+
+      // Get logs
+      const logs = await db
+        .select()
+        .from(vaultAuditLogs)
+        .where(where)
+        .orderBy(desc(vaultAuditLogs.created_at))
+        .limit(limit)
+        .offset(offset)
+
+      res.json({
+        logs: logs.map(l => ({
+          ...l,
+          meta: l.meta ? JSON.parse(l.meta) : null
+        })),
+        total,
+        page,
+        limit,
+        total_pages: Math.max(1, Math.ceil(total / limit))
+      })
+    } catch (err) {
+      console.error('[vault] GET /audit ERROR:', err)
+      res.status(500).json({ error: 'Failed to fetch audit logs', details: err.message })
+    }
+  })
+
+  return router
+}

package/src/routes/domains.mjs

@@ -0,0 +1,80 @@
+import { Router } from 'express'
+import { eq, and, isNull, sql } from 'drizzle-orm'
+import { vaultDomains, vaultEntries } from '../database/schema.mjs'
+
+export function createDomainsRouter(db) {
+  const router = Router({ mergeParams: true })
+
+  // GET /vaults/:vaultId/domains
+  router.get('/', async (req, res) => {
+    try {
+      const domains = await db.select().from(vaultDomains)
+        .where(eq(vaultDomains.vault_id, req.params.vaultId))
+
+      // Entry counts per domain
+      const withCounts = await Promise.all(domains.map(async (d) => {
+        const [{ count }] = await db
+          .select({ count: sql`count(*)::int` })
+          .from(vaultEntries)
+          .where(and(eq(vaultEntries.domain_id, d.id), isNull(vaultEntries.deleted_at)))
+        return { ...d, entry_count: count ?? 0 }
+      }))
+
+      res.json({ domains: withCounts })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to fetch domains' })
+    }
+  })
+
+  // POST /vaults/:vaultId/domains
+  router.post('/', async (req, res) => {
+    try {
+      const { name, domain } = req.body
+      if (!name || !domain) return res.status(400).json({ error: 'name and domain required' })
+      const [domainRecord] = await db.insert(vaultDomains).values({
+        vault_id: req.params.vaultId,
+        name: name.trim(),
+        domain: domain.trim().toLowerCase(),
+      }).returning()
+      res.status(201).json({ domain: { ...domainRecord, entry_count: 0 } })
+    } catch (err) {
+      if (err.code === '23505') {
+        return res.status(409).json({ error: 'This domain already exists in the vault' })
+      }
+      res.status(500).json({ error: 'Failed to create domain group' })
+    }
+  })
+
+  // PUT /vaults/:vaultId/domains/:id
+  router.put('/:id', async (req, res) => {
+    try {
+      const updates = {}
+      if (req.body.name) updates.name = req.body.name.trim()
+      if (req.body.domain) updates.domain = req.body.domain.trim().toLowerCase()
+      if (!Object.keys(updates).length) return res.status(400).json({ error: 'Nothing to update' })
+
+      const [domainRecord] = await db.update(vaultDomains).set(updates)
+        .where(and(eq(vaultDomains.id, req.params.id), eq(vaultDomains.vault_id, req.params.vaultId)))
+        .returning()
+
+      if (!domainRecord) return res.status(404).json({ error: 'Domain not found' })
+      res.json({ domain: domainRecord })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to update domain' })
+    }
+  })
+
+  // DELETE /vaults/:vaultId/domains/:id
+  router.delete('/:id', async (req, res) => {
+    try {
+      await db.delete(vaultDomains).where(
+        and(eq(vaultDomains.id, req.params.id), eq(vaultDomains.vault_id, req.params.vaultId))
+      )
+      res.json({ ok: true })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to delete domain' })
+    }
+  })
+
+  return router
+}