meyi-vault-server-dev 1.0.1

package/src/routes/entries.mjs

@@ -0,0 +1,217 @@
+import { Router } from 'express'
+import { eq, and, isNull } from 'drizzle-orm'
+import { vaultVaults, vaultEntries } from '../database/schema.mjs'
+import { encrypt, decrypt } from '../utils/crypto.mjs'
+import { checkVaultAccess } from '../utils/auth.mjs'
+import { writeAudit, actorFromReq } from '../utils/audit.mjs'
+
+async function getVault(db, vaultId) {
+  const [vault] = await db.select().from(vaultVaults).where(eq(vaultVaults.id, vaultId))
+  if (!vault) throw Object.assign(new Error('Vault not found'), { status: 404 })
+  return vault
+}
+
+export function createEntriesRouter(db) {
+  const router = Router({ mergeParams: true })
+
+  // GET /vaults/:vaultId/entries — decrypt all entries
+  router.get('/', async (req, res) => {
+    try {
+      const vault = await getVault(db, req.params.vaultId)
+      const { access } = await checkVaultAccess(db, vault.id, req.user)
+      if (!access) return res.status(403).json({ error: 'Forbidden' })
+
+      const keyHex = vault.key_material
+      const rows = await db.select().from(vaultEntries).where(
+        and(eq(vaultEntries.vault_id, req.params.vaultId), isNull(vaultEntries.deleted_at))
+      )
+      const entries = rows.map(e => {
+        let password = null
+        let notes = ''
+        
+        if (e.encrypted_data) {
+          try {
+            const data = JSON.parse(decrypt(e.encrypted_data, e.iv, e.auth_tag, keyHex))
+            password = data.password
+            notes = data.notes || ''
+          } catch (err) {
+            console.error('[vault] Decrypt error for entry', e.id, err.message)
+          }
+        }
+
+        return {
+          id: e.id, 
+          vault_id: e.vault_id, 
+          domain: e.domain || '', 
+          username: e.username || '', 
+          password, 
+          notes,
+          alias: e.alias || '',
+          created_at: e.created_at, 
+          updated_at: e.updated_at,
+        }
+      })
+
+      // Log sensitive access
+      if (entries.length > 0) {
+        await writeAudit(db, {
+          ...actorFromReq(req),
+          action: 'ENTRIES_VIEWED',
+          module: 'entry',
+          item_label: `Viewed ${entries.length} entries in vault ${req.params.vaultId}`,
+          meta: { vault_id: vault.id }
+        })
+      }
+
+      res.json({ entries })
+    } catch (err) {
+      res.status(err.status || 500).json({ error: err.message || 'Failed to fetch entries' })
+    }
+  })
+
+  // POST /vaults/:vaultId/entries — encrypt and store
+  router.post('/', async (req, res) => {
+    try {
+      const vault = await getVault(db, req.params.vaultId)
+      const { access, isOwner } = await checkVaultAccess(db, vault.id, req.user, true)
+      if (!access || !isOwner) return res.status(403).json({ error: 'Forbidden' })
+
+      const { alias, username, password, domain, notes = '' } = req.body
+      
+      // Validation: at least one of domain, username, or password
+      if (!domain?.trim() && !username?.trim() && !password?.trim()) {
+        return res.status(400).json({ error: 'At least one field (Domain, Username, or Password) must have a value' })
+      }
+
+      const keyHex = vault.key_material
+      let enc = { encrypted_data: null, iv: null, auth_tag: null }
+      
+      if (password?.trim() || notes?.trim()) {
+        enc = encrypt(JSON.stringify({ password: password || null, notes }), keyHex)
+      }
+
+      const [entry] = await db.insert(vaultEntries).values({
+        vault_id: req.params.vaultId,
+        domain: domain?.trim() || null,
+        username: username?.trim() || null,
+        alias: alias?.trim() || null,
+        ...enc,
+      }).returning()
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'ENTRY_CREATED',
+        module: 'entry',
+        item_id: entry.id,
+        item_label: entry.alias || entry.domain || entry.username || 'Unnamed Entry',
+        meta: { vault_id: vault.id, domain: entry.domain }
+      })
+
+      res.status(201).json({ entry: { ...entry, password, notes } })
+    } catch (err) {
+      console.error('[vault] POST /entries', err.message)
+      res.status(err.status || 500).json({ error: err.message || 'Failed to create entry' })
+    }
+  })
+
+  // PUT /vaults/:vaultId/entries/:id — re-encrypt on update
+  router.put('/:id', async (req, res) => {
+    try {
+      const vault = await getVault(db, req.params.vaultId)
+      const { access, isOwner } = await checkVaultAccess(db, vault.id, req.user, true)
+      if (!access || !isOwner) return res.status(403).json({ error: 'Forbidden' })
+
+      const [existing] = await db.select().from(vaultEntries).where(
+        and(
+          eq(vaultEntries.id, req.params.id),
+          eq(vaultEntries.vault_id, req.params.vaultId),
+          isNull(vaultEntries.deleted_at)
+        )
+      )
+      if (!existing) return res.status(404).json({ error: 'Entry not found' })
+
+      const keyHex = vault.key_material
+      let old = { password: null, notes: '' }
+      if (existing.encrypted_data) {
+        try {
+          old = JSON.parse(decrypt(existing.encrypted_data, existing.iv, existing.auth_tag, keyHex))
+        } catch (err) {
+          console.error('[vault] Decrypt error for update', existing.id)
+        }
+      }
+
+      const newPassword = req.body.password !== undefined ? req.body.password : old.password
+      const newNotes = req.body.notes !== undefined ? req.body.notes : old.notes || ''
+      const newDomain = req.body.domain !== undefined ? req.body.domain : existing.domain
+      const newUsername = req.body.username !== undefined ? req.body.username : existing.username
+      const newAlias = req.body.alias !== undefined ? req.body.alias : existing.alias
+
+      // Validation: at least one of domain, username, or password
+      if (!newDomain?.trim() && !newUsername?.trim() && !newPassword?.trim()) {
+        return res.status(400).json({ error: 'At least one field (Domain, Username, or Password) must have a value' })
+      }
+
+      let enc = { encrypted_data: existing.encrypted_data, iv: existing.iv, auth_tag: existing.auth_tag }
+      if (req.body.password !== undefined || req.body.notes !== undefined) {
+        if (newPassword?.trim() || newNotes?.trim()) {
+          enc = encrypt(JSON.stringify({ password: newPassword || null, notes: newNotes }), keyHex)
+        } else {
+          enc = { encrypted_data: null, iv: null, auth_tag: null }
+        }
+      }
+
+      const [entry] = await db.update(vaultEntries).set({
+        alias: newAlias?.trim() || null,
+        username: newUsername?.trim() || null,
+        domain: newDomain?.trim() || null,
+        ...enc,
+        updated_at: new Date(),
+      }).where(eq(vaultEntries.id, req.params.id)).returning()
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'ENTRY_UPDATED',
+        module: 'entry',
+        item_id: entry.id,
+        item_label: entry.alias || entry.domain || entry.username || 'Unnamed Entry',
+        meta: { vault_id: vault.id, domain: entry.domain }
+      })
+
+      res.json({ entry: { ...entry, password: newPassword, notes: newNotes } })
+    } catch (err) {
+      console.error('[vault] PUT /entries', err.message)
+      res.status(err.status || 500).json({ error: err.message || 'Failed to update entry' })
+    }
+  })
+
+  // DELETE /vaults/:vaultId/entries/:id — soft delete only
+  router.delete('/:id', async (req, res) => {
+    try {
+      const vault = await getVault(db, req.params.vaultId)
+      const { access, isOwner } = await checkVaultAccess(db, vault.id, req.user, true)
+      if (!access || !isOwner) return res.status(403).json({ error: 'Forbidden' })
+
+      const [entry] = await db.select().from(vaultEntries).where(eq(vaultEntries.id, req.params.id))
+      if (!entry) return res.status(404).json({ error: 'Entry not found' })
+
+      await db.update(vaultEntries).set({ deleted_at: new Date() }).where(
+        and(eq(vaultEntries.id, req.params.id), eq(vaultEntries.vault_id, req.params.vaultId))
+      )
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'ENTRY_DELETED',
+        module: 'entry',
+        item_id: req.params.id,
+        item_label: entry.alias || entry.domain || entry.username || 'Unnamed Entry',
+        meta: { vault_id: vault.id }
+      })
+
+      res.json({ ok: true })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to delete entry' })
+    }
+  })
+
+  return router
+}

package/src/routes/grants.mjs

@@ -0,0 +1,136 @@
+import { Router } from 'express'
+import { eq, and, isNull } from 'drizzle-orm'
+import { vaultGrants } from '../database/schema.mjs'
+import { expiresInToDate } from '../utils/crypto.mjs'
+import { checkVaultAccess, getVaultIdForScope } from '../utils/auth.mjs'
+import { writeAudit, actorFromReq } from '../utils/audit.mjs'
+
+export function createGrantsRouter(db) {
+  const router = Router()
+
+  // POST /grants — create or renew a grant
+  router.post('/', async (req, res) => {
+    try {
+      const { scope, scope_id, grantee_id, expires_in } = req.body
+      if (!scope || !scope_id || !grantee_id) {
+        return res.status(400).json({ error: 'scope, scope_id and grantee_id required' })
+      }
+      if (!['vault', 'entry'].includes(scope)) {
+        return res.status(400).json({ error: 'scope must be vault or entry' })
+      }
+
+      // Check if grantor is the owner of the vault containing this scope
+      const vaultId = await getVaultIdForScope(db, scope, scope_id)
+      if (!vaultId) return res.status(404).json({ error: 'Resource not found' })
+
+      const { access, isOwner } = await checkVaultAccess(db, vaultId, req.user, true)
+      if (!access || !isOwner) return res.status(403).json({ error: 'Forbidden' })
+
+      const expires_at = expiresInToDate(expires_in)
+
+      // Upsert — if grant already exists (even revoked), renew it
+      // Note: we don't have a unique constraint on vaultGrants in schema.mjs (it doesn't specify one)
+      // but the logic here assumes one.
+      // Actually, drizzle onConflict requires a target.
+      
+      const [grant] = await db
+        .insert(vaultGrants)
+        .values({
+          scope,
+          scope_id,
+          grantee_id,
+          granted_by_id: req.user.id,
+          expires_at,
+          revoked_at: null,
+        })
+        .returning()
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'GRANT_CREATED',
+        module: 'grant',
+        item_id: grant.id,
+        item_label: `Access to ${scope} granted to ${grantee_id}`,
+        meta: { scope, scope_id, grantee_id, vault_id: vaultId }
+      })
+
+      res.status(201).json({ grant })
+    } catch (err) {
+      console.error('[vault] POST /grants', err.message)
+      res.status(500).json({ error: 'Failed to create grant' })
+    }
+  })
+
+  // GET /grants — list grants issued by current user
+  router.get('/', async (req, res) => {
+    try {
+      const grants = await db
+        .select()
+        .from(vaultGrants)
+        .where(
+          and(
+            eq(vaultGrants.granted_by_id, req.user.id),
+            isNull(vaultGrants.revoked_at)
+          )
+        )
+      res.json({ grants })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to fetch grants' })
+    }
+  })
+
+  // GET /grants/received — grants received by current user
+  router.get('/received', async (req, res) => {
+    try {
+      const grants = await db
+        .select()
+        .from(vaultGrants)
+        .where(
+          and(
+            eq(vaultGrants.grantee_id, req.user.id),
+            isNull(vaultGrants.revoked_at)
+          )
+        )
+      res.json({ grants })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to fetch received grants' })
+    }
+  })
+
+  // DELETE /grants/:id — revoke
+  router.delete('/:id', async (req, res) => {
+    try {
+      const [grant] = await db
+        .select()
+        .from(vaultGrants)
+        .where(eq(vaultGrants.id, req.params.id))
+
+      if (!grant) return res.status(404).json({ error: 'Grant not found' })
+
+      // Only the grantor or an admin can revoke
+      if (grant.granted_by_id !== req.user.id && req.user.role !== 'admin') {
+        return res.status(403).json({ error: 'Forbidden' })
+      }
+
+      await db
+        .update(vaultGrants)
+        .set({ revoked_at: new Date() })
+        .where(eq(vaultGrants.id, req.params.id))
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'GRANT_REVOKED',
+        module: 'grant',
+        item_id: grant.id,
+        item_label: `Access to ${grant.scope} revoked from ${grant.grantee_id}`,
+        meta: { scope: grant.scope, scope_id: grant.scope_id, grantee_id: grant.grantee_id }
+      })
+
+      res.json({ ok: true })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to delete grant' })
+    }
+  })
+
+  return router
+}

package/src/routes/stats.mjs

@@ -0,0 +1,50 @@
+import { Router } from 'express'
+import { eq, and, isNull, sql } from 'drizzle-orm'
+import { vaultVaults, vaultGrants, vaultEntries } from '../database/schema.mjs'
+
+export function createStatsRouter(db) {
+  const router = Router()
+
+  // GET /stats — dashboard widget data for current user
+  router.get('/', async (req, res) => {
+    try {
+      const userId = req.user.id
+
+      const [{ vault_count }] = await db
+        .select({ vault_count: sql`count(*)::int` })
+        .from(vaultVaults)
+        .where(eq(vaultVaults.owner_id, userId))
+
+      const [{ active_grants }] = await db
+        .select({ active_grants: sql`count(*)::int` })
+        .from(vaultGrants)
+        .where(
+          and(
+            eq(vaultGrants.granted_by_id, userId),
+            isNull(vaultGrants.revoked_at)
+          )
+        )
+
+      const [{ entry_count }] = await db
+        .select({ entry_count: sql`count(*)::int` })
+        .from(vaultEntries)
+        .where(isNull(vaultEntries.deleted_at))
+
+      res.json({
+        vault_count: vault_count ?? 0,
+        active_grants: active_grants ?? 0,
+        entry_count: entry_count ?? 0,
+      })
+    } catch (err) {
+      console.error('[vault] GET /stats', err.message)
+      res.status(500).json({ error: 'Failed to fetch stats' })
+    }
+  })
+
+  // GET /me — current user info
+  router.get('/me', (req, res) => {
+    res.json({ user: req.user })
+  })
+
+  return router
+}

package/src/routes/vaults.mjs

@@ -0,0 +1,156 @@
+import { Router } from 'express'
+import { eq, and, isNull, or, sql, gt } from 'drizzle-orm'
+import { vaultVaults, vaultGrants } from '../database/schema.mjs'
+import { generateVaultKey } from '../utils/crypto.mjs'
+import { checkVaultAccess, getVaultIdForScope } from '../utils/auth.mjs'
+import { writeAudit, actorFromReq } from '../utils/audit.mjs'
+
+export function createVaultsRouter(db) {
+  const router = Router()
+
+  // GET /vaults — list owned + shared vaults
+  router.get('/', async (req, res) => {
+    try {
+      const userId = req.user.id
+      const owned = await db.select().from(vaultVaults).where(eq(vaultVaults.owner_id, userId))
+
+      // Find all active grants for the user
+      const activeGrants = await db.select().from(vaultGrants).where(
+        and(
+          eq(vaultGrants.grantee_id, userId),
+          isNull(vaultGrants.revoked_at),
+          or(
+            isNull(vaultGrants.expires_at),
+            gt(vaultGrants.expires_at, sql`now()`)
+          )
+        )
+      )
+
+      // Resolve vault IDs for all grants
+      const vaultIds = new Set()
+      for (const grant of activeGrants) {
+        if (grant.scope === 'vault') {
+          vaultIds.add(grant.scope_id)
+        } else {
+          const vId = await getVaultIdForScope(db, grant.scope, grant.scope_id)
+          if (vId) vaultIds.add(vId)
+        }
+      }
+
+      let shared = []
+      const activeGrantIds = Array.from(vaultIds)
+      if (activeGrantIds.length > 0) {
+        shared = await db.select().from(vaultVaults).where(
+          sql`${vaultVaults.id} = ANY(ARRAY[${sql.raw(activeGrantIds.map(id => `'${id}'`).join(','))}]::uuid[])`
+        )
+      }
+
+      const ownedIds = new Set(owned.map(v => v.id))
+      const all = [
+        ...owned.map(v => ({ ...v, is_owner: true })),
+        ...shared.filter(v => !ownedIds.has(v.id)).map(v => ({ ...v, is_owner: false })),
+      ].map(({ key_material, ...safe }) => safe) // never send key to client
+
+      res.json({ vaults: all })
+    } catch (err) {
+      console.error('[vault] GET /vaults', err.message)
+      res.status(500).json({ error: 'Failed to fetch vaults' })
+    }
+  })
+
+  // POST /vaults — create vault with fresh AES key
+  router.post('/', async (req, res) => {
+    try {
+      const { name } = req.body
+      if (!name?.trim()) return res.status(400).json({ error: 'name required' })
+      const [vault] = await db.insert(vaultVaults).values({
+        name: name.trim(),
+        owner_id: req.user.id,
+        key_material: generateVaultKey(),
+      }).returning()
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'VAULT_CREATED',
+        module: 'vault',
+        item_id: vault.id,
+        item_label: vault.name,
+      })
+
+      const { key_material, ...safe } = vault
+      res.status(201).json({ vault: { ...safe, is_owner: true } })
+    } catch (err) {
+      console.error('[vault] POST /vaults', err.message)
+      res.status(500).json({ error: 'Failed to create vault' })
+    }
+  })
+
+  // GET /vaults/:id
+  router.get('/:id', async (req, res) => {
+    try {
+      const { access, isOwner, vault } = await checkVaultAccess(db, req.params.id, req.user)
+      if (!vault) return res.status(404).json({ error: 'Vault not found' })
+      if (!access) return res.status(403).json({ error: 'Forbidden' })
+
+      const { key_material, ...safe } = vault
+      res.json({ vault: { ...safe, is_owner: isOwner } })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to fetch vault' })
+    }
+  })
+
+  // PUT /vaults/:id
+  router.put('/:id', async (req, res) => {
+    try {
+      const { name } = req.body
+      if (!name?.trim()) return res.status(400).json({ error: 'name required' })
+      
+      const { access, isOwner, vault } = await checkVaultAccess(db, req.params.id, req.user, true)
+      if (!vault) return res.status(404).json({ error: 'Vault not found' })
+      if (!access) return res.status(403).json({ error: 'Forbidden' })
+
+      const [updated] = await db.update(vaultVaults)
+        .set({ name: name.trim() })
+        .where(eq(vaultVaults.id, req.params.id))
+        .returning()
+      
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'VAULT_UPDATED',
+        module: 'vault',
+        item_id: updated.id,
+        item_label: updated.name,
+      })
+      
+      const { key_material, ...safe } = updated
+      res.json({ vault: { ...safe, is_owner: isOwner } })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to update vault' })
+    }
+  })
+
+  // DELETE /vaults/:id
+  router.delete('/:id', async (req, res) => {
+    try {
+      const { access, vault } = await checkVaultAccess(db, req.params.id, req.user, true)
+      if (!vault) return res.status(404).json({ error: 'Vault not found' })
+      if (!access) return res.status(403).json({ error: 'Forbidden' })
+
+      await db.delete(vaultVaults).where(eq(vaultVaults.id, req.params.id))
+
+      await writeAudit(db, {
+        ...actorFromReq(req),
+        action: 'VAULT_DELETED',
+        module: 'vault',
+        item_id: req.params.id,
+        item_label: vault.name,
+      })
+
+      res.json({ ok: true })
+    } catch (err) {
+      res.status(500).json({ error: 'Failed to delete vault' })
+    }
+  })
+
+  return router
+}

package/src/utils/audit.mjs

@@ -0,0 +1,57 @@
+import { vaultAuditLogs } from '../database/schema.mjs'
+
+/**
+ * Audit logging utility.
+ * Every mutating action in vault-server calls writeAudit().
+ * Errors are swallowed so an audit failure never breaks the main request.
+ */
+
+/**
+ * @param {object} db      — Drizzle DB instance
+ * @param {object} params
+ * @param {string} params.actor_id
+ * @param {string} params.actor_name
+ * @param {string} params.actor_email
+ * @param {string} params.action       — e.g. 'VAULT_CREATED'
+ * @param {string} params.module       — 'vault' | 'group' | 'entry' | 'grant'
+ * @param {string} params.item_id      — UUID of the resource
+ * @param {string} params.item_label   — human name e.g. vault name, entry title
+ * @param {object} [params.meta]       — extra context
+ */
+export async function writeAudit(db, {
+  actor_id,
+  actor_name = '',
+  actor_email = '',
+  action,
+  module,
+  item_id = '',
+  item_label = '',
+  meta = null,
+}) {
+  try {
+    await db.insert(vaultAuditLogs).values({
+      actor_id,
+      actor_name,
+      actor_email,
+      action,
+      module,
+      item_id: String(item_id),
+      item_label,
+      meta: meta ? JSON.stringify(meta) : null,
+    })
+  } catch (err) {
+    // Audit failures must never break the main request path
+    console.error('[vault-audit] write failed:', err.message)
+  }
+}
+
+/**
+ * Convenience: extract actor fields from req.user
+ */
+export function actorFromReq(req) {
+  return {
+    actor_id:    req.user?.id    ?? 'unknown',
+    actor_name:  req.user?.full_name ?? req.user?.name ?? '',
+    actor_email: req.user?.email ?? '',
+  }
+}

package/src/utils/auth.mjs

@@ -0,0 +1,52 @@
+import { eq, and, isNull, or, sql, gt } from 'drizzle-orm'
+import { vaultVaults, vaultGrants, vaultEntries } from '../database/schema.mjs'
+
+/**
+ * Checks if a user has access to a vault.
+ * @returns {Promise<{ access: boolean, isOwner: boolean, vault: any }>}
+ */
+export async function checkVaultAccess(db, vaultId, user, requireOwner = false) {
+  const [vault] = await db.select().from(vaultVaults).where(eq(vaultVaults.id, vaultId))
+  if (!vault) return { access: false, isOwner: false, vault: null }
+
+  const isOwner = vault.owner_id === user.id || user.role === 'admin'
+  if (isOwner) return { access: true, isOwner: true, vault }
+
+  if (requireOwner) return { access: false, isOwner: false, vault }
+
+  // Check for any active grant for this user that covers this vault or any children
+  const activeGrants = await db.select().from(vaultGrants).where(
+    and(
+      eq(vaultGrants.grantee_id, user.id),
+      isNull(vaultGrants.revoked_at),
+      or(
+        isNull(vaultGrants.expires_at),
+        gt(vaultGrants.expires_at, sql`now()`)
+      )
+    )
+  )
+
+  // Filter grants that belong to this vault
+  for (const grant of activeGrants) {
+    if (grant.scope === 'vault' && grant.scope_id === vaultId) return { access: true, isOwner: false, vault }
+    
+    // Check if it's a child resource of this vault
+    const grantVaultId = await getVaultIdForScope(db, grant.scope, grant.scope_id)
+    if (grantVaultId === vaultId) return { access: true, isOwner: false, vault }
+  }
+
+  return { access: false, isOwner: false, vault }
+}
+
+/**
+ * Finds the vaultId for a given scope and id.
+ */
+export async function getVaultIdForScope(db, scope, id) {
+  if (scope === 'vault') return id
+  // 'group' scope removed
+  if (scope === 'entry') {
+    const [e] = await db.select().from(vaultEntries).where(eq(vaultEntries.id, id))
+    return e?.vault_id || null
+  }
+  return null
+}