vaultkeeper 0.7.0 → 0.8.0

package/README.md

@@ -480,7 +480,11 @@ consecutive required-presence operations each demand their own distinct fresh ac
 > intrinsic to the cryptographic operation.
 
 Real-hardware confirmation for each backend is documented as a manual verification test in
-[`docs/manual-tests/presence-per-use.md`](../../docs/manual-tests/presence-per-use.md).
+[`docs/manual-tests/presence-per-use.md`](../../docs/manual-tests/presence-per-use.md). The
+release-process-referenced register of what manual residue remains per backend once its paired
+in-memory double runs the shared conformance corpus in CI — and the cadence/cost of running that
+corpus against the real adapter — lives in
+[`docs/manual-tests/manual-residue-register.md`](../../docs/manual-tests/manual-residue-register.md).
 
 ## Doctor / preflight checks
 

package/dist/index.cjs

@@ -473,6 +473,21 @@ var RotationInProgressError = class extends VaultError {
     this.name = "RotationInProgressError";
   }
 };
+var TestDoubleMisuseError = class extends VaultError {
+  /** The name of the test double class that refused to construct. */
+  doubleName;
+  /**
+   * The environment value (e.g. `process.env.NODE_ENV`) that triggered the
+   * refusal.
+   */
+  detectedEnvironment;
+  constructor(message, doubleName, detectedEnvironment) {
+    super(message);
+    this.name = "TestDoubleMisuseError";
+    this.doubleName = doubleName;
+    this.detectedEnvironment = detectedEnvironment;
+  }
+};
 
 // src/backend/registry.ts
 var BackendRegistry = class {
@@ -1391,13 +1406,19 @@ var DpapiBackend = class {
     const entryPath = getEntryPath2(storageDir, id);
     const script = [
       "Add-Type -AssemblyName System.Security",
-      `$bytes = [System.Text.Encoding]::UTF8.GetBytes(${JSON.stringify(secret)})`,
+      "$b64 = [Console]::In.ReadToEnd()",
+      "$bytes = [System.Convert]::FromBase64String($b64.Trim())",
       "$entropy = $null",
       "$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser",
       "$encrypted = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $entropy, $scope)",
       `[System.IO.File]::WriteAllBytes(${JSON.stringify(entryPath)}, $encrypted)`
     ].join("; ");
-    await execCommand("powershell", ["-NoProfile", "-Command", script]);
+    const secretBuf = Buffer.from(secret, "utf8");
+    const stdinPayload = secretBuf.toString("base64");
+    secretBuf.fill(0);
+    await execCommand("powershell", ["-NoProfile", "-Command", script], {
+      stdin: stdinPayload
+    });
   }
   async retrieve(id) {
     const storageDir = this.#storageDir;
@@ -1454,6 +1475,9 @@ var DpapiBackend = class {
 // src/backend/secret-tool-backend.ts
 var ATTRIBUTE_KEY = "vaultkeeper-id";
 var LABEL_PREFIX = "vaultkeeper: ";
+function stripSecretToolTrailingNewline(stdout) {
+  return stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+}
 var SecretToolBackend = class {
   type = "secret-tool";
   displayName = "Linux Secret Service (secret-tool)";
@@ -1470,29 +1494,29 @@ var SecretToolBackend = class {
   }
   async store(id, secret) {
     const label = `${LABEL_PREFIX}${id}`;
-    await execCommand("secret-tool", ["store", "--label", label, ATTRIBUTE_KEY, id], {
+    await execCommand("secret-tool", ["store", "--label", label, "--", ATTRIBUTE_KEY, id], {
       stdin: secret
     });
   }
   async retrieve(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    if (result.exitCode !== 0 || result.stdout.trim() === "") {
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
-    return result.stdout.trim();
+    return stripSecretToolTrailingNewline(result.stdout);
   }
   async delete(id) {
-    const result = await execCommandFull("secret-tool", ["clear", ATTRIBUTE_KEY, id]);
+    const result = await execCommandFull("secret-tool", ["clear", "--", ATTRIBUTE_KEY, id]);
     if (result.exitCode !== 0) {
       throw new SecretNotFoundError(`Secret not found in Secret Service: ${id}`);
     }
   }
   async exists(id) {
-    const result = await execCommandFull("secret-tool", ["lookup", ATTRIBUTE_KEY, id]);
-    return result.exitCode === 0 && result.stdout.trim() !== "";
+    const result = await execCommandFull("secret-tool", ["lookup", "--", ATTRIBUTE_KEY, id]);
+    return result.exitCode === 0;
   }
   async list() {
-    const result = await execCommandFull("secret-tool", ["search", ATTRIBUTE_KEY, ""]);
+    const result = await execCommandFull("secret-tool", ["search", "--", ATTRIBUTE_KEY, ""]);
     if (result.exitCode !== 0) {
       return [];
     }
@@ -2950,11 +2974,16 @@ async function createToken(key, claims, options) {
 function isObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isLeasePresence(value) {
+  if (!isObject2(value)) return false;
+  const { op, at, method, backend } = value;
+  return typeof op === "string" && typeof at === "number" && typeof method === "string" && typeof backend === "string";
+}
 function parseVaultClaims(raw) {
   if (!isObject2(raw)) {
     return void 0;
   }
-  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref } = raw;
+  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref, kty, kid, kgen, pres } = raw;
   if (typeof jti !== "string") return void 0;
   if (typeof exp !== "number") return void 0;
   if (typeof iat !== "number") return void 0;
@@ -2962,10 +2991,29 @@ function parseVaultClaims(raw) {
   if (typeof exe !== "string") return void 0;
   if (use !== null && typeof use !== "number") return void 0;
   if (tid !== 1 && tid !== 2 && tid !== 3) return void 0;
-  if (typeof bkd !== "string") return void 0;
-  if (typeof val !== "string") return void 0;
+  if (bkd !== void 0 && typeof bkd !== "string") return void 0;
+  if (val !== void 0 && typeof val !== "string") return void 0;
   if (typeof ref !== "string") return void 0;
-  return { jti, exp, iat, sub, exe, use: use ?? null, tid, bkd, val, ref };
+  if (kty !== void 0 && kty !== "secret" && kty !== "signing-key") return void 0;
+  if (kid !== void 0 && typeof kid !== "string") return void 0;
+  if (kgen !== void 0 && typeof kgen !== "number") return void 0;
+  if (pres !== void 0 && !isLeasePresence(pres)) return void 0;
+  return {
+    jti,
+    exp,
+    iat,
+    sub,
+    exe,
+    use: use ?? null,
+    tid,
+    bkd,
+    val,
+    ref,
+    kty,
+    kid,
+    kgen,
+    pres
+  };
 }
 async function decryptToken(key, jwe) {
   let plaintext;
@@ -3046,15 +3094,44 @@ function validateClaims(claims, usedCount = 0) {
   if (claims.exe.trim() === "") {
     throw new VaultError("Invalid token: exe must not be empty");
   }
-  if (claims.bkd.trim() === "") {
-    throw new VaultError("Invalid token: bkd must not be empty");
-  }
-  if (claims.val.trim() === "") {
-    throw new VaultError("Invalid token: val must not be empty");
-  }
   if (claims.ref.trim() === "") {
     throw new VaultError("Invalid token: ref must not be empty");
   }
+  switch (claims.kty) {
+    case "signing-key": {
+      if (claims.val !== void 0) {
+        throw new VaultError("Invalid token: signing lease must not carry a val");
+      }
+      if (claims.kid === void 0 || claims.kid.trim() === "") {
+        throw new VaultError("Invalid token: kid must not be empty");
+      }
+      if (claims.kgen === void 0) {
+        throw new VaultError("Invalid token: kgen is required for a signing lease");
+      }
+      if (!Number.isSafeInteger(claims.kgen) || claims.kgen < 0) {
+        throw new VaultError("Invalid token: kgen must be a non-negative integer");
+      }
+      break;
+    }
+    case "secret":
+    case void 0: {
+      if (claims.bkd === void 0 || claims.bkd.trim() === "") {
+        throw new VaultError("Invalid token: bkd must not be empty");
+      }
+      if (claims.val === void 0 || claims.val.trim() === "") {
+        throw new VaultError("Invalid token: val must not be empty");
+      }
+      if (claims.kid !== void 0 || claims.kgen !== void 0 || claims.pres !== void 0) {
+        throw new VaultError(
+          "Invalid token: secret claim must not carry signing-lease fields (kid/kgen/pres)"
+        );
+      }
+      break;
+    }
+    default: {
+      throw new VaultError(`Invalid token: unrecognized claim kind kty=${String(claims.kty)}`);
+    }
+  }
   if (claims.iat > claims.exp) {
     throw new VaultError("Invalid token: iat must not be after exp");
   }
@@ -4069,6 +4146,16 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
+      );
+    }
+    if (claims.val === void 0) {
+      throw new AuthorizationDeniedError(
+        "This capability token does not carry a secret value \u2014 it is malformed or was not minted as a secret token."
+      );
+    }
     return createSecretAccessor(claims.val);
   }
   /**
@@ -4411,7 +4498,7 @@ var VaultKeeper = class _VaultKeeper {
   // ---------------------------------------------------------------------------
   static #resolveSecrets(token) {
     if (token instanceof CapabilityToken) {
-      return _VaultKeeper.#requireSecretClaims(token).val;
+      return _VaultKeeper.#requireSecretValue(token);
     }
     const result = {};
     for (const [name, t] of Object.entries(token)) {
@@ -4420,7 +4507,7 @@ var VaultKeeper = class _VaultKeeper {
           `Invalid capability token for secret "${name}" \u2014 expected a CapabilityToken from authorize()`
         );
       }
-      result[name] = _VaultKeeper.#requireSecretClaims(t).val;
+      result[name] = _VaultKeeper.#requireSecretValue(t);
     }
     return result;
   }
@@ -4428,7 +4515,10 @@ var VaultKeeper = class _VaultKeeper {
    * Resolve a token to its secret claims, rejecting a signing-key token.
    *
    * Defense in depth: a signing-key capability must never be injectable as a
-   * secret through `fetch()`/`exec()`.
+   * secret through `fetch()`/`exec()`. This rejects both the in-memory
+   * signing-key token (`isSigningClaims`) and a JWE-based signing-key lease
+   * (`kty: 'signing-key'`) — the two capability shapes are discriminated
+   * differently but neither ever carries a secret value.
    */
   static #requireSecretClaims(token) {
     const claims = validateCapabilityToken(token);
@@ -4437,8 +4527,21 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be injected into fetch() or exec()."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing-key lease, not a secret \u2014 it cannot be injected into fetch() or exec()."
+      );
+    }
     return claims;
   }
+  /** Resolve a token to its secret value, rejecting a claims shape with no `val`. */
+  static #requireSecretValue(token) {
+    const claims = _VaultKeeper.#requireSecretClaims(token);
+    if (claims.val === void 0 || claims.val.trim() === "") {
+      throw new AuthorizationDeniedError("This capability token does not authorize a secret value.");
+    }
+    return claims.val;
+  }
   /**
    * Validate a caller-supplied resource name. `kind` names the resource in the
    * error so a signing-key caller is not told about a "secret".
@@ -4631,6 +4734,7 @@ exports.SetupError = SetupError;
 exports.SigningKeyAlreadyExistsError = SigningKeyAlreadyExistsError;
 exports.SigningKeyNotFoundError = SigningKeyNotFoundError;
 exports.SigningNotSupportedError = SigningNotSupportedError;
+exports.TestDoubleMisuseError = TestDoubleMisuseError;
 exports.TokenExpiredError = TokenExpiredError;
 exports.TokenRevokedError = TokenRevokedError;
 exports.UnknownBackendTypeError = UnknownBackendTypeError;