vaultlet

service SecretService {
  // GetSecret returns the current revision of one secret, including its value.
  // This is the only RPC that transports secret bytes, which makes it the one
  // place where a per-read policy check and audit record have to happen.
  rpc GetSecret(GetSecretRequest) returns (GetSecretResponse);

  // PutSecret creates or replaces a secret and returns the revision it wrote.
  // Backends that do not accept writes fail with FAILED_PRECONDITION.
  rpc PutSecret(PutSecretRequest) returns (PutSecretResponse);

  // ListSecrets returns metadata — never values — for every secret at or
  // beneath a namespace.
  rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);

  // DeleteSecret removes a secret. Deleting a key that does not exist is
  // NOT_FOUND rather than a silent success, so callers can tell the two apart.
  rpc DeleteSecret(DeleteSecretRequest) returns (DeleteSecretResponse);

  // WatchSecrets subscribes to a namespace and pushes an event whenever a
  // secret under it is added, updated or deleted.
  //
  // The stream opens with one ADDED event per secret currently in the
  // namespace, followed by a single IN_SYNC event. A client can therefore
  // subscribe without a separate ListSecrets call, and without the race that
  // list-then-watch would leave between the two.
  //
  // Events carry metadata only. To read a rotated value the client calls
  // GetSecret, so secret bytes stay on one authorized, audited path instead of
  // flowing down a long-lived stream whose policy was checked once at subscribe
  // time.
  rpc WatchSecrets(WatchSecretsRequest) returns (stream WatchSecretsResponse);
}

// ParseKey validates and constructs a Key from "ns/.../name".
func ParseKey(s string) (Key, error) {
	s = strings.Trim(s, "/")
	i := strings.LastIndex(s, "/")
	if i <= 0 || i == len(s)-1 {
		return Key{}, fmt.Errorf("%w: %q must be namespace/name", ErrInvalidKey, s)
	}
	ns, err := ParseNamespace(s[:i])
	if err != nil {
		return Key{}, fmt.Errorf("%w: %v", ErrInvalidKey, err)
	}
	name := s[i+1:]
	if len(name) > maxNameLen || !nameRe.MatchString(name) {
		return Key{}, fmt.Errorf("%w: bad name %q", ErrInvalidKey, name)
	}
	return Key{ns: ns, name: name}, nil
}

// Contains reports whether other is n itself or nested beneath it.
// payments.Contains(payments/prod) == true.
func (n Namespace) Contains(other Namespace) bool {
	if len(other.segments) < len(n.segments) {
		return false
	}
	for i, seg := range n.segments {
		if other.segments[i] != seg {
			return false
		}
	}
	return true
}

func NewSecret(meta SecretMeta, value []byte) (Secret, error) {
	if meta.Key.IsZero() {
		return Secret{}, ErrInvalidKey
	}
	if meta.Version.IsZero() {
		return Secret{}, ErrInvalidVersion
	}
	if len(value) == 0 {
		return Secret{}, ErrEmptyValue
	}
	// Defensive copy: callers (and adapters) must not be able to mutate
	// the value after construction.
	v := make([]byte, len(value))
	copy(v, value)
	return Secret{meta: meta, value: v}, nil
}

// Value returns a copy of the secret's bytes.
func (s Secret) Value() []byte {
	v := make([]byte, len(s.value))
	copy(v, s.value)
	return v
}

// String redacts the value so a Secret can never be logged by accident.
func (s Secret) String() string {
	return fmt.Sprintf("Secret{%s@%s}", s.meta.Key, s.meta.Version)
}

// GoString covers %#v as well.
func (s Secret) GoString() string { return s.String() }

package ports

import (
	"context"
	"errors"

	"github.com/IbiliAze/vaultlet/internal/domain"
)

// ErrNotFound is returned by Get and Delete when no secret exists at the key.
// Every backend must wrap this so callers can test with errors.Is.
var ErrNotFound = errors.New("secret not found")
var ErrReadOnly = errors.New("store is read-only")

type SecretStore interface {
	Get(ctx context.Context, key domain.Key) (domain.Secret, error)
	Put(ctx context.Context, key domain.Key, value []byte) (domain.SecretMeta, error)
	List(ctx context.Context, ns domain.Namespace) ([]domain.SecretMeta, error)
	Delete(ctx context.Context, key domain.Key) error
}

// NewPolicy compiles specs into a Policy, rejecting unknown actions and bad
// namespaces so a typo fails at boot rather than becoming a silent denial.
func NewPolicy(specs []RuleSpec) (Policy, error) {
	valid := map[Action]bool{
		ActionGet: true, ActionList: true, ActionWatch: true,
		ActionPut: true, ActionDelete: true,
	}

	p := make(Policy)
	for _, spec := range specs {
		var ns domain.Namespace // zero value: contains every namespace
		if spec.Namespace != "*" {
			parsed, err := domain.ParseNamespace(spec.Namespace)
			if err != nil {
				return nil, fmt.Errorf("policy: user %q: %w", spec.Principal, err)
			}
			ns = parsed
		}

		actions := make(map[Action]bool, len(spec.Actions))
		for _, a := range spec.Actions {
			if !valid[Action(a)] {
				return nil, fmt.Errorf("policy: user %q: unknown action %q", spec.Principal, a)
			}
			actions[Action(a)] = true
		}

		p[spec.Principal] = append(p[spec.Principal], Rule{namespace: ns, actions: actions})
	}
	return p, nil
}

// allows reports whether any of the principal's rules grants action at or
// above ns. No rule, no access.
func (p Policy) allows(principal string, action Action, ns domain.Namespace) bool {
	for _, r := range p[principal] {
		if r.actions[action] && r.namespace.Contains(ns) {
			return true
		}
	}
	return false
}

func (s *Service) Get(ctx context.Context, key domain.Key) (domain.Secret, error) {
	principal, ok := PrincipalFromContext(ctx)
	if !ok || !s.policy.allows(principal, ActionGet, key.Namespace()) {
		audit(ctx, principal, ActionGet, key.String(), "deny", "denied")
		return domain.Secret{}, ErrPermissionDenied
	}

	secret, err := s.store.Get(ctx, key)

	outcome := "success"
	if err != nil {
		outcome = "error"
	}

	audit(ctx, principal, ActionGet, key.String(), "allow", outcome)
	return secret, err
}

// …Put, List and Delete follow the same shape

var _ ports.SecretStore = (*Service)(nil)

// errUnauthenticated is the one answer every authentication failure gets.
// Distinguishing a missing header from an unknown user or a wrong password
// would tell an unauthenticated caller which usernames exist.
var errUnauthenticated = status.Error(codes.Unauthenticated, "invalid credentials")

// dummyHash is compared against when the username is unknown, so that a
// failed lookup costs the same bcrypt work as a wrong password and the two
// cannot be told apart by timing. The preimage is throwaway; even a match
// is rejected because the user is not in the map.
const dummyHash = "$2y$10$sSy2zu.lkhMSh0tzGrFD2eCyfeqkxmpVwEFCDjlm6Nb9Swq.u7sgO"

// authenticate resolves the RPC's principal from its "authorization: Basic"
// metadata, verifying the password against the configured bcrypt hash.
func (s *Server) authenticate(ctx context.Context) (string, error) {
	md, ok := metadata.FromIncomingContext(ctx)
	if !ok {
		return "", errUnauthenticated
	}

	auth := md.Get("authorization")
	if len(auth) == 0 {
		return "", errUnauthenticated
	}
	token, ok := strings.CutPrefix(auth[0], "Basic ")
	if !ok {
		return "", errUnauthenticated
	}
	raw, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return "", errUnauthenticated
	}
	username, password, ok := strings.Cut(string(raw), ":")
	if !ok {
		return "", errUnauthenticated
	}

	hash, known := s.users[username]
	if !known {
		hash = dummyHash
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)); err != nil || !known {
		return "", errUnauthenticated
	}
	return username, nil
}

func New(store ports.SecretStore, tlsCfg config.TLSConfig, auth config.AuthConfig) (*Server, error) {
	s := &Server{store: store}

	cert, err := tls.LoadX509KeyPair(tlsCfg.CertFile, tlsCfg.KeyFile)
	if err != nil {
		return nil, err
	}
	// TLS 1.3 floor: the same policy the CLI pins on its side of the dial.
	creds := credentials.NewTLS(&tls.Config{
		Certificates: []tls.Certificate{cert},
		MinVersion:   tls.VersionTLS13,
	})
	s.users = usersByName(auth.Users)
	s.grpc = grpc.NewServer(
		grpc.Creds(creds),
		grpc.ChainUnaryInterceptor(unaryLogging(), s.unaryAuth()),
		grpc.ChainStreamInterceptor(streamLogging(), s.streamAuth()))
	vaultletv1.RegisterSecretServiceServer(s.grpc, s)

	return s, nil
}

// resolveID maps a domain key onto the Bitwarden secret UUID. The SDK only
// addresses secrets by UUID, so every lookup by name costs a List of the whole
// organization first.
func (s *Store) resolveID(key domain.Key) (string, error) {
	res, err := s.client.Secrets().List(s.orgID)
	if err != nil {
		return "", fmt.Errorf("bitwarden: list secrets: %w", err)
	}

	name := key.String()
	for _, ident := range res.Data {
		if ident.Key == name && s.inProject(ident.ProjectIDS) {
			return ident.ID, nil
		}
	}
	return "", fmt.Errorf("bitwarden: %s: %w", key, ports.ErrNotFound)
}

// versionLayout is RFC 3339 with fixed-width nanoseconds. The stdlib's
// RFC3339Nano strips trailing zeros, which makes versions vary in width and
// sort incorrectly; padding with zeros keeps full precision so two writes in
// the same second stay distinguishable.
const versionLayout = "2006-01-02T15:04:05.000000000Z07:00"

// versionAt derives a domain.Version from a Bitwarden revision date. Bitwarden
// has no version identifier of its own, and RevisionDate is the only field that
// changes on every write. Every method must build versions through here, or
// values from Get and List will not compare equal.
func versionAt(t time.Time) (domain.Version, error) {
	return domain.NewVersion(t.UTC().Format(versionLayout))
}

func run() error {
	cfg, err := config.Load()
	if err != nil {
		return fmt.Errorf("load config: %w", err)
	}

	if err := cfg.Validate(); err != nil {
		return fmt.Errorf("validate config: %w", err)
	}

	store, err := newStore(cfg)
	if err != nil {
		return fmt.Errorf("open backend %q: %w", cfg.Backend, err)
	}
	if closer, ok := store.(interface{ Close() }); ok {
		defer closer.Close()
	}

	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()

	var specs []service.RuleSpec
	for _, user := range cfg.Auth.Users {
		for _, rule := range user.Allow {
			specs = append(specs, service.RuleSpec{
				Principal: user.Username,
				Namespace: rule.Namespace,
				Actions:   rule.Actions,
			})
		}
	}

	policy, err := service.NewPolicy(specs)
	if err != nil {
		return fmt.Errorf("policy initialisation: %w", err)
	}

	app := service.NewService(store, policy)
	server, err := grpcserver.New(app, cfg.TLS, cfg.Auth)
	if err != nil {
		return fmt.Errorf("server initialisation: %w", err)
	}

	if err := server.Listen(ctx, cfg.Listen); err != nil {
		return fmt.Errorf("listen %q: %w", cfg.Listen, err)
	}
	return nil
}