Sipke Schoorstra e2e00ff235

* Add secrets module

* Address Greptile feedback for secrets module

* Handle unavailable secrets in provider adapter

* Address path combine review comments

* Address additional Greptile secrets review

* Address final Greptile secrets feedback

* Handle secrets test payload failures

* address greptile feedback on secrets rotation

* fix secret recreation concurrency

* address greptile secrets followups

* address greptile secrets reliability feedback

* align secret store capabilities

2026-05-20 11:48:01 +02:00

1.7 KiB

Raw Blame History

Import/Export Contract: Secrets Module

Export Modes

Reference-Only Export

Default mode. Exports safe metadata and technical-name references only.

{
  "technicalName": "smtp-password",
  "type": "Text",
  "scope": "Email",
  "storeName": "ElsaEncrypted",
  "referenceOnly": true
}

Encrypted Value Export

Requires export:secrets and an explicit encryption target.

{
  "technicalName": "smtp-password",
  "type": "Text",
  "scope": "Email",
  "storeName": "ElsaEncrypted",
  "referenceOnly": false,
  "encryptedPayload": {
    "algorithm": "recipient-selected",
    "keyId": "import-target-key",
    "cipherText": "..."
  }
}

Rules:

Export packages never contain raw values.
Encrypted export does not use shared Data Protection keys as the portability mechanism.
Stores may refuse encrypted export when they cannot read or export values safely.

Import Conflict Behavior

Same-technical-name conflicts fail by default.

Allowed explicit behaviors:

create-new: create a new secret with a user-provided different technical name.
update-rotate: rotate the existing secret with the imported payload.
skip: leave the existing secret unchanged.

Import Results

Import reports safe item-level results:

{
  "technicalName": "smtp-password",
  "result": "Conflict",
  "code": "TechnicalNameExists",
  "message": "A secret with this technical name already exists."
}