SemianiakaVY/elsa-core
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity
elsa-core/specs/007-secrets-module/tasks.md
Sipke Schoorstra e2e00ff235
Add secrets module (#7468) 
* Add secrets module

* Address Greptile feedback for secrets module

* Handle unavailable secrets in provider adapter

* Address path combine review comments

* Address additional Greptile secrets review

* Address final Greptile secrets feedback

* Handle secrets test payload failures

* address greptile feedback on secrets rotation

* fix secret recreation concurrency

* address greptile secrets followups

* address greptile secrets reliability feedback

* align secret store capabilities
2026-05-20 11:48:01 +02:00

4.7 KiB
Raw Blame History

Tasks: Secrets Module

Input: Design documents from /specs/007-secrets-module/ Prerequisites: plan.md, spec.md, research.md, data-model.md, contracts/

Tests: Included because the feature is security-sensitive and the specification requires automated safety checks.

Phase 1: Setup

  • T001 Create src/modules/Elsa.Secrets and test/unit/Elsa.Secrets.UnitTests project structure.
  • T002 Add the Secrets projects to Elsa.sln.
  • T003 Add paired Studio module structure in /Users/sipke/.codex/worktrees/ae40/elsa-studio/src/modules/Elsa.Studio.Secrets.

Phase 2: Foundational

  • T004 Implement secret models, status, references, descriptors, and request/response DTOs in src/modules/Elsa.Secrets/Models.
  • T005 Implement runtime and management contracts in src/modules/Elsa.Secrets/Contracts.
  • T006 Implement secret value protection, name validation, type registry, and store registry services in src/modules/Elsa.Secrets/Services.
  • T007 Implement the Elsa-managed encrypted store and configuration-backed read-only store in src/modules/Elsa.Secrets/Stores.
  • T008 Register module and shell features in src/modules/Elsa.Secrets/Features, src/modules/Elsa.Secrets/ShellFeatures, and src/modules/Elsa.Secrets/Extensions.

Phase 3: User Story 1 - Manage Named Secrets (P1)

Goal: Operators can create, inspect safe metadata, rotate, revoke, and delete secrets without cleartext reveal. Independent Test: Create a text secret, rotate it, verify the old version is retired, revoke it, and verify resolution fails.

  • T009 [US1] Add unit tests for name immutability, rotation, revocation, and no-reveal metadata in test/unit/Elsa.Secrets.UnitTests/SecretManagerTests.cs.
  • T010 [US1] Implement secret manager lifecycle operations in src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs.
  • T011 [US1] Implement list/get/create/rotate/revoke/delete/test endpoints in src/modules/Elsa.Secrets/Endpoints/Secrets.

Phase 4: User Story 2 - Use Secrets From Workflows And Modules (P1)

Goal: Workflows and modules can resolve immutable secret references to latest active values. Independent Test: Resolve a reference before and after rotation and verify the latest active value is returned.

  • T012 [US2] Add unit tests for latest-active reference resolution in test/unit/Elsa.Secrets.UnitTests/SecretResolverTests.cs.
  • T013 [US2] Implement ISecretResolver and legacy ISecretProvider adapter in src/modules/Elsa.Secrets/Services.
  • T014 [US2] Add Studio picker contract DTOs and endpoint in src/modules/Elsa.Secrets/Endpoints/Secrets/Picker.

Phase 5: User Story 3 - Choose Secret Types And Stores (P2)

Goal: Operators can pick compatible types and stores, including read-only configuration-backed references. Independent Test: Resolve one encrypted text secret and one configuration-backed secret through the same resolver.

  • T015 [US3] Add unit tests for type descriptors, store descriptors, and configuration store resolution in test/unit/Elsa.Secrets.UnitTests/SecretStoreTests.cs.
  • T016 [US3] Implement text, RSA key, and X.509 reference descriptors in src/modules/Elsa.Secrets/Types.
  • T017 [US3] Implement descriptors endpoint in src/modules/Elsa.Secrets/Endpoints/Secrets/Descriptors.

Phase 6: Studio UX

Goal: Elsa Studio provides a Security > Secrets area plus reusable picker/create UX. Independent Test: Build the Studio module and inspect the management pages/components compile against the server API contract.

  • T018 Add Studio API client and models in /Users/sipke/.codex/worktrees/ae40/elsa-studio/src/modules/Elsa.Studio.Secrets.
  • T019 Add Studio menu, service registration, list/detail/create dialogs, and picker component in /Users/sipke/.codex/worktrees/ae40/elsa-studio/src/modules/Elsa.Studio.Secrets.
  • T020 Add Studio module project to /Users/sipke/.codex/worktrees/ae40/elsa-studio/Elsa.Studio.sln and host/bundle project references.

Phase 7: Polish

  • T021 Update quickstart/docs for server and Studio configuration.
  • T022 Run targeted server and Studio builds/tests and fix compile errors.

Dependencies

  • Phase 1 before all implementation.
  • Phase 2 blocks all user stories.
  • US1 and US2 are the MVP and must pass before Studio UX is considered complete.
  • Studio UX depends on the REST contract from US1-US3.

Implementation Strategy

Implement the smallest secure end-to-end slice first: in-memory metadata, encrypted Elsa-managed values, configuration-backed references, safe management endpoints, runtime resolver, Studio list/detail/create/rotate/revoke UX, and picker component. EF persistence and additional providers can follow once the API and UX shape is validated.