feat: Implement per-secret key architecture with individual keypairs - Each secret now has its own encryption keypair stored as pub.age, priv.age, value.age - Secret private keys are encrypted to vault long-term public key - Values stored as value.age instead of secret.age for new architecture

2025-05-29 09:52:18 -07:00
parent 43767c725f
commit f838c8cb98
2 changed files with 420 additions and 176 deletions
@@ -225,7 +225,7 @@ func (s *Secret) GetEncryptedData() ([]byte, error) {
 		slog.String("vault_name", s.vault.Name),
 	)

-	secretPath := filepath.Join(s.Directory, "secret.age")
+	secretPath := filepath.Join(s.Directory, "value.age")

 	Debug("Reading encrypted secret file", "secret_path", secretPath)

@@ -250,7 +250,7 @@ func (s *Secret) Exists() (bool, error) {
 		slog.String("vault_name", s.vault.Name),
 	)

-	secretPath := filepath.Join(s.Directory, "secret.age")
+	secretPath := filepath.Join(s.Directory, "value.age")

 	Debug("Checking secret file existence", "secret_path", secretPath)

@@ -266,4 +266,4 @@ func (s *Secret) Exists() (bool, error) {
 	)

 	return exists, nil
-}
+}