feat: encrypted credential vault

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/db.ts

@@ -62,10 +62,14 @@ export const getSettings = (userId: string) =>
   one<SettingsInput & { onboarded: number }>("SELECT * FROM settings WHERE user_id = ?", userId);
 
 export function saveSettings(userId: string, s: SettingsInput) {
+  // A blank secret means "keep what is stored" — enforced here, not only in the form layer, so no caller
+  // (password change, onboarding re-save, a future import) can blank a stored key by omitting it.
   db.prepare(`INSERT INTO settings (user_id, analyst_base_url, analyst_key, analyst_model, analyst_extra,
       jev_key, jev_model, onboarded, updated_at) VALUES (?,?,?,?,?,?,?,?,?)
-    ON CONFLICT(user_id) DO UPDATE SET analyst_base_url=excluded.analyst_base_url, analyst_key=excluded.analyst_key,
-      analyst_model=excluded.analyst_model, analyst_extra=excluded.analyst_extra, jev_key=excluded.jev_key,
+    ON CONFLICT(user_id) DO UPDATE SET analyst_base_url=excluded.analyst_base_url,
+      analyst_key=COALESCE(NULLIF(excluded.analyst_key, ''), settings.analyst_key),
+      analyst_model=excluded.analyst_model, analyst_extra=excluded.analyst_extra,
+      jev_key=COALESCE(NULLIF(excluded.jev_key, ''), settings.jev_key),
       jev_model=excluded.jev_model, onboarded=excluded.onboarded, updated_at=excluded.updated_at`)
     .run(userId, s.analyst_base_url, s.analyst_key, s.analyst_model, s.analyst_extra, s.jev_key, s.jev_model,
          s.onboarded, now());

lib/settings.ts

@@ -0,0 +1,45 @@
+import { getSettings, saveSettings, type SettingsInput } from "./db.ts";
+import { seal, open, mask } from "./vault.ts";
+
+export type AnalystConfig = { baseUrl: string; apiKey: string; model: string; extra: Record<string, unknown> };
+const str = (fd: FormData, k: string) => String(fd.get(k) ?? "").trim();
+const kept = (fd: FormData, k: string, existing: string) => { const v = str(fd, k); return v ? seal(v) : existing; };
+
+export function saveSettingsForm(userId: string, fd: FormData, onboarded = 1) {
+  const cur = getSettings(userId);
+  let extra = str(fd, "analyst_extra") || "{}";
+  try { JSON.parse(extra); } catch { extra = "{}"; }
+  saveSettings(userId, {
+    analyst_base_url: str(fd, "analyst_base_url").replace(/\/+$/, ""),
+    analyst_key: kept(fd, "analyst_key", cur?.analyst_key ?? ""),
+    analyst_model: str(fd, "analyst_model"),
+    analyst_extra: extra,
+    jev_key: kept(fd, "jev_key", cur?.jev_key ?? ""),
+    jev_model: str(fd, "jev_model") || "jev-latest",
+    onboarded: cur?.onboarded === 1 ? 1 : onboarded,
+  } satisfies SettingsInput);
+}
+export function analystConfig(userId: string): AnalystConfig | null {
+  const s = getSettings(userId);
+  const baseUrl = s?.analyst_base_url ?? "";
+  const apiKey = open(s?.analyst_key ?? "");
+  const model = s?.analyst_model ?? "";
+  if (!baseUrl || !apiKey || !model) return null;
+  let extra: Record<string, unknown> = {};
+  try { extra = JSON.parse(s!.analyst_extra) as Record<string, unknown>; } catch { /* bad JSON means no extra params */ }
+  return { baseUrl, apiKey, model, extra };
+}
+export const jevKey = (userId: string) => open(getSettings(userId)?.jev_key ?? "");
+export const jevModel = (userId: string) => getSettings(userId)?.jev_model || "jev-latest";
+export function settingsView(userId: string) {
+  const s = getSettings(userId);
+  const analystKey = open(s?.analyst_key ?? "");
+  const jev = open(s?.jev_key ?? "");
+  return {
+    analyst_base_url: s?.analyst_base_url ?? "", analyst_model: s?.analyst_model ?? "",
+    analyst_extra: s?.analyst_extra ?? "{}", jev_model: s?.jev_model ?? "jev-latest",
+    analyst_key_masked: mask(analystKey), jev_key_masked: mask(jev),
+    has_analyst: !!(s?.analyst_base_url && s?.analyst_model && analystKey), has_jev: !!jev,
+  };
+}
+export type SettingsView = ReturnType<typeof settingsView>;

lib/vault.ts

@@ -0,0 +1,24 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+
+function key() {
+  const s = process.env.APP_SECRET;
+  if (!s || s.length < 16) throw new Error("APP_SECRET is missing or shorter than 16 chars — set it in .env");
+  return scryptSync(s, "qai-vault-v1", 32);
+}
+export function seal(plain: string): string {
+  if (!plain) return "";
+  const iv = randomBytes(12);
+  const c = createCipheriv("aes-256-gcm", key(), iv);
+  const ct = Buffer.concat([c.update(plain, "utf8"), c.final()]);
+  return `${iv.toString("hex")}.${c.getAuthTag().toString("hex")}.${ct.toString("hex")}`;
+}
+export function open(sealed: string): string {
+  if (!sealed) return "";
+  try {
+    const [iv, tag, ct] = sealed.split(".");
+    const d = createDecipheriv("aes-256-gcm", key(), Buffer.from(iv, "hex"), { authTagLength: 16 });
+    d.setAuthTag(Buffer.from(tag, "hex"));
+    return Buffer.concat([d.update(Buffer.from(ct, "hex")), d.final()]).toString("utf8");
+  } catch { return ""; }
+}
+export const mask = (v: string) => (v ? `••••${v.slice(-4)}` : "");