Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-25 16:51:32 +01:00
parent 83ff79b9c3
commit 69988e08fc
78 changed files with 2472 additions and 52 deletions
@@ -0,0 +1,54 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import answerSecretRequest from "@/src/functions/backend/db/secret-requests/answer-secret-request";
+import grabSecretRequestView from "@/src/functions/backend/db/secret-requests/grab-secret-request-view";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { AnswerSecretRequestSchema } from "@/src/schemas/secret-request-schema";
+import type { SecretRequestView } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * The session user typed the secret a bot asked them for into its card:
+ * saved as their personal secret for that bot. Answers with the request
+ * as it now stands, never the value. Logged by key only.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<SecretRequestView>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { request_id, value } = parseWithSchema({ schema: AnswerSecretRequestSchema, data: body });
+        const request = await answerSecretRequest({ request_id, user_id: user.id, value });
+
+        await logEvent({
+            title: "Secret saved",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} saved ${request.key} for bot #${request.bot_id}, as bot #${request.bot_id} asked (request #${request.id}).`,
+            metadata: { request_id: request.id, key: request.key, bot_id: request.bot_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return {
+            success: true,
+            msg: `Saved ${request.key}.`,
+            singleRes: await grabSecretRequestView({ request_id, user_id: user.id }),
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,39 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import declineSecretRequest from "@/src/functions/backend/db/secret-requests/decline-secret-request";
+import grabSecretRequestView from "@/src/functions/backend/db/secret-requests/grab-secret-request-view";
+import { SecretRequestIdSchema } from "@/src/schemas/secret-request-schema";
+import type { SecretRequestView } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * The session user declined a secret a bot asked them for: nothing saved.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<SecretRequestView>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { request_id } = parseWithSchema({ schema: SecretRequestIdSchema, data: body });
+
+        await declineSecretRequest({ request_id, user_id: user.id });
+
+        return { success: true, singleRes: await grabSecretRequestView({ request_id, user_id: user.id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,32 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabSecretRequestView from "@/src/functions/backend/db/secret-requests/grab-secret-request-view";
+import { SecretRequestIdSchema } from "@/src/schemas/secret-request-schema";
+import type { SecretRequestView } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * `GET ?request_id=`: a secret a bot asked the session user for, as its
+ * chip and card show it. Nobody else reads it.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<SecretRequestView>> = async ({ req, query }) => {
+    try {
+        if (req.method != "GET") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { request_id } = parseWithSchema({ schema: SecretRequestIdSchema, data: query });
+
+        return { success: true, singleRes: await grabSecretRequestView({ request_id, user_id: user.id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,49 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import deleteUserSecret from "@/src/functions/backend/db/envs/delete-user-secret";
+import grabPersonalSecrets from "@/src/functions/backend/db/envs/grab-personal-secrets";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SecretIdSchema } from "@/src/schemas/secret-request-schema";
+import type { PersonalSecret } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * Removes one of the session user's own personal secrets. Answers with
+ * their fresh list.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<PersonalSecret[]>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { env_id } = parseWithSchema({ schema: SecretIdSchema, data: body });
+        const key = await deleteUserSecret({ user_id: user.id, env_id });
+
+        await logEvent({
+            title: "Secret removed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} removed their secret ${key}.`,
+            metadata: { env_id, key },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `Removed ${key}.`, singleRes: await grabPersonalSecrets({ user_id: user.id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,37 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabRevealableEnv from "@/src/functions/backend/db/secrets/grab-revealable-env";
+import { SecretIdSchema } from "@/src/schemas/secret-request-schema";
+import type { SecretRefView } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * `GET ?env_id=`: a secret a bot showed in the chat (`[secret:ID]`), as its
+ * chip shows it before anyone asks for the value: the key, and whether
+ * the session user may reveal it. Never the value.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<SecretRefView>> = async ({ req, query }) => {
+    try {
+        if (req.method != "GET") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { env_id } = parseWithSchema({ schema: SecretIdSchema, data: query });
+        const { env, can_reveal } = await grabRevealableEnv({ env_id, user_id: user.id });
+
+        return {
+            success: true,
+            singleRes: { id: env.id, key: env.key, description: env.description, can_reveal },
+        };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,50 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabRevealableEnv from "@/src/functions/backend/db/secrets/grab-revealable-env";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SecretIdSchema } from "@/src/schemas/secret-request-schema";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * A secret's value, for its chip's Reveal or Copy: only to whom
+ * `canRevealEnv` allows. This is the one way a value leaves the app for a
+ * browser from the chat; it never goes into a page, a message or the
+ * history. Logged by key, never by value.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<{ value: string }>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        const { env_id } = parseWithSchema({ schema: SecretIdSchema, data: body });
+        const { env, can_reveal } = await grabRevealableEnv({ env_id, user_id: user.id });
+
+        if (!can_reveal) {
+            throw new AppError(
+                env.paradigm == "user" ? `You no longer have this bot.` : `Only a super admin can reveal this.`,
+            );
+        }
+
+        await logEvent({
+            title: "Secret revealed",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} revealed ${env.key} (${env.paradigm} env #${env.id}) from the chat.`,
+            metadata: { env_id: env.id, key: env.key, paradigm: env.paradigm },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, singleRes: { value: env.value } };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};
@@ -0,0 +1,56 @@
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabAllEnvs from "@/src/functions/backend/db/envs/grab-all-envs";
+import grabPersonalSecrets from "@/src/functions/backend/db/envs/grab-personal-secrets";
+import saveUserSecret from "@/src/functions/backend/db/envs/save-user-secret";
+import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
+import { SaveUserSecretSchema } from "@/src/schemas/secret-request-schema";
+import type { PersonalSecret } from "@/src/types";
+import AppError from "@/src/utils/app-error";
+import parseWithSchema from "@/src/utils/parse-with-schema";
+import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import safeErrorMessage from "@/src/utils/safe-error-message";
+import type { APIResponseObject, BunextAPIRouteHandler } from "@moduletrace/bunext/types";
+
+/**
+ * Replaces the value of one of the session user's own personal secrets.
+ * Answers with their fresh list. Logged by key, never by value.
+ */
+export const handler: BunextAPIRouteHandler<APIResponseObject<PersonalSecret[]>> = async ({ req, body }) => {
+    try {
+        if (req.method != "POST") {
+            throw new AppError(`Method not allowed`);
+        }
+
+        const { user, user_types } = await userAuth({ req });
+
+        if (!user?.logged_in_status || !user.id) {
+            return { success: false, msg: `Unauthorized`, logoutUser: true };
+        }
+
+        if (isReadOnlyUser({ user_types: user_types || [] })) {
+            throw new AppError(`This user can only read records.`);
+        }
+
+        const { env_id, value } = parseWithSchema({ schema: SaveUserSecretSchema, data: body });
+        const env = (await grabAllEnvs()).find(
+            (e) => e.id == env_id && e.paradigm == "user" && e.user_id == Number(user.id),
+        );
+
+        if (!env?.bot_id) throw new AppError(`That secret no longer exists.`);
+
+        await saveUserSecret({ user_id: user.id, bot_id: env.bot_id, key: env.key, value });
+
+        await logEvent({
+            title: "Secret saved",
+            category: "system",
+            user_id: user.id,
+            plain_text: `User #${user.id} replaced ${env.key} for bot #${env.bot_id}.`,
+            metadata: { env_id, key: env.key, bot_id: env.bot_id },
+            ip_address: grabRequestIP(req),
+        });
+
+        return { success: true, msg: `Saved ${env.key}.`, singleRes: await grabPersonalSecrets({ user_id: user.id }) };
+    } catch (error: unknown) {
+        return { success: false, msg: safeErrorMessage({ error }) };
+    }
+};