Merge pull request #36 from Spacecraft-Software/identity-field-selectors

feat(vault): granular identity field selectors (CLI + TUI per-field)

Author: UnbreakableMJ

CHANGELOG.md

@@ -10,6 +10,15 @@ range may break in any release.
 
 ### Added
 
+- **Granular identity field selectors.** 16 new `--field` selectors expose every
+  identity field individually — `identity-{title,first-name,middle-name,
+  last-name,username,company,ssn,passport,license,address1,address2,address3,
+  city,state,postal,country}` — alongside the existing composed `identity-name`
+  / `identity-address`. `vault get … --field identity-ssn` now works, and the
+  TUI identity detail pane shows the full granular set so per-field reveal/copy
+  reaches every field (SSN/passport/license masked, revealed on demand like the
+  card CVV). Same proto → agent → CLI → TUI shape as the `card-*` selectors.
+
 - **TUI per-field reveal/copy in the detail pane.** The detail pane is now
   focusable (`Tab` cycles folders → items → detail): with it focused, `j`/`k`
   move a field cursor and `Space`/`c` reveal/copy the **selected** field — so the

README.md

@@ -100,7 +100,10 @@ Card (type 3) and identity (type 4) ciphers are readable from the CLI via
 
 ```sh
 vault get visa --field card-number     # also: card-cardholder, card-brand, card-expiry, card-code
-vault get me   --field identity-email  # also: identity-name, identity-phone, identity-address
+vault get me   --field identity-email  # composed: identity-name, identity-address; plus
+                                        # granular identity-{title,first-name,middle-name,
+                                        # last-name,username,company,ssn,passport,license,
+                                        # address1,address2,address3,city,state,postal,country}
 ```
 
 In the TUI, selecting a card or identity shows its fields in the detail pane:

crates/vault-agent/src/state.rs

@@ -727,6 +727,7 @@ impl AgentState {
     /// reliable path when several items share a name. When `id` is `None`, it
     /// falls back to a case-insensitive match on `query` and returns the first
     /// hit (the long-standing CLI behavior). `query` is also the error label.
+    #[allow(clippy::too_many_lines)] // flat per-field dispatch (one arm per Field) reads best in one match
     pub fn get_item(&self, id: Option<&str>, query: &str, field: Field) -> Result<Item, IpcError> {
         let v = self.vault.as_ref().ok_or(IpcError::Locked)?;
         let query_lower = query.to_lowercase();
@@ -783,7 +784,23 @@ impl AgentState {
             Field::IdentityName
             | Field::IdentityEmail
             | Field::IdentityPhone
-            | Field::IdentityAddress => DecryptOptions {
+            | Field::IdentityAddress
+            | Field::IdentityTitle
+            | Field::IdentityFirstName
+            | Field::IdentityMiddleName
+            | Field::IdentityLastName
+            | Field::IdentityUsername
+            | Field::IdentityCompany
+            | Field::IdentitySsn
+            | Field::IdentityPassport
+            | Field::IdentityLicense
+            | Field::IdentityAddress1
+            | Field::IdentityAddress2
+            | Field::IdentityAddress3
+            | Field::IdentityCity
+            | Field::IdentityState
+            | Field::IdentityPostal
+            | Field::IdentityCountry => DecryptOptions {
                 identity: true,
                 ..DecryptOptions::default()
             },
@@ -814,6 +831,30 @@ impl AgentState {
             Field::IdentityEmail => plain.identity.as_ref().and_then(|i| i.email.clone()),
             Field::IdentityPhone => plain.identity.as_ref().and_then(|i| i.phone.clone()),
             Field::IdentityAddress => plain.identity.as_ref().and_then(identity_address),
+            Field::IdentityTitle => plain.identity.as_ref().and_then(|i| i.title.clone()),
+            Field::IdentityFirstName => plain.identity.as_ref().and_then(|i| i.first_name.clone()),
+            Field::IdentityMiddleName => {
+                plain.identity.as_ref().and_then(|i| i.middle_name.clone())
+            }
+            Field::IdentityLastName => plain.identity.as_ref().and_then(|i| i.last_name.clone()),
+            Field::IdentityUsername => plain.identity.as_ref().and_then(|i| i.username.clone()),
+            Field::IdentityCompany => plain.identity.as_ref().and_then(|i| i.company.clone()),
+            Field::IdentitySsn => plain.identity.as_ref().and_then(|i| i.ssn.clone()),
+            Field::IdentityPassport => plain
+                .identity
+                .as_ref()
+                .and_then(|i| i.passport_number.clone()),
+            Field::IdentityLicense => plain
+                .identity
+                .as_ref()
+                .and_then(|i| i.license_number.clone()),
+            Field::IdentityAddress1 => plain.identity.as_ref().and_then(|i| i.address1.clone()),
+            Field::IdentityAddress2 => plain.identity.as_ref().and_then(|i| i.address2.clone()),
+            Field::IdentityAddress3 => plain.identity.as_ref().and_then(|i| i.address3.clone()),
+            Field::IdentityCity => plain.identity.as_ref().and_then(|i| i.city.clone()),
+            Field::IdentityState => plain.identity.as_ref().and_then(|i| i.state.clone()),
+            Field::IdentityPostal => plain.identity.as_ref().and_then(|i| i.postal_code.clone()),
+            Field::IdentityCountry => plain.identity.as_ref().and_then(|i| i.country.clone()),
         };
         let value = value.ok_or_else(|| IpcError::NoSuchField {
             item: name.clone(),

crates/vault-cli/src/main.rs

@@ -455,6 +455,22 @@ enum FieldArg {
     IdentityEmail,
     IdentityPhone,
     IdentityAddress,
+    IdentityTitle,
+    IdentityFirstName,
+    IdentityMiddleName,
+    IdentityLastName,
+    IdentityUsername,
+    IdentityCompany,
+    IdentitySsn,
+    IdentityPassport,
+    IdentityLicense,
+    IdentityAddress1,
+    IdentityAddress2,
+    IdentityAddress3,
+    IdentityCity,
+    IdentityState,
+    IdentityPostal,
+    IdentityCountry,
 }
 
 impl From<FieldArg> for Field {
@@ -474,6 +490,22 @@ impl From<FieldArg> for Field {
             FieldArg::IdentityEmail => Self::IdentityEmail,
             FieldArg::IdentityPhone => Self::IdentityPhone,
             FieldArg::IdentityAddress => Self::IdentityAddress,
+            FieldArg::IdentityTitle => Self::IdentityTitle,
+            FieldArg::IdentityFirstName => Self::IdentityFirstName,
+            FieldArg::IdentityMiddleName => Self::IdentityMiddleName,
+            FieldArg::IdentityLastName => Self::IdentityLastName,
+            FieldArg::IdentityUsername => Self::IdentityUsername,
+            FieldArg::IdentityCompany => Self::IdentityCompany,
+            FieldArg::IdentitySsn => Self::IdentitySsn,
+            FieldArg::IdentityPassport => Self::IdentityPassport,
+            FieldArg::IdentityLicense => Self::IdentityLicense,
+            FieldArg::IdentityAddress1 => Self::IdentityAddress1,
+            FieldArg::IdentityAddress2 => Self::IdentityAddress2,
+            FieldArg::IdentityAddress3 => Self::IdentityAddress3,
+            FieldArg::IdentityCity => Self::IdentityCity,
+            FieldArg::IdentityState => Self::IdentityState,
+            FieldArg::IdentityPostal => Self::IdentityPostal,
+            FieldArg::IdentityCountry => Self::IdentityCountry,
         }
     }
 }

crates/vault-ipc/src/proto.rs

@@ -551,6 +551,38 @@ pub enum Field {
     IdentityPhone,
     /// `Identity` address lines + city/state/postal/country.
     IdentityAddress,
+    /// `Identity.Title`.
+    IdentityTitle,
+    /// `Identity.FirstName`.
+    IdentityFirstName,
+    /// `Identity.MiddleName`.
+    IdentityMiddleName,
+    /// `Identity.LastName`.
+    IdentityLastName,
+    /// `Identity.Username`.
+    IdentityUsername,
+    /// `Identity.Company`.
+    IdentityCompany,
+    /// `Identity.SSN` (sensitive).
+    IdentitySsn,
+    /// `Identity.PassportNumber` (sensitive).
+    IdentityPassport,
+    /// `Identity.LicenseNumber` (sensitive).
+    IdentityLicense,
+    /// `Identity.Address1`.
+    IdentityAddress1,
+    /// `Identity.Address2`.
+    IdentityAddress2,
+    /// `Identity.Address3`.
+    IdentityAddress3,
+    /// `Identity.City`.
+    IdentityCity,
+    /// `Identity.State`.
+    IdentityState,
+    /// `Identity.PostalCode`.
+    IdentityPostal,
+    /// `Identity.Country`.
+    IdentityCountry,
 }
 
 /// Re-export the full cipher payload from `vault-core` when needed.

crates/vault-tui/src/app.rs

@@ -410,10 +410,24 @@ pub const fn detail_fields(cipher_type: u8) -> &'static [DetailField] {
         df("CVV", Field::CardCode, true),
     ];
     const IDENTITY: &[DetailField] = &[
-        df("Person", Field::IdentityName, false),
+        df("Title", Field::IdentityTitle, false),
+        df("First", Field::IdentityFirstName, false),
+        df("Middle", Field::IdentityMiddleName, false),
+        df("Last", Field::IdentityLastName, false),
+        df("IdUser", Field::IdentityUsername, false),
+        df("Company", Field::IdentityCompany, false),
         df("Email", Field::IdentityEmail, false),
         df("Phone", Field::IdentityPhone, false),
-        df("Address", Field::IdentityAddress, false),
+        df("Addr1", Field::IdentityAddress1, false),
+        df("Addr2", Field::IdentityAddress2, false),
+        df("Addr3", Field::IdentityAddress3, false),
+        df("City", Field::IdentityCity, false),
+        df("State", Field::IdentityState, false),
+        df("Postal", Field::IdentityPostal, false),
+        df("Country", Field::IdentityCountry, false),
+        df("SSN", Field::IdentitySsn, true),
+        df("Passport", Field::IdentityPassport, true),
+        df("License", Field::IdentityLicense, true),
     ];
     match cipher_type {
         3 => CARD,
@@ -2201,7 +2215,18 @@ mod tests {
             .expect("card has a CVV field");
         assert_eq!(cvv.field, Field::CardCode);
         assert!(cvv.masked, "CVV is masked until revealed");
-        assert_eq!(detail_fields(4).len(), 4);
+        // Identity exposes its full granular set; the three sensitive fields are
+        // masked.
+        let id = detail_fields(4);
+        assert_eq!(id.len(), 18);
+        for label in ["SSN", "Passport", "License"] {
+            let f = id.iter().find(|f| f.label == label).expect("field present");
+            assert!(f.masked, "{label} must be masked");
+        }
+        assert_eq!(
+            id.iter().find(|f| f.label == "SSN").map(|f| f.field),
+            Some(Field::IdentitySsn)
+        );
     }
 
     #[test]

crates/vault-tui/src/main.rs

@@ -794,11 +794,25 @@ async fn ensure_detail(state: &mut App, socket: &Path) {
             ("Brand", Field::CardBrand),
             ("Exp", Field::CardExpiry),
         ],
+        // The non-sensitive identity fields (granular, matching the detail
+        // pane's field cursor). SSN/passport/license reveal on demand, so they
+        // aren't fetched here.
         4 => &[
-            ("Person", Field::IdentityName),
+            ("Title", Field::IdentityTitle),
+            ("First", Field::IdentityFirstName),
+            ("Middle", Field::IdentityMiddleName),
+            ("Last", Field::IdentityLastName),
+            ("IdUser", Field::IdentityUsername),
+            ("Company", Field::IdentityCompany),
             ("Email", Field::IdentityEmail),
             ("Phone", Field::IdentityPhone),
-            ("Address", Field::IdentityAddress),
+            ("Addr1", Field::IdentityAddress1),
+            ("Addr2", Field::IdentityAddress2),
+            ("Addr3", Field::IdentityAddress3),
+            ("City", Field::IdentityCity),
+            ("State", Field::IdentityState),
+            ("Postal", Field::IdentityPostal),
+            ("Country", Field::IdentityCountry),
         ],
         _ => {
             state.detail = None;