feat(vault): create/edit identity ciphers (write path)#27
Merged
Conversation
`vault add --type identity` and `vault edit <identity>` now build and update identity (type 4) ciphers — the last cipher type to gain a write path. Mirrors the card-write stack. - vault-ipc: typed `IdentityWrite` (15 non-secret `Option<String>` + ssn/passport_number/license_number as secret `Vec<u8>` with a redacted `Debug`) rides a serde-defaulted `identity` on `Request::Add`/`Edit`; transport round-trip + redaction tests. - vault-core: `from_plain` emits an `Identity` for cipher_type 4, the inverse of the read-path decrypt; from_plain→decrypt round-trip test. - vault-agent: `add_cipher` decodes the secrets into a `PlainIdentity` before `from_plain`; `apply_cipher_edits` sets only the given identity fields (reusing `PlainIdentity` as the owned borrow holder so its `Drop` scrubs the secrets), rejecting identity edits on a non-identity item; unit-tested. - vault-cli: `KindArg::Identity`; a `#[command(flatten)] IdentityArgs` shared by add/edit — 15 string flags + `--ssn`/`--passport`/`--license` bools that prompt on /dev/tty (never argv). Identity username is `--identity-username` (the login username stays `--username`). - vault-tui: thread `identity: None` through its Add/Edit literals. - docs: README identity create/edit, CHANGELOG entry. All four cipher types are now writable. Identity TUI editing (now unblocked) is the next follow-up. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
vault add --type identityandvault edit <identity>now create and update identity (type 4) ciphers — the last cipher type to gain a write path. With this, all four cipher types (login / note / card / identity) are writable from the CLI.Mirrors the card-write stack (PR #25). The 15 non-secret fields are flags; the three sensitive fields — SSN, passport, license (which
PlainIdentityzeroizes) — are read from/dev/ttywhen their bool flag is set, never argv.How
IdentityWrite(15Option<String>+ ssn/passport/license as secretVec<u8>with a hand-writtenDebugthat redacts them). Rides a#[serde(default)] identityonRequest::Add/Edit. Transport round-trip + redaction tests.from_plainemits anIdentityforcipher_type == 4, the exact inverse of the read-pathdecrypt.from_plain→decryptround-trip test.add_cipherdecodes the secrets (zeroizing) into aPlainIdentitybeforefrom_plain;apply_cipher_editssets only the given identity fields and rejects identity edits on a non-identity item. The edit path reusesidentity_write_to_plainto produce an ownedPlainIdentityand borrows the overlay from it, so itsDropscrubs the secrets. Unit-tested.KindArg::Identity; a#[command(flatten)] IdentityArgsstruct shared byadd/edit(15 string flags +--ssn/--passport/--licensebool flags gating tty prompts). The identity's own username is--identity-username(the bare--usernamestays the login field).identity: Nonethrough its Add/Edit request literals.Verification
cargo fmt --check, fresh-isolatedclippy -D warnings(pedantic+nursery),cargo test --workspace --all-targets(core 7 / ipc 17 / agent 37 with the new identity tests),cargo deny check, and both headless builds all clean.Out of scope (tracked follow-up)
vault-tuiper-type form like the card rows (PR feat(vault-tui): create/edit cards in the add/edit form #26).🤖 Generated with Claude Code