Skip to content

feat: full key vault platform with auth, encryption, and React frontend#3

Merged
jbcupps merged 4 commits intomainfrom
fix/sao-build
Feb 18, 2026
Merged

feat: full key vault platform with auth, encryption, and React frontend#3
jbcupps merged 4 commits intomainfrom
fix/sao-build

Conversation

@jbcupps
Copy link
Copy Markdown
Owner

@jbcupps jbcupps commented Feb 8, 2026

Summary

  • PostgreSQL foundation: Mandatory DB with full schema migration (users, agents, vault secrets, WebAuthn credentials, OIDC providers, audit log, refresh tokens)
  • Vault encryption engine: AES-256-GCM-SIV encryption at rest with Argon2id KDF, passphrase-based seal/unseal, setup wizard for initial vault + admin creation
  • WebAuthn/FIDO2 authentication: Windows Hello / security key login, JWT sessions (30min access + 7-day refresh tokens), auth middleware extractors
  • OIDC SSO: Admin-configurable providers (Entra, Auth0, Google), authorization code flow, automatic user creation/linking
  • RBAC: User and Administrator roles with ownership checks on secrets and agents
  • React/TypeScript frontend: Dark-themed SPA with setup wizard, key vault management, agent registry, admin panels (users, SSO config), and paginated audit log
  • Docker multi-stage build: Node.js frontend build + Rust backend build + minimal Debian runtime with PostgreSQL
  • Windows build support: Static CRT linking and OpenSSL configuration in .cargo/config.toml

Test plan

  • cargo check compiles the full workspace without errors
  • cd frontend && npm run build produces production bundle
  • docker compose -f docker/docker-compose.yml up --build starts all services
  • GET /api/health returns DB health info
  • GET /api/setup/status returns needs_setup: true on first run
  • POST /api/setup/initialize creates vault master key + admin user
  • WebAuthn registration and login flow works with Windows Hello
  • Vault seal/unseal cycle works; secrets encrypted at rest
  • OIDC provider configuration and login flow works
  • Admin routes return 403 for non-admin users
  • Audit log captures key operations

🤖 Generated with Claude Code

jbcupps and others added 2 commits February 7, 2026 22:29
Fix `json\!` → `json!` and `env\!` → `env!` across all route files.
Also remove BOM characters from source files.

Closes #1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…act frontend

Transform SAO from a headless REST/WebSocket server into a complete key
management platform:

- PostgreSQL as mandatory data store with full schema migration
- AES-256-GCM-SIV vault encryption with Argon2id KDF seal/unseal
- WebAuthn/FIDO2 authentication (Windows Hello) with JWT sessions
- OIDC SSO support for enterprise login (Entra, Auth0, Google)
- RBAC with User and Administrator roles
- React/TypeScript SPA with Tailwind CSS dark theme
- Setup wizard, key vault, agent registry, admin panels, audit log
- Docker multi-stage build with frontend and PostgreSQL

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jbcupps jbcupps changed the title fix: correct escaped macro syntax in route handlers feat: full key vault platform with auth, encryption, and React frontend Feb 18, 2026
jbcupps and others added 2 commits February 17, 2026 20:34
- Run cargo fmt on all workspace files
- Fix clippy warnings: dead_code allows, too_many_arguments allows,
  collapsible_if, useless_format, useless_conversion
- Implement FromStr trait for SecretType instead of inherent from_str
- Update CI workflow: add libssl-dev for OpenSSL on Linux runners,
  remove obsolete --features postgres flag
- Move OpenSSL env vars out of .cargo/config.toml to avoid panicking
  openssl-sys on Linux CI (paths are Windows-specific)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@jbcupps jbcupps merged commit dfaebd5 into main Feb 18, 2026
3 checks passed
@jbcupps jbcupps deleted the fix/sao-build branch February 18, 2026 01:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant