gitcaddy-vault/models/secret.go

// Copyright 2026 MarketAlly. All rights reserved.
// Proprietary and confidential.

package models

import (
	"context"
	"fmt"

	"code.gitcaddy.com/server/v3/models/db"
	"code.gitcaddy.com/server/v3/modules/timeutil"
	"code.gitcaddy.com/server/v3/modules/util"

	"xorm.io/builder"
)

// SecretType represents the type of secret
type SecretType string

const (
	SecretTypeEnvFile     SecretType = "env-file"
	SecretTypeKeyValue    SecretType = "key-value"
	SecretTypeFile        SecretType = "file"
	SecretTypeCertificate SecretType = "certificate"
	SecretTypeSSHKey      SecretType = "ssh-key"
)

// VaultSecret represents an encrypted secret in the vault
type VaultSecret struct {
	ID             int64              `xorm:"pk autoincr"`
	RepoID         int64              `xorm:"INDEX NOT NULL"`
	Name           string             `xorm:"INDEX NOT NULL"` // unique per repo when not deleted
	Description    string             `xorm:"TEXT"`
	Type           SecretType         `xorm:"VARCHAR(20) NOT NULL DEFAULT 'env-file'"`
	CurrentVersion int                `xorm:"NOT NULL DEFAULT 1"`
	CreatedUnix    timeutil.TimeStamp `xorm:"created NOT NULL"`
	CreatedBy      int64              `xorm:"NOT NULL"`
	UpdatedUnix    timeutil.TimeStamp `xorm:"updated NOT NULL"`

	// Encryption mode: "standard" (server-side) or "lockbox" (client E2E encrypted)
	EncryptionMode string `xorm:"VARCHAR(20) NOT NULL DEFAULT 'standard'"`

	// Soft delete
	DeletedUnix timeutil.TimeStamp `xorm:"INDEX"` // 0 = active, >0 = soft deleted
	DeletedBy   int64
	PurgedUnix  timeutil.TimeStamp // 0 = versions retained, >0 = versions wiped
}

// TableName returns the table name for xorm
func (VaultSecret) TableName() string {
	return "vault_secret"
}

// ErrVaultSecretNotFound represents a "secret not found" error
type ErrVaultSecretNotFound struct {
	ID     int64
	RepoID int64
	Name   string
}

func (err ErrVaultSecretNotFound) Error() string {
	return fmt.Sprintf("vault secret not found [id: %d, repo_id: %d, name: %s]", err.ID, err.RepoID, err.Name)
}

func (err ErrVaultSecretNotFound) Unwrap() error {
	return util.ErrNotExist
}

// ErrVaultSecretAlreadyExists represents a "secret already exists" error
type ErrVaultSecretAlreadyExists struct {
	RepoID int64
	Name   string
}

func (err ErrVaultSecretAlreadyExists) Error() string {
	return fmt.Sprintf("vault secret already exists [repo_id: %d, name: %s]", err.RepoID, err.Name)
}

func (err ErrVaultSecretAlreadyExists) Unwrap() error {
	return util.ErrAlreadyExist
}

// IsActive returns true if the secret is not deleted
func (s *VaultSecret) IsActive() bool {
	return s.DeletedUnix == 0
}

// IsDeleted returns true if the secret is soft deleted
func (s *VaultSecret) IsDeleted() bool {
	return s.DeletedUnix > 0 && s.PurgedUnix == 0
}

// IsPurged returns true if the secret versions have been wiped
func (s *VaultSecret) IsPurged() bool {
	return s.PurgedUnix > 0
}

// FindVaultSecretsOptions contains options for finding vault secrets
type FindVaultSecretsOptions struct {
	db.ListOptions
	RepoID         int64
	Name           string
	IncludeDeleted bool
}

// ToConds converts options to xorm conditions
func (opts FindVaultSecretsOptions) ToConds() builder.Cond {
	cond := builder.NewCond()

	if opts.RepoID > 0 {
		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
	}

	if opts.Name != "" {
		cond = cond.And(builder.Eq{"name": opts.Name})
	}

	if !opts.IncludeDeleted {
		cond = cond.And(builder.Eq{"deleted_unix": 0})
	}

	return cond
}

// CreateVaultSecret creates a new vault secret
func CreateVaultSecret(ctx context.Context, secret *VaultSecret) error {
	// Check if secret with same name already exists (and is not deleted)
	exists, err := db.GetEngine(ctx).Where("repo_id = ? AND name = ? AND deleted_unix = 0", secret.RepoID, secret.Name).Exist(&VaultSecret{})
	if err != nil {
		return err
	}
	if exists {
		return ErrVaultSecretAlreadyExists{RepoID: secret.RepoID, Name: secret.Name}
	}

	_, err = db.GetEngine(ctx).Insert(secret)
	return err
}

// GetVaultSecretByID returns a vault secret by ID
func GetVaultSecretByID(ctx context.Context, id int64) (*VaultSecret, error) {
	secret := &VaultSecret{}
	has, err := db.GetEngine(ctx).ID(id).Get(secret)
	if err != nil {
		return nil, err
	}
	if !has {
		return nil, ErrVaultSecretNotFound{ID: id}
	}
	return secret, nil
}

// GetVaultSecretByName returns a vault secret by repo and name
func GetVaultSecretByName(ctx context.Context, repoID int64, name string) (*VaultSecret, error) {
	secret := &VaultSecret{}
	has, err := db.GetEngine(ctx).Where("repo_id = ? AND name = ? AND deleted_unix = 0", repoID, name).Get(secret)
	if err != nil {
		return nil, err
	}
	if !has {
		return nil, ErrVaultSecretNotFound{RepoID: repoID, Name: name}
	}
	return secret, nil
}

// UpdateVaultSecret updates a vault secret
func UpdateVaultSecret(ctx context.Context, secret *VaultSecret, cols ...string) error {
	_, err := db.GetEngine(ctx).ID(secret.ID).Cols(cols...).Update(secret)
	return err
}

// SoftDeleteVaultSecret marks a secret as deleted
func SoftDeleteVaultSecret(ctx context.Context, secret *VaultSecret, deletedBy int64) error {
	secret.DeletedUnix = timeutil.TimeStampNow()
	secret.DeletedBy = deletedBy
	return UpdateVaultSecret(ctx, secret, "deleted_unix", "deleted_by")
}

// RestoreVaultSecret restores a soft-deleted secret
func RestoreVaultSecret(ctx context.Context, secret *VaultSecret) error {
	if secret.PurgedUnix > 0 {
		return fmt.Errorf("cannot restore purged secret")
	}
	secret.DeletedUnix = 0
	secret.DeletedBy = 0
	return UpdateVaultSecret(ctx, secret, "deleted_unix", "deleted_by")
}

// PurgeVaultSecret permanently deletes all versions and marks as purged
func PurgeVaultSecret(ctx context.Context, secret *VaultSecret) error {
	if secret.DeletedUnix == 0 {
		return fmt.Errorf("must delete before purging")
	}

	// Delete all versions
	if _, err := db.GetEngine(ctx).Where("secret_id = ?", secret.ID).Delete(&VaultSecretVersion{}); err != nil {
		return err
	}

	secret.PurgedUnix = timeutil.TimeStampNow()
	return UpdateVaultSecret(ctx, secret, "purged_unix")
}

// GetVaultSecretsByRepo returns all vault secrets for a repository
func GetVaultSecretsByRepo(ctx context.Context, repoID int64, includeDeleted bool) ([]*VaultSecret, error) {
	secrets := make([]*VaultSecret, 0)
	sess := db.GetEngine(ctx).Where("repo_id = ?", repoID)
	if !includeDeleted {
		sess = sess.And("deleted_unix = 0")
	}
	err := sess.OrderBy("name").Find(&secrets)
	return secrets, err
}

// CountVaultSecretsByRepo returns the count of vault secrets for a repository
func CountVaultSecretsByRepo(ctx context.Context, repoID int64) (int64, error) {
	return db.GetEngine(ctx).Where("repo_id = ? AND deleted_unix = 0", repoID).Count(&VaultSecret{})
}