Merge pull request #21 from constructive-io/feat/constructive-accounts

feat(accounts): manage Constructive accounts and API keys from the vault

Author: pyramation

README.md

@@ -14,8 +14,8 @@
 </p>
 
 Audited, dependency-light building blocks for mnemonics, envelope encryption, Shamir secret sharing and
-team secret management — plus the `dcrypt` CLI. Everything runs locally; nothing in this repo makes a
-network request.
+team secret management — plus the `dcrypt` CLI. Everything runs locally; the only code here that opens a
+socket is `dcrypt account`, which talks to the Constructive endpoint you name.
 
 ## Packages
 
@@ -27,6 +27,7 @@ network request.
 | **@decryption/wallet** | [![npm](https://img.shields.io/npm/v/@decryption/wallet.svg)](https://www.npmjs.com/package/@decryption/wallet) | [GitHub](./packages/wallet) | BIP39/BIP32 wallets and offline address derivation |
 | **@decryption/keys** | [![npm](https://img.shields.io/npm/v/@decryption/keys.svg)](https://www.npmjs.com/package/@decryption/keys) | [GitHub](./packages/keys) | X25519 identities, recipient strings, on-disk keyring |
 | **@decryption/secrets** | [![npm](https://img.shields.io/npm/v/@decryption/secrets.svg)](https://www.npmjs.com/package/@decryption/secrets) | [GitHub](./packages/secrets) | Team secrets file format, rekeying and `.env` export |
+| **@decryption/accounts** | [![npm](https://img.shields.io/npm/v/@decryption/accounts.svg)](https://www.npmjs.com/package/@decryption/accounts) | [GitHub](./packages/accounts) | Constructive accounts and API keys, held in the local vault |
 | **@decryption/cli** | [![npm](https://img.shields.io/npm/v/@decryption/cli.svg)](https://www.npmjs.com/package/@decryption/cli) | [GitHub](./packages/cli) | The `dcrypt` command-line interface |
 
 ### Vendored primitives
@@ -53,6 +54,9 @@ dcrypt encrypt --in secret.txt          # Argon2id + XChaCha20-Poly1305 envelope
 dcrypt shamir split --shares 5 --threshold 3
 dcrypt secrets init && dcrypt secrets set DATABASE_URL
 dcrypt secrets run -- pnpm dev          # inject secrets without writing a .env
+
+dcrypt account signin me@example.com --endpoint https://auth.example.com/graphql
+dcrypt account key create ci --expires-days 30   # secret lands in the vault, not a .env
 ```
 
 ## Security model
@@ -62,4 +66,5 @@ dcrypt secrets run -- pnpm dev          # inject secrets without writing a .env
   returning an empty string.
 - Team secrets use X25519 per-recipient wrapping (age/sops-shaped), so adding or removing a teammate never
   requires resharing a passphrase. Shamir is reserved for break-glass recovery.
-- Nothing here opens a socket. Private keys are never written to disk unencrypted.
+- Private keys are never written to disk unencrypted. `dcrypt account` is the one command that uses the
+  network: session tokens and API-key secrets it receives go straight into the encrypted vault.

apps/desktop/package.json

@@ -21,6 +21,7 @@
     "icons": "node scripts/generate-icons.mjs"
   },
   "dependencies": {
+    "@decryption/accounts": "workspace:*",
     "@decryption/core": "workspace:*",
     "@decryption/cosmology-compat": "workspace:*",
     "@decryption/hashes": "workspace:*",

apps/desktop/src/main/ipc.ts

@@ -1,3 +1,4 @@
+import { AccountManager } from '@decryption/accounts';
 import { decryptFromString, encryptToString } from '@decryption/core';
 import { decrypt as legacyDecrypt } from '@decryption/cosmology-compat';
 import { combineToString, splitToStrings } from '@decryption/shamir';
@@ -6,7 +7,13 @@ import { BrowserWindow, ipcMain, shell } from 'electron';
 import { existsSync } from 'fs';
 import * as path from 'path';
 
-import { CHANNELS, FieldPurpose, ItemKind } from '../shared/api';
+import {
+  CHANNELS,
+  CreateKeyRequest,
+  FieldPurpose,
+  ItemKind,
+  SignInRequest,
+} from '../shared/api';
 import { parseOtpauthUri } from '../shared/otpauth';
 import { backupVault, restoreVault } from './backup';
 import { lookupBrandIcons } from './brand-icons';
@@ -156,6 +163,58 @@ export const registerIpc = (service: VaultService): void => {
   // ─── brand icons (bundled, offline) ───
   handle(CHANNELS.iconsLookup, (names: string[]) => lookupBrandIcons(assertStringArray(names)));
 
+  // ─── constructive accounts ───
+  const accounts = (): AccountManager => new AccountManager(service.current());
+  const credentials = (request: SignInRequest): SignInRequest => ({
+    endpoint: assertString(request?.endpoint),
+    email: assertString(request?.email),
+    password: assertString(request?.password),
+  });
+
+  handle(CHANNELS.accountsList, () => accounts().listAccounts());
+  handle(CHANNELS.accountsSignIn, async (request: SignInRequest) => {
+    const account = await accounts().signIn(credentials(request));
+    service.scheduleSave();
+    return account;
+  });
+  handle(CHANNELS.accountsSignUp, async (request: SignInRequest) => {
+    const account = await accounts().signUp(credentials(request));
+    service.scheduleSave();
+    return account;
+  });
+  handle(CHANNELS.accountsSignOut, async (itemId: string) => {
+    await accounts().signOut(assertString(itemId));
+    service.scheduleSave();
+  });
+  handle(CHANNELS.accountsForget, async (itemId: string) => {
+    await accounts().forget(assertString(itemId));
+    service.scheduleSave();
+  });
+  handle(CHANNELS.accountsKeys, (accountItemId?: string) =>
+    accounts().listApiKeys(accountItemId === undefined ? undefined : assertString(accountItemId))
+  );
+  handle(
+    CHANNELS.accountsCreateKey,
+    async (accountItemId: string, request: CreateKeyRequest) => {
+      const days = request?.expiresDays;
+      const key = await accounts().createApiKey(assertString(accountItemId), {
+        name: assertString(request?.name),
+        expiresIn: days === undefined ? undefined : { days: assertInt(days, 1, 3650) },
+        accessLevel:
+          request?.accessLevel === undefined ? undefined : assertString(request.accessLevel),
+      });
+      service.scheduleSave();
+      return key;
+    }
+  );
+  handle(CHANNELS.accountsRevealKey, (itemId: string) =>
+    accounts().revealApiKey(assertString(itemId))
+  );
+  handle(CHANNELS.accountsRevokeKey, async (itemId: string) => {
+    await accounts().revokeApiKey(assertString(itemId));
+    service.scheduleSave();
+  });
+
   // ─── audit ───
   handle(CHANNELS.auditLog, (itemId?: string) => service.current().auditLog(itemId));
 

apps/desktop/src/main/vault-service.ts

@@ -7,11 +7,13 @@ import type { RebuildReport, TotpEntry, VaultStatus } from '../shared/api';
 
 const APP_NAME = 'dcrypt';
 
+const appDirs = () => appstash(APP_NAME, { ensure: true });
+
 /** Root of everything dcrypt keeps on this machine: vault, keychain, identity. */
-export const appDataPath = (): string => appstash(APP_NAME, { ensure: true });
+export const appDataPath = (): string => appDirs().root;
 
 export const vaultFilePath = (): string =>
-  resolve(appDataPath(), 'data', 'db') + path.sep + 'vault.dcrypt';
+  resolve(appDirs(), 'data', 'db') + path.sep + 'vault.dcrypt';
 
 /** Locate the dcrypt-vault pgpm module in dev (workspace) and packaged builds. */
 export const vaultModulePath = (): string => {

apps/desktop/src/preload/index.ts

@@ -52,6 +52,18 @@ const api: DcryptApi & {
     urls: (itemId) => invoke(CHANNELS.urlsList, itemId),
     addUrl: (itemId, url) => invoke(CHANNELS.urlsAdd, itemId, url),
   },
+  accounts: {
+    list: () => invoke(CHANNELS.accountsList),
+    signIn: (request) => invoke(CHANNELS.accountsSignIn, request),
+    signUp: (request) => invoke(CHANNELS.accountsSignUp, request),
+    signOut: (itemId) => invoke(CHANNELS.accountsSignOut, itemId),
+    forget: (itemId) => invoke(CHANNELS.accountsForget, itemId),
+    keys: (accountItemId) => invoke(CHANNELS.accountsKeys, accountItemId),
+    createKey: (accountItemId, request) =>
+      invoke(CHANNELS.accountsCreateKey, accountItemId, request),
+    revealKey: (itemId) => invoke(CHANNELS.accountsRevealKey, itemId),
+    revokeKey: (itemId) => invoke(CHANNELS.accountsRevokeKey, itemId),
+  },
   audit: {
     log: (itemId) => invoke(CHANNELS.auditLog, itemId),
   },

apps/desktop/src/renderer/src/App.tsx

@@ -7,27 +7,30 @@ import {
   Settings,
   ShieldCheck,
   Timer,
+  UserRound,
   Wrench,
 } from 'lucide-react';
 import { useCallback, useEffect, useState } from 'react';
 
 import { DoorState, VaultDoors } from './components/VaultDoors';
 import { dcrypt } from './lib/ipc';
 import { ThemeProvider, useThemeMode } from './lib/theme-context';
+import { AccountsScreen } from './screens/AccountsScreen';
 import { SettingsScreen } from './screens/SettingsScreen';
 import { ToolsScreen } from './screens/ToolsScreen';
 import { TotpScreen } from './screens/TotpScreen';
 import { UnlockScreen } from './screens/UnlockScreen';
 import { VaultScreen } from './screens/VaultScreen';
 
-type Tab = 'vault' | 'codes' | 'tools' | 'settings';
+type Tab = 'vault' | 'codes' | 'accounts' | 'tools' | 'settings';
 
 /** `opening`/`closing` are the door transitions; the vault is mounted for all but `locked`. */
 type Phase = 'locked' | 'opening' | 'unlocked' | 'closing';
 
 const NAV: { id: Tab; label: string; icon: typeof KeyRound }[] = [
   { id: 'vault', label: 'Vault', icon: KeyRound },
   { id: 'codes', label: 'Codes', icon: Timer },
+  { id: 'accounts', label: 'Accounts', icon: UserRound },
   { id: 'tools', label: 'Tools', icon: Wrench },
   { id: 'settings', label: 'Settings', icon: Settings },
 ];
@@ -110,6 +113,7 @@ const AppContent = () => {
           <main className="min-w-0 flex-1 overflow-hidden">
             {tab === 'vault' && <VaultScreen />}
             {tab === 'codes' && <TotpScreen />}
+            {tab === 'accounts' && <AccountsScreen />}
             {tab === 'tools' && <ToolsScreen />}
             {tab === 'settings' && (
               <SettingsScreen onLocked={() => setPhase('closing')} />