d42c653eea
- engineering-docs → archive/2026-03-29-engineering-docs (63/63 tasks complete) - phase-2-production-ready → archive/2026-03-29-phase-2-production-ready (89/89 tasks complete) - openspec/specs/ synced with all Phase 1 + Phase 2 + engineering-docs capabilities (22 specs total) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
22 lines
928 B
Markdown
22 lines
928 B
Markdown
# Spec: HashiCorp Vault Integration
|
|
|
|
**Status**: Pending CEO approval
|
|
**Workstream**: 1 of 8
|
|
|
|
## Scope
|
|
- VaultClient class wrapping `node-vault`
|
|
- `005_add_vault_path.sql` migration
|
|
- Updated CredentialService to write secrets to Vault instead of PostgreSQL
|
|
- New env vars: VAULT_ADDR, VAULT_TOKEN, VAULT_MOUNT
|
|
- Migration guide: bcrypt → Vault coexistence strategy
|
|
|
|
## Acceptance Criteria
|
|
- [ ] New credentials: secret written to Vault KV v2, `vault_path` stored in PostgreSQL
|
|
- [ ] Credential rotation: Vault versioned update, `vault_path` unchanged
|
|
- [ ] Credential revocation: Vault secret deleted, DB status = `revoked`
|
|
- [ ] Existing bcrypt credentials continue to work until rotated
|
|
- [ ] VaultClient follows existing service interface pattern (DRY, SOLID)
|
|
- [ ] Zero `any` types, TypeScript strict
|
|
- [ ] `VAULT_ADDR` / `VAULT_TOKEN` validation at startup (fail-fast)
|
|
- [ ] DevOps docs updated with Vault setup section
|