phase 3: secure credential vault

atlas-terminal/server/services/credentials_service.py

@@ -0,0 +1,40 @@
+"""High-level credential storage helpers."""
+
+from __future__ import annotations
+
+from server.core.secrets import SecretsVault
+from server.db.credentials_repo import (
+    get_credential_blob,
+    log_credential_access,
+    mark_credential_used,
+    upsert_credential,
+)
+
+
+async def store_credential(
+    user_id: str,
+    provider: str,
+    secret: str,
+    ip: str | None = None,
+    ua: str | None = None,
+) -> None:
+    vault = SecretsVault.from_env()
+    encrypted = vault.encrypt(secret, user_id=user_id, provider=provider)
+    await upsert_credential(user_id, provider, encrypted)
+    await log_credential_access(user_id, provider, "upsert", ip, ua)
+
+
+async def load_credential_secret(
+    user_id: str,
+    provider: str,
+    ip: str | None = None,
+    ua: str | None = None,
+) -> str | None:
+    blob = await get_credential_blob(user_id, provider)
+    if blob is None:
+        await log_credential_access(user_id, provider, "miss", ip, ua)
+        return None
+    secret = SecretsVault.from_env().decrypt(blob, user_id=user_id, provider=provider)
+    await mark_credential_used(user_id, provider)
+    await log_credential_access(user_id, provider, "decrypt", ip, ua)
+    return secret