Jason Woltje dd171b287f feat(#353): Create VaultService NestJS module for OpenBao Transit ...

Implements secure credential encryption using OpenBao Transit API with
automatic fallback to AES-256-GCM when OpenBao is unavailable.

Features:
- AppRole authentication with automatic token renewal at 50% TTL
- Transit encrypt/decrypt with 4 named keys
- Automatic fallback to CryptoService when OpenBao unavailable
- Auto-detection of ciphertext format (vault:v1: vs AES)
- Request timeout protection (5s default)
- Health indicator for monitoring
- Backward compatible with existing AES-encrypted data

Security:
- ERROR-level logging for fallback
- Proper error propagation (no silent failures)
- Request timeouts prevent hung operations
- Secure credential file reading

Migrations:
- Account encryption middleware uses VaultService
- Uses TransitKey.ACCOUNT_TOKENS for OAuth tokens
- Backward compatible with existing encrypted data

Tests: 56 tests passing (36 VaultService + 20 middleware)

Closes #353

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-07 16:13:05 -06:00

..

api

feat(#353): Create VaultService NestJS module for OpenBao Transit

2026-02-07 16:13:05 -06:00

coordinator

fix(#338): Sanitize issue body for prompt injection

2026-02-05 18:36:16 -06:00

orchestrator

test(#344): Add comprehensive tests for CI operations service

2026-02-07 11:27:35 -06:00

web

fix(web): Remove re-throw from loadConversation to prevent unhandled rejections

2026-02-06 20:33:52 -06:00