feat: move vault ssh signing into a plugin (C5)

src/backend/database/database.ts

@@ -7,6 +7,7 @@ import multer from "multer";
 import cookieParser from "cookie-parser";
 import userRoutes from "./routes/users.js";
 import hostRoutes from "./routes/host.js";
+import { registerVaultCompatRoutes } from "./routes/host-compat-routes.js";
 import alertRoutes from "./routes/alerts.js";
 import credentialsRoutes from "./routes/credentials.js";
 import sshAuthRoutes from "./routes/ssh-auth-routes.js";
@@ -18,7 +19,6 @@ import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-pref
 import uiPreferencesRoutes from "./routes/ui-preferences.js";
 import termixIdRoutes from "./routes/termix-id.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
-import vaultRoutes from "./routes/vault.js";
 import notificationChannelsRoutes from "./routes/notification-channels-routes.js";
 import syncRoutes from "./routes/sync.js";
 import dashboardRoutes from "./routes/dashboard-routes.js";
@@ -1795,7 +1795,9 @@ app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
 app.use("/ui-preferences", uiPreferencesRoutes);
 app.use("/termix-id", termixIdRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
-app.use("/vault", vaultRoutes);
+const vaultCompatRoutes = express.Router();
+registerVaultCompatRoutes(vaultCompatRoutes);
+app.use("/vault", vaultCompatRoutes);
 app.use("/", notificationChannelsRoutes);
 app.use("/sync", syncRoutes);
 app.use("/dashboard", dashboardRoutes);

src/backend/database/db/index.ts

@@ -978,11 +978,6 @@ const migrateSchema = () => {
     "override_credential_username",
     "INTEGER",
   );
-  addColumnIfNotExists(
-    "ssh_data",
-    "vault_profile_id",
-    "INTEGER REFERENCES vault_profiles(id) ON DELETE SET NULL",
-  );
 
   addColumnIfNotExists("ssh_data", "autostart_password", "TEXT");
   addColumnIfNotExists("ssh_data", "autostart_key", "TEXT");
@@ -1579,67 +1574,6 @@ const migrateSchema = () => {
     });
   }
 
-  try {
-    sqlite.prepare("SELECT id FROM vault_profiles LIMIT 1").get();
-  } catch {
-    try {
-      sqlite.exec(`
-        CREATE TABLE IF NOT EXISTS vault_profiles (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          user_id TEXT NOT NULL,
-          name TEXT NOT NULL,
-          description TEXT,
-          folder TEXT,
-          tags TEXT,
-          vault_addr TEXT NOT NULL,
-          vault_namespace TEXT,
-          oidc_mount TEXT,
-          oidc_role TEXT,
-          ssh_mount TEXT,
-          ssh_role TEXT NOT NULL,
-          valid_principals TEXT,
-          key_type TEXT,
-          shared INTEGER NOT NULL DEFAULT 0,
-          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
-        );
-      `);
-    } catch (createError) {
-      databaseLogger.warn("Failed to create vault_profiles table", {
-        operation: "schema_migration",
-        error: createError,
-      });
-    }
-  }
-
-  try {
-    sqlite.prepare("SELECT id FROM vault_tokens LIMIT 1").get();
-  } catch {
-    try {
-      sqlite.exec(`
-        CREATE TABLE IF NOT EXISTS vault_tokens (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          user_id TEXT NOT NULL,
-          profile_id INTEGER NOT NULL,
-          ssh_cert TEXT NOT NULL,
-          private_key TEXT NOT NULL,
-          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
-          expires_at TEXT NOT NULL,
-          last_used TEXT,
-          UNIQUE(user_id, profile_id),
-          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
-          FOREIGN KEY (profile_id) REFERENCES vault_profiles (id) ON DELETE CASCADE
-        );
-      `);
-    } catch (createError) {
-      databaseLogger.warn("Failed to create vault_tokens table", {
-        operation: "schema_migration",
-        error: createError,
-      });
-    }
-  }
-
   try {
     const existingRoles = sqlite.prepare("SELECT name, is_system FROM roles").all() as Array<{ name: string; is_system: number }>;
 
@@ -1878,7 +1812,6 @@ const migrateSchema = () => {
   addColumnIfNotExists("ssh_folders", "sync_id", "TEXT");
   addColumnIfNotExists("snippets", "sync_id", "TEXT");
   addColumnIfNotExists("snippet_folders", "sync_id", "TEXT");
-  addColumnIfNotExists("vault_profiles", "sync_id", "TEXT");
 
   // Plugin runtime: lastError reports why a plugin is blocked or failed, and
   // grants record whether a capability came from an admin or from bundling.
@@ -1896,7 +1829,6 @@ const migrateSchema = () => {
     "ssh_folders",
     "snippets",
     "snippet_folders",
-    "vault_profiles",
   ];
 
   for (const table of syncIdTables) {

src/backend/database/db/schema.mysql.ts

@@ -194,13 +194,6 @@ export const hosts = mysqlTable(
 
     credentialId: int("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
     overrideCredentialUsername: boolean("override_credential_username"),
-    // When authType is "vault", the host authenticates via a Vault SSH signer
-    // profile (shared settings, no secrets). The signing certificate is obtained
-    // per-user at connect time via an interactive Vault OIDC flow.
-    vaultProfileId: int("vault_profile_id").references(
-      () => vaultProfiles.id,
-      { onDelete: "set null" },
-    ),
     enableTerminal: boolean("enable_terminal")
       .notNull()
       .default(true),
@@ -660,71 +653,6 @@ export const auditLogs = mysqlTable(
   ],
 );
 
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = mysqlTable("vault_profiles", {
-  id: int("id").autoincrement().primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: varchar("name", { length: 255 }).notNull(),
-  description: text("description"),
-  folder: varchar("folder", { length: 255 }),
-  tags: text("tags"),
-  // Vault server connection (non-secret)
-  vaultAddr: text("vault_addr").notNull(),
-  vaultNamespace: text("vault_namespace"),
-  // OIDC auth method mount + role used to obtain a Vault token interactively
-  oidcMount: text("oidc_mount"),
-  oidcRole: text("oidc_role"),
-  // SSH secrets engine mount + signer role used to sign the ephemeral key
-  sshMount: text("ssh_mount"),
-  sshRole: text("ssh_role").notNull(),
-  validPrincipals: text("valid_principals"),
-  // Ephemeral keypair algorithm to generate per connection
-  keyType: text("key_type"),
-  // When true the profile is visible/usable by all users on the server
-  shared: boolean("shared").notNull().default(false),
-  syncId: varchar("sync_id", { length: 255 }).unique(),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-  updatedAt: text("updated_at")
-    .notNull()
-    .default(sql`(CURRENT_TIMESTAMP)`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = mysqlTable(
-  "vault_tokens",
-  {
-    id: int("id").autoincrement().primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    profileId: int("profile_id")
-      .notNull()
-      .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-  
-    sshCert: text("ssh_cert").notNull(),
-    privateKey: text("private_key").notNull(),
-  
-    createdAt: text("created_at")
-      .notNull()
-      .default(sql`(CURRENT_TIMESTAMP)`),
-    expiresAt: varchar("expires_at", { length: 255 }).notNull(),
-    lastUsed: text("last_used"),
-  },
-  // Declared inline in the production DDL as UNIQUE(...), but never here,
-  // so the generated Postgres and MySQL schemas allowed duplicates the
-  // SQLite deployment forbids — and the upsert had nothing to conflict on.
-  (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
 export const apiKeys = mysqlTable(
   "api_keys",
   {

src/backend/database/db/schema.pg.ts

@@ -195,13 +195,6 @@ export const hosts = pgTable(
 
     credentialId: integer("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
     overrideCredentialUsername: boolean("override_credential_username"),
-    // When authType is "vault", the host authenticates via a Vault SSH signer
-    // profile (shared settings, no secrets). The signing certificate is obtained
-    // per-user at connect time via an interactive Vault OIDC flow.
-    vaultProfileId: integer("vault_profile_id").references(
-      () => vaultProfiles.id,
-      { onDelete: "set null" },
-    ),
     enableTerminal: boolean("enable_terminal")
       .notNull()
       .default(true),
@@ -661,71 +654,6 @@ export const auditLogs = pgTable(
   ],
 );
 
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = pgTable("vault_profiles", {
-  id: serial("id").primaryKey(),
-  userId: varchar("user_id", { length: 255 })
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: varchar("name", { length: 255 }).notNull(),
-  description: text("description"),
-  folder: varchar("folder", { length: 255 }),
-  tags: text("tags"),
-  // Vault server connection (non-secret)
-  vaultAddr: text("vault_addr").notNull(),
-  vaultNamespace: text("vault_namespace"),
-  // OIDC auth method mount + role used to obtain a Vault token interactively
-  oidcMount: text("oidc_mount"),
-  oidcRole: text("oidc_role"),
-  // SSH secrets engine mount + signer role used to sign the ephemeral key
-  sshMount: text("ssh_mount"),
-  sshRole: text("ssh_role").notNull(),
-  validPrincipals: text("valid_principals"),
-  // Ephemeral keypair algorithm to generate per connection
-  keyType: text("key_type"),
-  // When true the profile is visible/usable by all users on the server
-  shared: boolean("shared").notNull().default(false),
-  syncId: varchar("sync_id", { length: 255 }).unique(),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-  updatedAt: text("updated_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = pgTable(
-  "vault_tokens",
-  {
-    id: serial("id").primaryKey(),
-    userId: varchar("user_id", { length: 255 })
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    profileId: integer("profile_id")
-      .notNull()
-      .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-  
-    sshCert: text("ssh_cert").notNull(),
-    privateKey: text("private_key").notNull(),
-  
-    createdAt: text("created_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-    expiresAt: varchar("expires_at", { length: 255 }).notNull(),
-    lastUsed: text("last_used"),
-  },
-  // Declared inline in the production DDL as UNIQUE(...), but never here,
-  // so the generated Postgres and MySQL schemas allowed duplicates the
-  // SQLite deployment forbids — and the upsert had nothing to conflict on.
-  (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
 export const apiKeys = pgTable(
   "api_keys",
   {

src/backend/database/db/schema.ts

@@ -187,13 +187,6 @@ export const hosts = sqliteTable(
     overrideCredentialUsername: integer("override_credential_username", {
       mode: "boolean",
     }),
-    // When authType is "vault", the host authenticates via a Vault SSH signer
-    // profile (shared settings, no secrets). The signing certificate is obtained
-    // per-user at connect time via an interactive Vault OIDC flow.
-    vaultProfileId: integer("vault_profile_id").references(
-      () => vaultProfiles.id,
-      { onDelete: "set null" },
-    ),
     enableTerminal: integer("enable_terminal", { mode: "boolean" })
       .notNull()
       .default(true),
@@ -653,71 +646,6 @@ export const auditLogs = sqliteTable(
   ],
 );
 
-// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
-// are intended to be shared across users (shared === true makes a profile
-// visible to every user on the server). Each user authenticates to Vault via an
-// interactive OIDC flow at connect time; no tokens or keys are stored here.
-export const vaultProfiles = sqliteTable("vault_profiles", {
-  id: integer("id").primaryKey({ autoIncrement: true }),
-  userId: text("user_id")
-    .notNull()
-    .references(() => users.id, { onDelete: "cascade" }),
-  name: text("name").notNull(),
-  description: text("description"),
-  folder: text("folder"),
-  tags: text("tags"),
-  // Vault server connection (non-secret)
-  vaultAddr: text("vault_addr").notNull(),
-  vaultNamespace: text("vault_namespace"),
-  // OIDC auth method mount + role used to obtain a Vault token interactively
-  oidcMount: text("oidc_mount"),
-  oidcRole: text("oidc_role"),
-  // SSH secrets engine mount + signer role used to sign the ephemeral key
-  sshMount: text("ssh_mount"),
-  sshRole: text("ssh_role").notNull(),
-  validPrincipals: text("valid_principals"),
-  // Ephemeral keypair algorithm to generate per connection
-  keyType: text("key_type"),
-  // When true the profile is visible/usable by all users on the server
-  shared: integer("shared", { mode: "boolean" }).notNull().default(false),
-  syncId: text("sync_id").unique(),
-  createdAt: text("created_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-  updatedAt: text("updated_at")
-    .notNull()
-    .default(sql`CURRENT_TIMESTAMP`),
-});
-
-// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
-// Transient: rows live only until the certificate expires. Secret fields are
-// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = sqliteTable(
-  "vault_tokens",
-  {
-    id: integer("id").primaryKey({ autoIncrement: true }),
-    userId: text("user_id")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    profileId: integer("profile_id")
-      .notNull()
-      .references(() => vaultProfiles.id, { onDelete: "cascade" }),
-  
-    sshCert: text("ssh_cert", { length: 8192 }).notNull(),
-    privateKey: text("private_key", { length: 8192 }).notNull(),
-  
-    createdAt: text("created_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-    expiresAt: text("expires_at").notNull(),
-    lastUsed: text("last_used"),
-  },
-  // Declared inline in the production DDL as UNIQUE(...), but never here,
-  // so the generated Postgres and MySQL schemas allowed duplicates the
-  // SQLite deployment forbids — and the upsert had nothing to conflict on.
-  (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
-);
-
 export const apiKeys = sqliteTable(
   "api_keys",
   {

src/backend/database/repositories/factory.ts

@@ -42,8 +42,6 @@ import { TrustedDeviceRepository } from "./trusted-device-repository.js";
 import { UserDataExportRepository } from "./user-data-export-repository.js";
 import { UserPreferenceRepository } from "./user-preference-repository.js";
 import { UserRepository } from "./user-repository.js";
-import { VaultProfileRepository } from "./vault-profile-repository.js";
-import { VaultTokenRepository } from "./vault-token-repository.js";
 
 /**
  * The context every repository runs against.
@@ -416,20 +414,6 @@ export function createCurrentSharedCredentialSecretsRepository(): SharedCredenti
   );
 }
 
-export function createCurrentVaultProfileRepository(): VaultProfileRepository {
-  return new VaultProfileRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("vault_profile_repository_write"),
-  );
-}
-
-export function createCurrentVaultTokenRepository(): VaultTokenRepository {
-  return new VaultTokenRepository(
-    createCurrentRepositoryContext(),
-    createCurrentRepositoryWriteHook("vault_token_repository_write"),
-  );
-}
-
 /**
  * Loads the settings cache. Must run during startup on engines without a
  * synchronous read, before anything calls getCurrentSettingValue.

src/backend/database/repositories/host-resolution-repository.ts

@@ -18,7 +18,6 @@ export interface HostUpdateStateRecord {
   rdpCredentialId: number | null;
   vncCredentialId: number | null;
   telnetCredentialId: number | null;
-  vaultProfileId: number | null;
   authType: string;
   parentHostId: number | null;
   folder: string | null;
@@ -146,7 +145,6 @@ export class HostResolutionRepository {
         rdpCredentialId: hosts.rdpCredentialId,
         vncCredentialId: hosts.vncCredentialId,
         telnetCredentialId: hosts.telnetCredentialId,
-        vaultProfileId: hosts.vaultProfileId,
         authType: hosts.authType,
         parentHostId: hosts.parentHostId,
         folder: hosts.folder,

src/backend/database/repositories/vault-profile-repository.ts

@@ -1,134 +0,0 @@
-import { desc, eq, or } from "drizzle-orm";
-import { randomUUID } from "crypto";
-import { vaultProfiles } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import {
-  deleteReturning,
-  insertReturning,
-  updateReturning,
-} from "./returning.js";
-
-export type VaultProfileRecord = typeof vaultProfiles.$inferSelect;
-
-export interface VaultProfileCreateInput {
-  userId: string;
-  name: string;
-  description?: string | null;
-  folder?: string | null;
-  tags?: string | null;
-  vaultAddr: string;
-  vaultNamespace?: string | null;
-  oidcMount?: string | null;
-  oidcRole?: string | null;
-  sshMount?: string | null;
-  sshRole: string;
-  validPrincipals?: string | null;
-  keyType?: string | null;
-  shared?: boolean;
-}
-
-export type VaultProfileUpdateInput = Partial<
-  Omit<VaultProfileCreateInput, "userId">
-> & {
-  updatedAt?: string;
-};
-
-export class VaultProfileRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  async listVisibleToUser(userId: string): Promise<VaultProfileRecord[]> {
-    return this.context.drizzle
-      .select()
-      .from(vaultProfiles)
-      .where(
-        or(eq(vaultProfiles.userId, userId), eq(vaultProfiles.shared, true)),
-      )
-      .orderBy(desc(vaultProfiles.updatedAt));
-  }
-
-  async create(input: VaultProfileCreateInput): Promise<VaultProfileRecord> {
-    const [created] = await insertReturning(this.context, vaultProfiles, {
-      syncId: randomUUID(),
-      userId: input.userId,
-      name: input.name,
-      description: input.description,
-      folder: input.folder,
-      tags: input.tags,
-      vaultAddr: input.vaultAddr,
-      vaultNamespace: input.vaultNamespace,
-      oidcMount: input.oidcMount,
-      oidcRole: input.oidcRole,
-      sshMount: input.sshMount,
-      sshRole: input.sshRole,
-      validPrincipals: input.validPrincipals,
-      keyType: input.keyType,
-      shared: input.shared ?? false,
-    });
-
-    await this.afterWrite();
-    return created;
-  }
-
-  async findById(id: number): Promise<VaultProfileRecord | null> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(vaultProfiles)
-      .where(eq(vaultProfiles.id, id))
-      .limit(1);
-
-    return rows[0] ?? null;
-  }
-
-  async updateById(
-    id: number,
-    input: VaultProfileUpdateInput,
-  ): Promise<VaultProfileRecord | null> {
-    const [updated] = await updateReturning(
-      this.context,
-      vaultProfiles,
-      {
-        ...input,
-        updatedAt: input.updatedAt ?? new Date().toISOString(),
-      },
-      eq(vaultProfiles.id, id),
-    );
-
-    if (updated) {
-      await this.afterWrite();
-    }
-
-    return updated ?? null;
-  }
-
-  async deleteById(id: number): Promise<{ syncId: string | null } | null> {
-    const rows = await deleteReturning(
-      this.context,
-      vaultProfiles,
-      eq(vaultProfiles.id, id),
-    );
-
-    if (rows.length === 0) return null;
-    await this.afterWrite();
-    return { syncId: rows[0].syncId };
-  }
-
-  async deleteByUserId(userId: string): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(vaultProfiles)
-      .where(eq(vaultProfiles.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}

src/backend/database/repositories/vault-token-repository.ts

@@ -1,126 +0,0 @@
-import { and, eq } from "drizzle-orm";
-import { vaultTokens } from "../db/schema.js";
-import type { DatabaseContext } from "./database-context.js";
-import { rowsAffected } from "./mutation-result.js";
-import { upsert } from "./returning.js";
-
-export type VaultTokenRecord = typeof vaultTokens.$inferSelect;
-
-export interface VaultTokenUpsertInput {
-  userId: string;
-  profileId: number;
-  sshCert: string;
-  privateKey: string;
-  expiresAt: string;
-  createdAt?: string;
-}
-
-export class VaultTokenRepository {
-  constructor(
-    private readonly context: DatabaseContext,
-    private readonly onWrite?: () => void | Promise<void>,
-  ) {}
-
-  async upsert(input: VaultTokenUpsertInput): Promise<void> {
-    const createdAt = input.createdAt ?? new Date().toISOString();
-
-    await upsert(
-      this.context,
-      vaultTokens,
-      {
-        userId: input.userId,
-        profileId: input.profileId,
-        sshCert: input.sshCert,
-        privateKey: input.privateKey,
-        expiresAt: input.expiresAt,
-      },
-      {
-        target: [vaultTokens.userId, vaultTokens.profileId],
-        set: {
-          sshCert: input.sshCert,
-          privateKey: input.privateKey,
-          expiresAt: input.expiresAt,
-          createdAt,
-        },
-      },
-    );
-
-    await this.afterWrite();
-  }
-
-  async findByUserAndProfile(
-    userId: string,
-    profileId: number,
-  ): Promise<VaultTokenRecord | null> {
-    const rows = await this.context.drizzle
-      .select()
-      .from(vaultTokens)
-      .where(
-        and(
-          eq(vaultTokens.userId, userId),
-          eq(vaultTokens.profileId, profileId),
-        ),
-      )
-      .limit(1);
-
-    return rows[0] ?? null;
-  }
-
-  async updateLastUsed(
-    userId: string,
-    profileId: number,
-    lastUsed = new Date().toISOString(),
-  ): Promise<boolean> {
-    const result = await this.context.drizzle
-      .update(vaultTokens)
-      .set({ lastUsed })
-      .where(
-        and(
-          eq(vaultTokens.userId, userId),
-          eq(vaultTokens.profileId, profileId),
-        ),
-      );
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result) > 0;
-  }
-
-  async deleteByUserAndProfile(
-    userId: string,
-    profileId: number,
-  ): Promise<boolean> {
-    const result = await this.context.drizzle
-      .delete(vaultTokens)
-      .where(
-        and(
-          eq(vaultTokens.userId, userId),
-          eq(vaultTokens.profileId, profileId),
-        ),
-      );
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result) > 0;
-  }
-
-  async deleteByUserId(userId: string): Promise<number> {
-    const result = await this.context.drizzle
-      .delete(vaultTokens)
-      .where(eq(vaultTokens.userId, userId));
-
-    if (rowsAffected(result) > 0) {
-      await this.afterWrite();
-    }
-
-    return rowsAffected(result);
-  }
-
-  private async afterWrite(): Promise<void> {
-    await this.onWrite?.();
-  }
-}

src/backend/database/routes/delete-user-data.ts

@@ -23,10 +23,8 @@ import {
   createCurrentTrustedDeviceRepository,
   createCurrentUserPreferenceRepository,
   createCurrentUserRepository,
-  createCurrentVaultProfileRepository,
   createCurrentSharedCredentialSecretsRepository,
   createCurrentCredentialAccessRepository,
-  createCurrentVaultTokenRepository,
 } from "../repositories/factory.js";
 
 export async function deleteUserAndRelatedData(
@@ -96,11 +94,9 @@ export async function deleteUserAndRelatedData(
     // secret_sources cascade on the user's refUser() foreign key, as the
     // homepage and secret-sources plugins' adopted tables. The secret
     // source's token in ctx.secrets is cleaned up generically below, with
-    // every other plugin_settings row for this user. The opkssh plugin's
-    // cached certificates cascade the same way.
+    // every other plugin_settings row for this user. The opkssh and vault
+    // plugins' tables cascade the same way.
 
-    await createCurrentVaultTokenRepository().deleteByUserId(userId);
-    await createCurrentVaultProfileRepository().deleteByUserId(userId);
     await createCurrentTermixIdentityCaRepository().deleteByUserId(userId);
     await createCurrentTermixIdentityRepository().deleteByUserId(userId);
     await createCurrentOpenTabRepository().deleteByUserId(userId);

src/backend/database/routes/host-compat-routes.ts

@@ -1,6 +1,7 @@
 /**
- * The 2.8 URLs under /host that something outside Termix still depends on:
- * the OPKSSH and Step CA redirect URIs registered with identity providers.
+ * The 2.8 auth callback URLs something outside Termix still depends on: the
+ * OPKSSH and Step CA redirect URIs registered with identity providers, and
+ * the Vault one listed in Vault OIDC roles.
  * Each forwards to the plugin route that replaced it, so with the plugin off
  * it signs nobody in.
  */
@@ -50,3 +51,21 @@ export function registerHostAuthCompatRoutes(router: Router): void {
     res.redirect(307, localUrl(req, "/plugin-api/step-ca/callback"));
   });
 }
+
+export function registerVaultCompatRoutes(router: Router): void {
+  /**
+   * @openapi
+   * /vault/oidc/callback:
+   *   get:
+   *     summary: Vault OIDC callback (2.8 URL)
+   *     description: The redirect URI Vault OIDC roles allowed before 2.9. Redirects to /plugin-api/vault/oidc/callback with the same query, so existing Vault roles keep working.
+   *     tags:
+   *       - Vault
+   *     responses:
+   *       307:
+   *         description: Redirect to the vault plugin's callback.
+   */
+  router.get("/oidc/callback", (req, res) => {
+    res.redirect(307, localUrl(req, "/plugin-api/vault/oidc/callback"));
+  });
+}

src/backend/database/routes/host-normalizers.ts

@@ -42,7 +42,6 @@ export const OWNER_PRIVATE_AUTH_FIELDS = {
     "authType",
     "authMethod",
     "credentialId",
-    "vaultProfileId",
     "overrideCredentialUsername",
     "shareSshAuth",
     "password",

src/backend/database/routes/host.ts

@@ -183,7 +183,6 @@ router.post(
       authType,
       shareSshAuth,
       credentialId,
-      vaultProfileId,
       key,
       keyPassword,
       keyType,
@@ -305,8 +304,6 @@ router.post(
       authType: effectiveAuthType,
       shareSshAuth: shareSshAuth === true ? 1 : 0,
       credentialId: credentialId || null,
-      vaultProfileId:
-        effectiveAuthType === "vault" ? vaultProfileId || null : null,
       overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
       pin: pin ? 1 : 0,
       enableTerminal: enableTerminal ? 1 : 0,
@@ -858,7 +855,6 @@ router.put(
       authType,
       shareSshAuth,
       credentialId,
-      vaultProfileId,
       key,
       keyPassword,
       keyType,
@@ -981,8 +977,6 @@ router.put(
       authType: effectiveAuthType,
       shareSshAuth: shareSshAuth === true ? 1 : 0,
       credentialId: credentialId || null,
-      vaultProfileId:
-        effectiveAuthType === "vault" ? vaultProfileId || null : null,
       overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
       pin: pin ? 1 : 0,
       enableTerminal: enableTerminal ? 1 : 0,

src/backend/database/routes/sync-entities.ts

@@ -15,7 +15,6 @@ import {
   hosts,
   sshCredentials,
   sshFolders,
-  vaultProfiles,
   userPreferences,
 } from "../db/schema.js";
 import {
@@ -47,11 +46,6 @@ const HOST_REFERENCES = [
     syncField: "telnetCredentialSyncId",
     entityType: "sshCredentials",
   },
-  {
-    field: "vaultProfileId",
-    syncField: "vaultProfileSyncId",
-    entityType: "vaultProfiles",
-  },
   {
     field: "parentHostId",
     syncField: "parentHostSyncId",
@@ -78,11 +72,8 @@ export function registerCoreSyncEntities(): void {
     order: 10,
   });
 
-  registerEntity(CORE_OWNER, {
-    type: "vaultProfiles",
-    table: vaultProfiles,
-    order: 20,
-  });
+  // vaultProfiles (order 20) moved to the vault plugin. Hosts no longer
+  // reference it: a host's profile is the plugin's profileId host setting.
 
   registerEntity(CORE_OWNER, {
     type: "sshFolders",

src/backend/database/routes/sync-references.ts

@@ -7,8 +7,7 @@ import { getEntity } from "../../plugins/sync-registry.js";
  * A plain string rather than a union: the set is whatever is registered, and a
  * plugin can both register an entity and reference one. sync.ts resolves the
  * name through the registry, so an unknown one is an error there rather than a
- * silent fallthrough - which is what the old three-way if/else did, routing
- * anything that was not hosts or sshCredentials to vaultProfiles.
+ * silent fallthrough.
  */
 export type SyncReferenceEntity = string;
 

src/backend/database/routes/vault.ts

@@ -1,448 +0,0 @@
-import express, { type Request, type Response } from "express";
-import {
-  createCurrentVaultProfileRepository,
-  createCurrentUserRepository,
-  createCurrentSyncTombstoneRepository,
-} from "../repositories/factory.js";
-import type { VaultProfileUpdateInput } from "../repositories/vault-profile-repository.js";
-import type { AuthenticatedRequest } from "../../../types/index.js";
-import { authLogger } from "../../utils/logger.js";
-import { AuthManager } from "../../utils/auth-manager.js";
-import { completeVaultAuth } from "../../hosts/vault-oidc-auth.js";
-
-const router = express.Router();
-
-const authManager = AuthManager.getInstance();
-const authenticateJWT = authManager.createAuthMiddleware();
-
-function isNonEmptyString(val: unknown): val is string {
-  return typeof val === "string" && val.trim().length > 0;
-}
-
-async function userIsAdmin(userId: string): Promise<boolean> {
-  try {
-    const user = await createCurrentUserRepository().findById(userId);
-    return !!user?.isAdmin;
-  } catch {
-    return false;
-  }
-}
-
-function formatProfile(
-  row: Record<string, unknown>,
-  currentUserId: string,
-): Record<string, unknown> {
-  return {
-    id: row.id,
-    name: row.name,
-    description: row.description,
-    folder: row.folder,
-    tags:
-      typeof row.tags === "string"
-        ? row.tags
-          ? (row.tags as string).split(",").filter(Boolean)
-          : []
-        : [],
-    vaultAddr: row.vaultAddr,
-    vaultNamespace: row.vaultNamespace,
-    oidcMount: row.oidcMount,
-    oidcRole: row.oidcRole,
-    sshMount: row.sshMount,
-    sshRole: row.sshRole,
-    validPrincipals: row.validPrincipals,
-    keyType: row.keyType,
-    shared: !!row.shared,
-    owned: row.userId === currentUserId,
-    createdAt: row.createdAt,
-    updatedAt: row.updatedAt,
-  };
-}
-
-/**
- * @openapi
- * /vault/oidc/callback:
- *   get:
- *     summary: Vault OIDC callback
- *     description: Unauthenticated endpoint the IdP redirects to after login. Correlates the authorization code to a pending session via the Vault-issued state parameter.
- *     tags:
- *       - Vault
- *     parameters:
- *       - in: query
- *         name: state
- *         required: true
- *         schema:
- *           type: string
- *       - in: query
- *         name: code
- *         required: true
- *         schema:
- *           type: string
- *       - in: query
- *         name: error
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: HTML page confirming sign-in success or failure.
- *       400:
- *         description: Missing parameters or authentication failure.
- */
-router.get("/oidc/callback", async (req: Request, res: Response) => {
-  const state = String(req.query.state || "");
-  const code = String(req.query.code || "");
-  const oidcError = req.query.error ? String(req.query.error) : "";
-
-  const esc = (value: string): string =>
-    value
-      .replace(/&/g, "&amp;")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-      .replace(/"/g, "&quot;")
-      .replace(/'/g, "&#39;");
-
-  const html = (title: string, message: string) =>
-    `<!doctype html><html><head><meta charset="utf-8"><title>${esc(title)}</title>
-<style>body{font-family:system-ui,sans-serif;background:#0b0b0c;color:#e5e5e5;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
-.card{max-width:420px;text-align:center;padding:24px;border:1px solid #2a2a2e;border-radius:8px}</style></head>
-<body><div class="card"><h2>${esc(title)}</h2><p>${esc(message)}</p>
-<script>setTimeout(function(){window.close()},1500)</script></div></body></html>`;
-
-  if (oidcError) {
-    return res
-      .status(400)
-      .send(html("Vault sign-in failed", `Vault returned: ${oidcError}`));
-  }
-  if (!state || !code) {
-    return res
-      .status(400)
-      .send(html("Vault sign-in failed", "Missing state or code."));
-  }
-
-  const result = await completeVaultAuth(state, code);
-  if (result.ok) {
-    return res.send(
-      html(
-        "Vault sign-in complete",
-        "You can close this window and return to Termix.",
-      ),
-    );
-  }
-  return res
-    .status(400)
-    .send(
-      html("Vault sign-in failed", result.error || "Authentication failed."),
-    );
-});
-
-/**
- * @openapi
- * /vault/profiles:
- *   get:
- *     summary: List Vault profiles
- *     description: Returns all Vault signer profiles owned by the authenticated user or marked as shared.
- *     tags:
- *       - Vault
- *     responses:
- *       200:
- *         description: Array of Vault profile objects.
- *       500:
- *         description: Failed to list vault profiles.
- */
-router.get(
-  "/profiles",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    try {
-      const rows =
-        await createCurrentVaultProfileRepository().listVisibleToUser(userId);
-      res.json(
-        rows.map((r) => formatProfile(r as Record<string, unknown>, userId)),
-      );
-    } catch (err) {
-      authLogger.error("Failed to list vault profiles", err);
-      res.status(500).json({ error: "Failed to list vault profiles" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /vault/profiles:
- *   post:
- *     summary: Create a Vault profile
- *     description: Creates a new Vault signer profile owned by the authenticated user. The shared flag requires admin privileges.
- *     tags:
- *       - Vault
- *     requestBody:
- *       required: true
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *             required:
- *               - name
- *               - vaultAddr
- *               - sshRole
- *             properties:
- *               name:
- *                 type: string
- *               vaultAddr:
- *                 type: string
- *               vaultNamespace:
- *                 type: string
- *               oidcMount:
- *                 type: string
- *               oidcRole:
- *                 type: string
- *               sshMount:
- *                 type: string
- *               sshRole:
- *                 type: string
- *               validPrincipals:
- *                 type: string
- *               keyType:
- *                 type: string
- *               shared:
- *                 type: boolean
- *     responses:
- *       201:
- *         description: Created Vault profile object.
- *       400:
- *         description: Missing required fields.
- *       403:
- *         description: Non-admin attempted to create a shared profile.
- *       500:
- *         description: Failed to create vault profile.
- */
-router.post(
-  "/profiles",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const {
-      name,
-      description,
-      folder,
-      tags,
-      vaultAddr,
-      vaultNamespace,
-      oidcMount,
-      oidcRole,
-      sshMount,
-      sshRole,
-      validPrincipals,
-      keyType,
-      shared,
-    } = req.body;
-
-    if (
-      !isNonEmptyString(name) ||
-      !isNonEmptyString(vaultAddr) ||
-      !isNonEmptyString(sshRole)
-    ) {
-      return res
-        .status(400)
-        .json({ error: "name, vaultAddr and sshRole are required" });
-    }
-
-    const wantShared = !!shared;
-    if (wantShared && !(await userIsAdmin(userId))) {
-      return res.status(403).json({
-        error: "Only administrators can create shared Vault profiles",
-      });
-    }
-
-    try {
-      const inserted = await createCurrentVaultProfileRepository().create({
-        userId,
-        name: name.trim(),
-        description: description?.trim() || null,
-        folder: folder?.trim() || null,
-        tags: Array.isArray(tags) ? tags.join(",") : tags || "",
-        vaultAddr: vaultAddr.trim(),
-        vaultNamespace: vaultNamespace?.trim() || null,
-        oidcMount: oidcMount?.trim() || null,
-        oidcRole: oidcRole?.trim() || null,
-        sshMount: sshMount?.trim() || null,
-        sshRole: sshRole.trim(),
-        validPrincipals: validPrincipals?.trim() || null,
-        keyType: keyType?.trim() || null,
-        shared: wantShared,
-      });
-      res
-        .status(201)
-        .json(formatProfile(inserted as Record<string, unknown>, userId));
-    } catch (err) {
-      authLogger.error("Failed to create vault profile", err);
-      res.status(500).json({ error: "Failed to create vault profile" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /vault/profiles/{id}:
- *   put:
- *     summary: Update a Vault profile
- *     description: Updates a Vault signer profile. Only the owner may edit; toggling shared to true requires admin privileges.
- *     tags:
- *       - Vault
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: integer
- *     requestBody:
- *       content:
- *         application/json:
- *           schema:
- *             type: object
- *     responses:
- *       200:
- *         description: Updated Vault profile object.
- *       400:
- *         description: Invalid profile id.
- *       403:
- *         description: Non-owner attempted to edit, or non-admin attempted to share.
- *       404:
- *         description: Profile not found.
- *       500:
- *         description: Failed to update vault profile.
- */
-router.put(
-  "/profiles/:id",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const id = parseInt(String(req.params.id), 10);
-    if (!Number.isFinite(id)) {
-      return res.status(400).json({ error: "Invalid profile id" });
-    }
-
-    try {
-      const repository = createCurrentVaultProfileRepository();
-      const existing = await repository.findById(id);
-      if (!existing) {
-        return res.status(404).json({ error: "Profile not found" });
-      }
-      if (existing.userId !== userId) {
-        return res
-          .status(403)
-          .json({ error: "Only the owner can edit this profile" });
-      }
-
-      const body = req.body;
-      const fields: VaultProfileUpdateInput = {
-        updatedAt: new Date().toISOString(),
-      };
-      if (body.name !== undefined) fields.name = body.name?.trim();
-      if (body.description !== undefined)
-        fields.description = body.description?.trim() || null;
-      if (body.folder !== undefined)
-        fields.folder = body.folder?.trim() || null;
-      if (body.tags !== undefined)
-        fields.tags = Array.isArray(body.tags)
-          ? body.tags.join(",")
-          : body.tags || "";
-      if (body.vaultAddr !== undefined && isNonEmptyString(body.vaultAddr))
-        fields.vaultAddr = body.vaultAddr.trim();
-      if (body.vaultNamespace !== undefined)
-        fields.vaultNamespace = body.vaultNamespace?.trim() || null;
-      if (body.oidcMount !== undefined)
-        fields.oidcMount = body.oidcMount?.trim() || null;
-      if (body.oidcRole !== undefined)
-        fields.oidcRole = body.oidcRole?.trim() || null;
-      if (body.sshMount !== undefined)
-        fields.sshMount = body.sshMount?.trim() || null;
-      if (body.sshRole !== undefined && isNonEmptyString(body.sshRole))
-        fields.sshRole = body.sshRole.trim();
-      if (body.validPrincipals !== undefined)
-        fields.validPrincipals = body.validPrincipals?.trim() || null;
-      if (body.keyType !== undefined)
-        fields.keyType = body.keyType?.trim() || null;
-      if (body.shared !== undefined) {
-        if (!!body.shared && !(await userIsAdmin(userId))) {
-          return res.status(403).json({
-            error: "Only administrators can share Vault profiles",
-          });
-        }
-        fields.shared = !!body.shared;
-      }
-
-      const updated = await repository.updateById(id, fields);
-      if (!updated) {
-        return res.status(404).json({ error: "Profile not found" });
-      }
-      res.json(formatProfile(updated as Record<string, unknown>, userId));
-    } catch (err) {
-      authLogger.error("Failed to update vault profile", err);
-      res.status(500).json({ error: "Failed to update vault profile" });
-    }
-  },
-);
-
-/**
- * @openapi
- * /vault/profiles/{id}:
- *   delete:
- *     summary: Delete a Vault profile
- *     description: Permanently deletes a Vault signer profile. Only the owner may delete it.
- *     tags:
- *       - Vault
- *     parameters:
- *       - in: path
- *         name: id
- *         required: true
- *         schema:
- *           type: integer
- *     responses:
- *       200:
- *         description: Deletion confirmed.
- *       400:
- *         description: Invalid profile id.
- *       403:
- *         description: Non-owner attempted to delete.
- *       404:
- *         description: Profile not found.
- *       500:
- *         description: Failed to delete vault profile.
- */
-router.delete(
-  "/profiles/:id",
-  authenticateJWT,
-  async (req: Request, res: Response) => {
-    const userId = (req as AuthenticatedRequest).userId;
-    const id = parseInt(String(req.params.id), 10);
-    if (!Number.isFinite(id)) {
-      return res.status(400).json({ error: "Invalid profile id" });
-    }
-    try {
-      const repository = createCurrentVaultProfileRepository();
-      const existing = await repository.findById(id);
-      if (!existing) {
-        return res.status(404).json({ error: "Profile not found" });
-      }
-      if (existing.userId !== userId) {
-        return res
-          .status(403)
-          .json({ error: "Only the owner can delete this profile" });
-      }
-      const deleted = await repository.deleteById(id);
-      if (deleted?.syncId) {
-        await createCurrentSyncTombstoneRepository().record(
-          userId,
-          "vaultProfiles",
-          deleted.syncId,
-        );
-      }
-      res.json({ success: true });
-    } catch (err) {
-      authLogger.error("Failed to delete vault profile", err);
-      res.status(500).json({ error: "Failed to delete vault profile" });
-    }
-  },
-);
-
-export default router;