feat: move vault ssh signing into a plugin (C5)

src/backend/tests/database/repositories/host-resolution-repository.test.ts

@@ -195,7 +195,6 @@ describe("HostResolutionRepository", () => {
       rdpCredentialId: null,
       vncCredentialId: null,
       telnetCredentialId: null,
-      vaultProfileId: null,
       authType: "password",
       parentHostId: null,
       folder: null,

src/backend/tests/database/repositories/vault-profile-repository.test.ts

@@ -1,115 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { TestSqliteDatabase } from "./test-support.js";
-import { VaultProfileRepository } from "../../../database/repositories/vault-profile-repository.js";
-
-describe("VaultProfileRepository", () => {
-  let adapter: TestSqliteDatabase | null = null;
-
-  afterEach(async () => {
-    if (adapter) {
-      await adapter.close();
-      adapter = null;
-    }
-  });
-
-  async function createRepository(
-    onWrite?: () => void | Promise<void>,
-  ): Promise<VaultProfileRepository> {
-    adapter = new TestSqliteDatabase();
-    const context = await adapter.connect();
-    await adapter.exec(`
-      INSERT INTO users (id, username, password_hash)
-      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
-      INSERT INTO vault_profiles (
-        id, user_id, name, vault_addr, ssh_role, shared, updated_at
-      )
-      VALUES (1, 'user-1', 'owned', 'https://vault.one', 'role-one', 0, '2026-01-01T00:00:00.000Z'),
-        (2, 'user-2', 'shared', 'https://vault.two', 'role-two', 1, '2026-01-02T00:00:00.000Z'),
-        (3, 'user-2', 'hidden', 'https://vault.three', 'role-three', 0, '2026-01-03T00:00:00.000Z');
-    `);
-
-    return new VaultProfileRepository(context, onWrite);
-  }
-
-  it("lists profiles owned by or shared with the user", async () => {
-    const repo = await createRepository();
-
-    const rows = await repo.listVisibleToUser("user-1");
-
-    expect(rows.map((row) => row.id)).toEqual([2, 1]);
-  });
-
-  it("creates and reads a profile", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    const created = await repo.create({
-      userId: "user-1",
-      name: "new",
-      description: "desc",
-      folder: "folder",
-      tags: "prod,ssh",
-      vaultAddr: "https://vault.new",
-      vaultNamespace: "ns",
-      oidcMount: "oidc",
-      oidcRole: "oidc-role",
-      sshMount: "ssh",
-      sshRole: "ssh-role",
-      validPrincipals: "root",
-      keyType: "ed25519",
-      shared: true,
-    });
-
-    const found = await repo.findById(created.id);
-    expect(found).toMatchObject({
-      userId: "user-1",
-      name: "new",
-      vaultAddr: "https://vault.new",
-      sshRole: "ssh-role",
-      shared: true,
-    });
-    expect(writeCount).toBe(1);
-  });
-
-  it("updates and deletes profiles", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    const updated = await repo.updateById(1, {
-      name: "renamed",
-      shared: true,
-      updatedAt: "2026-02-01T00:00:00.000Z",
-    });
-    expect(updated).toMatchObject({
-      id: 1,
-      name: "renamed",
-      shared: true,
-      updatedAt: "2026-02-01T00:00:00.000Z",
-    });
-
-    expect(await repo.updateById(999, { name: "missing" })).toBeNull();
-    expect(await repo.deleteById(1)).toEqual({ syncId: null });
-    expect(await repo.deleteById(1)).toBeNull();
-    expect(await repo.findById(1)).toBeNull();
-    expect(writeCount).toBe(2);
-  });
-
-  it("deletes all profiles for a user", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    await expect(repo.deleteByUserId("user-2")).resolves.toBe(2);
-    await expect(repo.deleteByUserId("missing")).resolves.toBe(0);
-
-    expect(await repo.findById(2)).toBeNull();
-    expect(await repo.findById(3)).toBeNull();
-    expect((await repo.findById(1))?.userId).toBe("user-1");
-    expect(writeCount).toBe(1);
-  });
-});

src/backend/tests/database/repositories/vault-token-repository.test.ts

@@ -1,107 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import { TestSqliteDatabase } from "./test-support.js";
-import { VaultTokenRepository } from "../../../database/repositories/vault-token-repository.js";
-
-describe("VaultTokenRepository", () => {
-  let adapter: TestSqliteDatabase | null = null;
-
-  afterEach(async () => {
-    if (adapter) {
-      await adapter.close();
-      adapter = null;
-    }
-  });
-
-  async function createRepository(
-    onWrite?: () => void | Promise<void>,
-  ): Promise<VaultTokenRepository> {
-    adapter = new TestSqliteDatabase();
-    const context = await adapter.connect();
-    await adapter.exec(`
-      INSERT INTO users (id, username, password_hash)
-      VALUES ('user-1', 'alice', 'hash'), ('user-2', 'bob', 'hash');
-      INSERT INTO vault_profiles (id, user_id, name, vault_addr, ssh_role)
-      VALUES (1, 'user-1', 'one', 'http://vault', 'r'), (2, 'user-2', 'two', 'http://vault', 'r');
-      INSERT INTO vault_tokens (
-        user_id, profile_id, ssh_cert, private_key, expires_at
-      )
-      VALUES
-        ('user-1', 1, 'cert-1', 'key-1', '2099-01-01T00:00:00.000Z'),
-        ('user-2', 2, 'cert-2', 'key-2', '2099-01-01T00:00:00.000Z');
-    `);
-
-    return new VaultTokenRepository(context, onWrite);
-  }
-
-  it("finds and upserts a token by user and profile", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    const existing = await repo.findByUserAndProfile("user-1", 1);
-    expect(existing?.sshCert).toBe("cert-1");
-
-    await repo.upsert({
-      userId: "user-1",
-      profileId: 1,
-      sshCert: "new-cert",
-      privateKey: "new-key",
-      expiresAt: "2099-02-01T00:00:00.000Z",
-      createdAt: "2026-01-01T00:00:00.000Z",
-    });
-
-    const updated = await repo.findByUserAndProfile("user-1", 1);
-    expect(updated).toMatchObject({
-      sshCert: "new-cert",
-      privateKey: "new-key",
-      expiresAt: "2099-02-01T00:00:00.000Z",
-      createdAt: "2026-01-01T00:00:00.000Z",
-    });
-    expect(writeCount).toBe(1);
-  });
-
-  it("updates last-used and deletes one token", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    expect(
-      await repo.updateLastUsed("user-1", 1, "2026-01-02T00:00:00.000Z"),
-    ).toBe(true);
-    expect(await repo.updateLastUsed("missing", 1)).toBe(false);
-    expect((await repo.findByUserAndProfile("user-1", 1))?.lastUsed).toBe(
-      "2026-01-02T00:00:00.000Z",
-    );
-
-    expect(await repo.deleteByUserAndProfile("user-1", 1)).toBe(true);
-    expect(await repo.deleteByUserAndProfile("user-1", 1)).toBe(false);
-    expect(await repo.findByUserAndProfile("user-1", 1)).toBeNull();
-    expect(await repo.findByUserAndProfile("user-2", 2)).not.toBeNull();
-    expect(writeCount).toBe(2);
-  });
-
-  it("deletes all tokens for a user", async () => {
-    let writeCount = 0;
-    const repo = await createRepository(() => {
-      writeCount += 1;
-    });
-
-    await repo.upsert({
-      userId: "user-1",
-      profileId: 2,
-      sshCert: "cert-extra",
-      privateKey: "key-extra",
-      expiresAt: "2099-03-01T00:00:00.000Z",
-    });
-
-    await expect(repo.deleteByUserId("user-1")).resolves.toBe(2);
-    await expect(repo.deleteByUserId("missing")).resolves.toBe(0);
-
-    expect(await repo.findByUserAndProfile("user-1", 1)).toBeNull();
-    expect(await repo.findByUserAndProfile("user-1", 2)).toBeNull();
-    expect(await repo.findByUserAndProfile("user-2", 2)).not.toBeNull();
-    expect(writeCount).toBe(2);
-  });
-});

src/backend/tests/database/routes/host-compat-routes.test.ts

@@ -1,5 +1,5 @@
 /**
- * The OPKSSH and Step CA redirect URIs identity providers were registered with before
+ * The OPKSSH, Step CA and Vault redirect URIs identity providers were registered with before
  * 2.9 must keep reaching the plugin's callback, query intact.
  */
 
@@ -62,3 +62,29 @@ describe("the old Step CA callback", () => {
     );
   });
 });
+
+describe("the old Vault callback", () => {
+  it("forwards to the plugin's callback with the query", async () => {
+    const { registerVaultCompatRoutes } =
+      await import("../../../database/routes/host-compat-routes.js");
+    const router = express.Router();
+    registerVaultCompatRoutes(router);
+    const app = express();
+    app.use("/vault", router);
+    const vaultServer = http.createServer(app);
+    await new Promise<void>((resolve) => vaultServer.listen(0, resolve));
+    const port = (vaultServer.address() as AddressInfo).port;
+    try {
+      const response = await fetch(
+        `http://127.0.0.1:${port}/vault/oidc/callback?code=abc&state=xyz`,
+        { redirect: "manual" },
+      );
+      expect(response.status).toBe(307);
+      expect(response.headers.get("location")).toBe(
+        "/plugin-api/vault/oidc/callback?code=abc&state=xyz",
+      );
+    } finally {
+      await new Promise<void>((resolve) => vaultServer.close(() => resolve()));
+    }
+  });
+});

src/backend/tests/database/routes/sync.test.ts

@@ -33,7 +33,6 @@ describe("isValidEntityType", () => {
       "hosts",
       "sshCredentials",
       "sshFolders",
-      "vaultProfiles",
       "userPreferences",
     ]) {
       expect(isValidEntityType(type)).toBe(true);

src/backend/tests/database/sync-references.test.ts

@@ -23,7 +23,6 @@ describe("sync references", () => {
         rdpCredentialId: 13,
         vncCredentialId: null,
         telnetCredentialId: null,
-        vaultProfileId: 4,
         parentHostId: 3,
       },
       async (entityType, id) => `${entityType}-${id}`,
@@ -34,17 +33,14 @@ describe("sync references", () => {
       rdpCredentialSyncId: "sshCredentials-13",
       vncCredentialSyncId: null,
       telnetCredentialSyncId: null,
-      vaultProfileSyncId: "vaultProfiles-4",
       parentHostSyncId: "hosts-3",
     });
     expect(row).not.toHaveProperty("credentialId");
-    expect(row).not.toHaveProperty("vaultProfileId");
   });
 
   it("resolves stable sync IDs to IDs from the receiving database", async () => {
     const ids = new Map([
       ["sshCredentials:credential-sync", 91],
-      ["vaultProfiles:vault-sync", 37],
       ["hosts:parent-sync", 52],
     ]);
     const row = await deserializeSyncReferences(
@@ -55,7 +51,6 @@ describe("sync references", () => {
         rdpCredentialSyncId: null,
         vncCredentialSyncId: null,
         telnetCredentialSyncId: null,
-        vaultProfileSyncId: "vault-sync",
         parentHostSyncId: "parent-sync",
       },
       async (entityType, syncId) => ids.get(`${entityType}:${syncId}`) ?? null,
@@ -66,7 +61,6 @@ describe("sync references", () => {
       rdpCredentialId: null,
       vncCredentialId: null,
       telnetCredentialId: null,
-      vaultProfileId: 37,
       parentHostId: 52,
     });
     expect(row).not.toHaveProperty("credentialSyncId");