feat: Secret management

server/internal/models/secret.go

@@ -0,0 +1,24 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Secret is a single key/value pair within a group. The value is stored
+// encrypted (AES-256-GCM) and is never serialized to JSON.
+type Secret struct {
+	ID             bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	Group          string        `bson:"group" json:"group"`
+	Key            string        `bson:"key" json:"key"`
+	EncryptedValue string        `bson:"encrypted_value" json:"-"`
+	UpdatedAt      time.Time     `bson:"updated_at" json:"updated_at"`
+}
+
+// GroupSummary describes a group in the list view.
+type GroupSummary struct {
+	Group     string    `json:"group"`
+	KeyCount  int       `json:"key_count"`
+	UpdatedAt time.Time `json:"updated_at"`
+}

server/internal/models/settings.go

@@ -1,6 +1,10 @@
 package models
 
-import "go.mongodb.org/mongo-driver/v2/bson"
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
 
 type AlertSettings struct {
 	Enabled                 bool   `bson:"enabled" json:"enabled"`
@@ -19,8 +23,17 @@ type EmailSettings struct {
 	UseTLS   bool     `bson:"use_tls" json:"use_tls"`
 }
 
-type Settings struct {
-	ID     bson.ObjectID `bson:"_id,omitempty" json:"-"`
-	Alerts AlertSettings `bson:"alerts" json:"alerts"`
-	Email  EmailSettings `bson:"email" json:"email"`
+// SecretsSettings holds configuration for the secrets vault / ESO integration.
+// The read token is stored as a SHA-256 hash and never returned to clients.
+type SecretsSettings struct {
+	ReadTokenHash string    `bson:"read_token_hash,omitempty" json:"-"`
+	ReadTokenSet  bool      `bson:"-" json:"read_token_set"`
+	RotatedAt     time.Time `bson:"rotated_at,omitempty" json:"rotated_at,omitempty"`
+}
+
+type Settings struct {
+	ID      bson.ObjectID   `bson:"_id,omitempty" json:"-"`
+	Alerts  AlertSettings   `bson:"alerts" json:"alerts"`
+	Email   EmailSettings   `bson:"email" json:"email"`
+	Secrets SecretsSettings `bson:"secrets" json:"secrets"`
 }