47 lines
2.5 KiB
Markdown
47 lines
2.5 KiB
Markdown
# Read-only password-store domains
|
|
|
|
`VaultReader` in `crates/storage` owns the semantics for `list`/`ls`, explicit
|
|
and implicit `show`, `find`/`search`, and decrypted `grep`. Frontends receive
|
|
typed models and render storage-provided paths; they do not inspect tree text,
|
|
ciphertext names, or decrypted display strings to infer domain state.
|
|
|
|
## Trees and dispatch
|
|
|
|
Tree models contain separate entry and directory node kinds, logical paths,
|
|
names, and deterministic children. Entry names never contain the `.gpg` storage
|
|
suffix. Policy files, signatures, other metadata, `.git`, and `.extensions`
|
|
trees are not nodes. The plain renderer produces the stable uncolored tree used
|
|
by command-line output.
|
|
|
|
No show path selects the root tree. A path is resolved against the repository
|
|
snapshot: an entry decrypts to redacted `SecretBytes`, while a directory returns
|
|
its subtree. Missing and ambiguous paths remain typed repository errors and map
|
|
to the normal `pass` failure status.
|
|
|
|
Clipboard and QR requests use the parsed `Presentation` enum and a nonzero line
|
|
number. Storage selects that line directly from decrypted bytes and returns a
|
|
`PresentationSecret` containing the logical entry, line, channel, and redacted
|
|
zeroizing contents. The adapter never parses rendered terminal output, and a
|
|
missing or empty requested line is an explicit failure.
|
|
The resulting secret is consumed by the shared presentation service documented
|
|
in [`presentation.md`](presentation.md); plaintext is not written to CLI output
|
|
for clipboard or QR requests.
|
|
|
|
## Name and plaintext search
|
|
|
|
Find performs Unicode case-insensitive substring matching against logical entry
|
|
and directory names. Multiple terms are alternatives, as in upstream `pass`.
|
|
Results include typed matches plus a pruned deterministic tree with the
|
|
necessary ancestors. Hidden implementation directories, metadata, and
|
|
ciphertext suffixes cannot become matches.
|
|
|
|
Decrypted grep uses the Rust `regex` byte engine, which provides linear-time
|
|
matching without invoking GNU grep. The accepted command contract is limited to
|
|
case-insensitive, inverted, line-number, and fixed-string behavior; unsupported
|
|
GNU options fail during command parsing. Entries are visited in repository
|
|
order, each plaintext is decrypted only while its lines are examined, and the
|
|
full plaintext buffer is zeroed when that iteration ends. Matched lines are
|
|
copied into redacted `SecretBytes`; rendered grep output is also returned as
|
|
`SecretBytes`, and both are zeroed with their result values. Debug output
|
|
includes paths and counts but never matched contents.
|