wraith/backend
Vantz Stockwell b11efce6ed feat(security): Argon2id key derivation for vault encryption
BREAKING CHANGE (forward-only): New credentials/keys encrypted with v2
(Argon2id-derived AES-256-GCM). Existing v1 records decrypt transparently.

- Argon2id params: 64 MiB memory, 3 iterations, 4 parallelism (OWASP)
- Per-record 16-byte salt stored in ciphertext format
- v2 format: v2:<salt>:<iv>:<authTag>:<ciphertext>
- Backwards compatible: v1 records still decrypt with raw key
- Admin endpoint POST /api/credentials/migrate-v2 upgrades all v1→v2
- Added docs/FUTURE-FEATURES.md with remaining spec gaps

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-14 13:40:41 -04:00
..
prisma feat: multi-user isolation with admin/user roles 2026-03-14 12:57:38 -04:00
src feat(security): Argon2id key derivation for vault encryption 2026-03-14 13:40:41 -04:00
test feat: AES-256-GCM encryption service + auth module (JWT, guards, seed) 2026-03-12 17:07:14 -04:00
nest-cli.json feat: project scaffold — Docker, NestJS, Nuxt 3, Prisma config 2026-03-12 17:05:37 -04:00
package-lock.json feat(security): Argon2id key derivation for vault encryption 2026-03-14 13:40:41 -04:00
package.json feat(security): Argon2id key derivation for vault encryption 2026-03-14 13:40:41 -04:00
seed.js feat: multi-user isolation with admin/user roles 2026-03-14 12:57:38 -04:00
tsconfig.build.json feat: project scaffold — Docker, NestJS, Nuxt 3, Prisma config 2026-03-12 17:05:37 -04:00
tsconfig.json feat: project scaffold — Docker, NestJS, Nuxt 3, Prisma config 2026-03-12 17:05:37 -04:00