Encrypt values to the vault's Kernel key instead of per-request keys

Author: rgarcia

.env.example

@@ -8,11 +8,6 @@ MOCK_VAULT=true
 KERNEL_API_KEY=
 # KERNEL_API_BASE_URL=https://api.onkernel.com
 
-# Required in BOTH mock and real mode. Server-only; never use a NEXT_PUBLIC_ variable.
-# Generate 32 random bytes as base64 once (see README); use the same key for CLI and server.
-# Keep outside the request store. Production should use KMS/HSM-backed key wrapping.
-COLLECTION_KEY_WRAPPING_KEY=
-
-# Local links and wrapped per-request private keys are written to .data/credential-requests.json.
+# Local links are written to .data/credential-requests.json.
 # Replace FileCollectionRequestStore with your database in production.
 COLLECTION_REQUEST_TTL_MINUTES=15

README.md

@@ -9,7 +9,7 @@ import {
   type CredentialItem,
 } from '@onkernel/vault-react';
 import { readCollectionToken } from '@/lib/collection-token';
-import { encryptSubmission, type CollectionEncryption } from '@/lib/credential-envelope';
+import { encryptSubmission, type VaultEncryptionKey } from '@/lib/encrypted-submission';
 
 const endpoint = '/api/credential-requests/current';
 const errorCodes = new Set<CollectionErrorCode>([
@@ -44,10 +44,7 @@ export function CollectionPage() {
 }
 
 function RequestForm({ token }: { token: string }) {
-  const [collection, setCollection] = useState<{
-    item: CredentialItem;
-    encryption: CollectionEncryption;
-  }>();
+  const [collection, setCollection] = useState<{ item: CredentialItem; key: VaultEncryptionKey }>();
   const [failure, setFailure] = useState<CollectionErrorCode>();
   const authorization = `Bearer ${token}`;
 
@@ -61,12 +58,10 @@ function RequestForm({ token }: { token: string }) {
     })
       .then(async (response) => {
         if (!response.ok) throw new CredentialFormError(await responseError(response, 'unavailable'));
-        const data = await response.json();
-        const item = safeCredentialItem(data.item);
-        if (data.encryption.itemId !== item.id || data.encryption.version !== item.version) {
-          throw new CredentialFormError('unavailable');
-        }
-        if (!controller.signal.aborted) setCollection({ item, encryption: data.encryption });
+        const body = await response.json();
+        const item = safeCredentialItem(body.item);
+        const key = vaultEncryptionKey(body.encryption_key);
+        if (!controller.signal.aborted) setCollection({ item, key });
       })
       .catch((error: unknown) => {
         if (!controller.signal.aborted) {
@@ -91,13 +86,12 @@ function RequestForm({ token }: { token: string }) {
       item={collection.item}
       submitLabel="Save credentials"
       onSubmit={async (submission) => {
-        const envelope = await encryptSubmission(submission, collection.encryption);
         const response = await fetch(endpoint, {
           method: 'PATCH',
           credentials: 'omit',
           cache: 'no-store',
-          headers: { Authorization: authorization, 'Content-Type': 'application/jose' },
-          body: envelope,
+          headers: { Authorization: authorization, 'Content-Type': 'application/json' },
+          body: JSON.stringify(await encryptSubmission(submission, collection.key)),
         });
         if (!response.ok) {
           throw new CredentialFormError(await responseError(response, 'unavailable'));
@@ -108,6 +102,20 @@ function RequestForm({ token }: { token: string }) {
   );
 }
 
+function vaultEncryptionKey(value: unknown): VaultEncryptionKey {
+  const key = value as VaultEncryptionKey | undefined;
+  if (
+    typeof key?.kid !== 'string' ||
+    key.jwk?.kty !== 'EC' ||
+    key.jwk.crv !== 'P-256' ||
+    typeof key.jwk.x !== 'string' ||
+    typeof key.jwk.y !== 'string'
+  ) {
+    throw new CredentialFormError('unavailable');
+  }
+  return { kid: key.kid, jwk: { kty: 'EC', crv: 'P-256', x: key.jwk.x, y: key.jwk.y } };
+}
+
 function Message({ children }: { children: React.ReactNode }) {
   return <p role="alert">{children}</p>;
 }

app/credentials/collect/collection-page.tsx

@@ -6,7 +6,7 @@ export default function Page() {
       <section className="collection-card">
         <p className="eyebrow">Secure credential request</p>
         <h1>Connect your account</h1>
-        <p className="intro">Your credentials are sent directly to the application that requested them.</p>
+        <p className="intro">Your credentials are encrypted in this page. Only Kernel can decrypt them.</p>
         <CollectionPage />
       </section>
     </main>

app/credentials/collect/page.tsx

@@ -1,16 +1,17 @@
-import { safeCredentialItem, type CredentialSubmission } from '@onkernel/vault-react/data';
+import { safeCredentialItem } from '@onkernel/vault-react/data';
+import type { EncryptedSubmission } from './encrypted-submission';
 import type { CollectionRequestStore } from './request-store';
 import { collectionTokenDigest } from './server-token';
-import { decryptSubmission, keyBinding } from './collection-keys';
-import { MAX_ENVELOPE_BYTES } from './credential-envelope';
-import type { PrivateKeyProtector } from './private-key-protector';
 import {
   VaultConflictError,
   VaultInvalidRequestError,
   type CredentialVaultClient,
 } from './vault-client';
 
 const bearerPattern = /^Bearer ([A-Za-z0-9_-]{43})$/;
+// Compact JWE: five base64url segments. Kernel rejects anything it cannot decrypt.
+const compactJwePattern = /^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]*){4}$/;
+const maxEncryptedValueLength = 24 * 1024;
 
 function json(body: unknown, status = 200) {
   return Response.json(body, {
@@ -19,7 +20,7 @@ function json(body: unknown, status = 200) {
   });
 }
 
-async function readEnvelope(request: Request): Promise<string> {
+async function readJson(request: Request): Promise<unknown> {
   const reader = request.body?.getReader();
   if (!reader) throw new Error('invalid request');
   const chunks: Uint8Array[] = [];
@@ -29,7 +30,7 @@ async function readEnvelope(request: Request): Promise<string> {
       const { done, value } = await reader.read();
       if (done) break;
       size += value.byteLength;
-      if (size > MAX_ENVELOPE_BYTES) {
+      if (size > 128 * 1024) {
         await reader.cancel();
         throw new Error('invalid request');
       }
@@ -44,69 +45,51 @@ async function readEnvelope(request: Request): Promise<string> {
     body.set(chunk, offset);
     offset += chunk.byteLength;
   }
-  return new TextDecoder('utf-8', { fatal: true }).decode(body);
+  return JSON.parse(new TextDecoder().decode(body));
 }
 
 export function createCollectionHandler({
   appOrigin,
   store,
   vault,
-  protector,
   now = Date.now,
 }: {
   appOrigin: string;
   store: CollectionRequestStore;
   vault: CredentialVaultClient;
-  protector: PrivateKeyProtector;
   now?: () => number;
 }) {
   const trustedOrigin = new URL(appOrigin).origin;
-  // Local-only serialization. Production needs a durable, distributed request claim.
-  const submitting = new Set<string>();
 
   return async (request: Request): Promise<Response> => {
-    let claimedDigest: string | undefined;
     try {
       if (!['GET', 'PATCH'].includes(request.method)) return json({ code: 'invalid' }, 405);
       const bearer = bearerPattern.exec(request.headers.get('Authorization') ?? '')?.[1];
       if (!bearer) return json({ code: 'unavailable' }, 401);
 
       const digest = collectionTokenDigest(bearer);
-      if (request.method === 'PATCH') {
-        if (request.headers.get('Origin') !== trustedOrigin) return json({ code: 'unavailable' }, 403);
-        if (submitting.has(digest)) return json({ code: 'unavailable' }, 409);
-        submitting.add(digest);
-        claimedDigest = digest;
-      }
       const mapping = await store.findByTokenDigest(digest);
       if (!mapping) return json({ code: 'unavailable' }, 404);
       if (mapping.revokedAt !== null) return json({ code: 'unavailable' }, 410);
       if (mapping.consumedAt !== null) return json({ code: 'consumed' }, 410);
       if (mapping.expiresAt <= now()) return json({ code: 'expired' }, 410);
+      if (request.method === 'PATCH' && request.headers.get('Origin') !== trustedOrigin) {
+        return json({ code: 'unavailable' }, 403);
+      }
 
       const item = safeCredentialItem(await vault.retrieve(mapping));
       if (item.id !== mapping.itemId) return json({ code: 'unavailable' }, 404);
       if (request.method === 'GET') {
-        const { x, y } = mapping.key.publicKey;
-        return json({
-          item,
-          encryption: {
-            ...keyBinding(mapping),
-            version: item.version,
-            publicKey: { kty: 'EC', crv: 'P-256', x, y },
-          },
-        });
+        const { kid, jwk } = await vault.encryptionKey(mapping);
+        return json({ item, encryption_key: { kid, jwk } });
       }
-      if (request.headers.get('Content-Type')?.split(';')[0].trim() !== 'application/jose') {
+      if (!request.headers.get('Content-Type')?.startsWith('application/json')) {
         return json({ code: 'invalid' }, 400);
       }
 
       let body: unknown;
-      let boundVersion: number;
       try {
-        const decrypted = await decryptSubmission(await readEnvelope(request), mapping, protector);
-        body = decrypted.submission;
-        boundVersion = decrypted.version;
+        body = await readJson(request);
       } catch {
         return json({ code: 'invalid' }, 400);
       }
@@ -115,7 +98,6 @@ export function createCollectionHandler({
       }
       const input = body as Record<string, unknown>;
       if (
-        input.version !== boundVersion ||
         !Number.isSafeInteger(input.version) ||
         Number(input.version) < 1 ||
         !input.fields ||
@@ -133,21 +115,19 @@ export function createCollectionHandler({
         if (!field || field.type === 'totp' || !edit || typeof edit !== 'object' || Array.isArray(edit)) {
           return json({ code: 'invalid' }, 400);
         }
+        // Plaintext values are rejected: this backend only ever relays ciphertext or a clear.
         const replacement = edit as Record<string, unknown>;
-        if (
-          Object.keys(replacement).length !== 1 ||
-          !Object.hasOwn(replacement, 'value') ||
-          (replacement.value === null && field.required) ||
-          (replacement.value !== null &&
-            (typeof replacement.value !== 'string' ||
-              replacement.value.length === 0 ||
-              new TextEncoder().encode(replacement.value).length > 16 * 1024))
-        ) {
+        const encrypted = replacement.encrypted_value;
+        const clear = Object.hasOwn(replacement, 'value') && replacement.value === null && !field.required;
+        const ciphertext = typeof encrypted === 'string' &&
+          encrypted.length <= maxEncryptedValueLength &&
+          compactJwePattern.test(encrypted);
+        if (Object.keys(replacement).length !== 1 || !(clear || ciphertext)) {
           return json({ code: 'invalid' }, 400);
         }
       }
 
-      const submission = input as CredentialSubmission;
+      const submission = input as EncryptedSubmission;
       if (submission.version !== item.version) return json({ code: 'stale' }, 409);
       if (!entries.length) {
         await store.markConsumed(digest, now());
@@ -156,18 +136,15 @@ export function createCollectionHandler({
 
       try {
         const updated = safeCredentialItem(await vault.update(mapping, submission));
-        if (updated.id !== mapping.itemId) throw new Error('unexpected vault item');
         await store.markConsumed(digest, now());
-        return json({ saved: true });
+        return json(updated);
       } catch (error) {
         if (error instanceof VaultConflictError) return json({ code: 'stale' }, 409);
         if (error instanceof VaultInvalidRequestError) return json({ code: 'invalid' }, 400);
         throw error;
       }
     } catch {
       return json({ code: 'unavailable' }, 502);
-    } finally {
-      if (claimedDigest) submitting.delete(claimedDigest);
     }
   };
 }