- decryptCipher: full decrypt for Card (number/cvv/exp/brand) and Identity (all fields)
- extractSecret: type-aware output (notes for SecureNote, JSON fields for Card/Identity)
- tested: TEST_NOTE (SecureNote) and login secrets resolve by name
* Filtering feature, minor logic changes
+: Add IP validation (to properly log IP even when trusted proxy is missing)
+: Added synchronization of decrypted organization, collection, and folder names (for filtering purposes)
+: Changed sync behavior to prevent collapsing multiple logins with the same name
+: Added possibility to filter logins based on organization, collection, and folder name/id in GetSecret
+: Added support for space character in secret name validation (it is also properly URL-decoded)
* Update README
* Fixes related to issues reported by CodeRabbit:
+: Changed british use of organisations in README
+: Reduced line count in parseSecretFilters by including helper function for filter dimensions resolution
+: Added comment clarifying absence of existence checking on dimension IDs as opposed to names
+: Removed efensive comma split logic on IPs (redundant due to IPValidation setting on Fiber)
+: Changed Query validator to align with name validator (mainly removing hard-coded values)
+: Added comments to decryptVaultLabel for clarity
+: Change empty SyncNameMaps instance with emptySyncNameMaps helper for consistency
+: Add lexical sort for lookupIDByName for deterministic result in case of multiple matches
* Bumped logging to warn and added entity metadata in log
* Unit tests:
+: Added unit tests for every newly introduced or changed function
+: Rewrote NewClient constructor to accept optional preloaded data (so it can be used in test scenarios)
* Changes requested by CodeRabbit
* security: redact secret names from logs, bind port to localhost
- handlers: replace secret names in Warn/Error logs with client IP
(prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
(Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
(prevents direct access bypassing reverse proxy)
Found during security pen test of vault.turboot.com
* Enhance logging for secret retrieval and cache access
Hermes