secrets-manager/PROPOSAL.md

Project Proposal: Zero-Knowledge Secrets Manager

1. Project Overview

We are building a Zero-Knowledge Secrets Manager based on the "Thick Client, Blind Server" philosophy. The server will act as a synchronization engine for encrypted data, ensuring that it never has access to the raw secrets. Encryption and decryption will happen exclusively on the client side.

2. Requirements

Core Features

• Zero-Knowledge Architecture: Server stores only encrypted blobs.
• Secure Authentication: SRP-6a protocol for password-based authentication without sending the password to the server.
• Data Storage: PostgreSQL with Row-Level Security (RLS) to enforce access control.
• API: Node.js for auth/business logic and PostgREST for high-performance CRUD.
• Client: Cross-platform support (Tauri for Desktop, Flutter for Mobile). Note: We will initially focus on the Desktop client (Tauri).
• Infrastructure: Docker Compose for easy deployment of all services (Gateway, API, PostgREST, DB, Redis).

Technology Stack

• Backend: Node.js v24, PostgREST
• Database: PostgreSQL v18+
• Caching: Redis Cluster v8 (official alpine image)
• Frontend: Tauri (Rust + Web Frontend), Flutter
• Gateway: Nginx/Traefik
• Cryptography: Argon2id, AES-256-GCM / XChaCha20-Poly1305

3. Implementation Plan

We propose the following step-by-step approach to build the system:

Phase 1: Foundation & Infrastructure

1. Repository Setup: Initialize git and project structure.
2. Infrastructure: Create docker-compose.yaml with all required services (Postgres, Redis, Node.js, PostgREST, Nginx).
3. Database Design: Define SQL schema for users, secrets, and access_policies. Implement RLS policies.

Phase 2: Backend Core

4. Authentication Service: Implement the Node.js service with SRP-6a for user registration and login.
5. PostgREST Integration: Configure PostgREST to work with the JWTs issued by the Auth service.
6. API Logic: Implement endpoints for secret rotation jobs and webhooks (if applicable at this stage).

Phase 3: Client Development (Tauri)

7. Client Scaffold: Set up the Tauri project.
8. Cryptography Layer: Implement client-side encryption/decryption (Rust/WASM).
9. Auth Integration: Connect client to the SRP-6a auth flow.
10. Secrets Management: Implement UI for adding, viewing, and syncing secrets.

Phase 4: Polish & Verification

11. Testing: Verify end-to-end flows (Auth -> Sync -> Decrypt).
12. Documentation: Update docs/ and activity.log.
13. Security Review: fast audit of the implemented flows.

4. Questions & Clarifications

• Frontend Preference: Should we prioritize the Tauri desktop app or the Flutter mobile app first? (Assumed Tauri for now).
• Domain/Network: Do you have specific domain names or IP addresses for the extensive deployment, or is localhost sufficient for this development phase?
• Secrets: Do you have any specific secrets management constraints or compliance requirements not mentioned?

5. Next Steps

Upon approval of this proposal, we will begin with Phase 1: Foundation & Infrastructure.