SecretController.php

<?php

namespace STS\Keep\Server\Controllers;

use Exception;
use STS\Keep\Data\Collections\FilterCollection;
use STS\Keep\Validation\SecretKeyValidator;

class SecretController extends ApiController
{
    public function list(): array
    {
        $vault = $this->getVault();
        $secrets = $vault->list();
        
        return $this->success([
            'secrets' => $secrets->toApiArray($this->isUnmasked())
        ]);
    }

    public function get(string $key): array
    {
        $vault = $this->getVault();
        $secret = $vault->get(urldecode($key));
        
        if (!$secret) {
            return $this->error('Secret not found', 404);
        }
        
        return $this->success([
            'secret' => $secret->toApiArray($this->isUnmasked())
        ]);
    }

    public function create(): array
    {
        if ($error = $this->requireFields(['key', 'value', 'vault', 'env'])) {
            return $error;
        }
        
        try {
            $vault = $this->getVault();
            $vault->set($this->body['key'], $this->body['value']);
        } catch (\InvalidArgumentException $e) {
            return $this->error($e->getMessage());
        }
        
        return $this->success([
            'success' => true,
            'message' => "Secret '{$this->body['key']}' created in vault '{$this->body['vault']}' environment '{$this->body['env']}'"
        ]);
    }

    public function update(string $key): array
    {
        if ($error = $this->requireFields(['value', 'vault', 'env'])) {
            return $error;
        }
        
        $vault = $this->getVault();
        $vault->set(urldecode($key), $this->body['value']);
        
        return $this->success([
            'success' => true,
            'message' => "Secret '{$key}' updated in vault '{$this->body['vault']}' environment '{$this->body['env']}'"
        ]);
    }

    public function delete(string $key): array
    {
        if ($error = $this->requireFields(['vault', 'env'])) {
            return $error;
        }
        
        $vault = $this->getVault();
        $decodedKey = urldecode($key);
        
        try {
            $vault->delete($decodedKey);
        } catch (\STS\Keep\Exceptions\SecretNotFoundException $e) {
            // For verify test keys, provide a more helpful error message
            if (str_starts_with($decodedKey, '__keep_verify_') || str_starts_with($decodedKey, 'keep-verify-')) {
                throw new \STS\Keep\Exceptions\SecretNotFoundException(
                    "Test key '{$decodedKey}' not found. This may be an orphaned verification key. " .
                    "It might have been created in a different namespace or environment context."
                );
            }
            throw $e;
        }
        
        return $this->success([
            'success' => true,
            'message' => "Secret '{$key}' deleted"
        ]);
    }

    public function search(): array
    {
        $q = $this->getParam('q', '');
        
        if (empty($q)) {
            return $this->error('Missing search query');
        }
        
        $vault = $this->getVault();
        $secrets = $vault->list();
        
        $results = $secrets->filter(function($secret) use ($q) {
            return stripos($secret->value(), $q) !== false ||
                   stripos($secret->key(), $q) !== false;
        });
        
        return $this->success([
            'secrets' => $results->map(fn($secret) => array_merge(
                $secret->toApiArray($this->isUnmasked()),
                ['match' => stripos($secret->value(), $q) !== false ? 'value' : 'key']
            ))->values()->toArray()
        ]);
    }

    public function rename(string $oldKey): array
    {
        if ($error = $this->requireFields(['newKey', 'vault', 'env'])) {
            return $error;
        }

        $newKey = $this->body['newKey'];
        if ($oldKey === $newKey) {
            return $this->error('New key must be different from old key');
        }

        $validator = new SecretKeyValidator();
        try {
            $validator->validate($newKey);
        } catch (\InvalidArgumentException $e) {
            return $this->error($e->getMessage());
        }

        $vault = $this->getVault();
        $vault->rename(urldecode($oldKey), $newKey);

        return $this->success([
            'success' => true,
            'message' => "Secret renamed from '{$oldKey}' to '{$newKey}'"
        ]);
    }

    public function copyToEnv(string $key): array
    {
        if ($error = $this->requireFields(['targetEnv'])) {
            return $error;
        }
        
        $targetEnv = $this->body['targetEnv'];
        
        // Get source vault (from vault/env query params or body)
        $sourceVault = $this->getVault();
        
        // Get the secret from source
        try {
            $secret = $sourceVault->get(urldecode($key));
            if (!$secret) {
                return $this->error('Secret not found', 404);
            }
        } catch (\Exception $e) {
            return $this->error('Secret not found', 404);
        }
        
        // Get the target vault (can be different vault)
        $targetVaultName = $this->getParam('targetVault', $this->getParam('vault', $this->manager->getDefaultVault()));
        $targetVault = $this->manager->vault($targetVaultName, $targetEnv);
        
        // Copy to target
        $targetVault->set(urldecode($key), $secret->value());
        
        return $this->success([
            'success' => true,
            'message' => "Secret '{$key}' copied to {$targetVaultName}:{$targetEnv}"
        ]);
    }

    public function history(string $key): array
    {
        $vault = $this->getVault();
        $limit = (int)$this->getParam('limit', 10);
        
        try {
            $historyCollection = $vault->history(urldecode($key), new FilterCollection(), $limit);

            if (!$this->isUnmasked()) {
                $historyCollection = $historyCollection->withMaskedValues();
            }
            
            $history = $historyCollection->map(function($entry) {
                return [
                    'version' => $entry->version(),
                    'value' => $entry->value() ?? null,
                    'dataType' => $entry->dataType(),
                    'modifiedDate' => $entry->formattedDate(),
                    'modifiedBy' => $entry->lastModifiedUser() ?? 'unknown',
                    'timestamp' => $entry->lastModifiedDate()?->toISOString()
                ];
            })->toArray();
            
            return $this->success([
                'history' => $history,
                'key' => urldecode($key),
                'vault' => $this->query['vault'] ?? $this->manager->getDefaultVault(),
                'env' => $this->query['env']
            ]);
        } catch (\Exception $e) {
            return $this->error('Failed to retrieve history: ' . $e->getMessage());
        }
    }
    
    /**
     * Get validation rules for secret keys.
     * This endpoint provides the rules to the frontend for client-side validation.
     */
    public function validationRules(): array
    {
        return $this->success([
            'rules' => (new SecretKeyValidator)->getValidationRules()
        ]);
    }
}