Danijel Martinek
c990e1b871
Workspaces Payload collection with the PAT as a write-only field: access.read () => false strips it from every access-controlled read path, and a field-level beforeChange hook encrypts on write with AES-256-GCM (scrypt key from VEECT_SECRET, random per-value salt + IV, v1 storage format) via node:crypto only. The real repository replaces the phase-1 stub with payload create/findByID; toDomain never maps the credential, and getDecryptedCredential(id) is the single server-side decrypt path for the runner handoff (story 07). Contract suite now covers create, write-only behaviour, and the decrypt path against both the mock and the Payload impl (stub runs the real collection hooks). Missing VEECT_SECRET fails production bind/boot with an actionable message; dev-seed boots without it. Env declared in turbo.json globalEnv + .env.example. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
19 lines
524 B
YAML
19 lines
524 B
YAML
# compliance/retention-policy.yml — Collection retention schedules
|
|
# Generated by scripts/compliance/emit-retention-policy.mjs — do not edit manually.
|
|
# Run `pnpm compliance:retention-policy` to regenerate.
|
|
collections:
|
|
users:
|
|
postDeletion:
|
|
action: hard-delete
|
|
duration: P30D
|
|
trigger: after-deletion
|
|
purgeSchedule: daily
|
|
slug: users
|
|
workspaces:
|
|
postDeletion:
|
|
action: hard-delete
|
|
duration: P30D
|
|
trigger: after-deletion
|
|
purgeSchedule: daily
|
|
slug: workspaces
|