Danijel Martinek
c990e1b871
Workspaces Payload collection with the PAT as a write-only field: access.read () => false strips it from every access-controlled read path, and a field-level beforeChange hook encrypts on write with AES-256-GCM (scrypt key from VEECT_SECRET, random per-value salt + IV, v1 storage format) via node:crypto only. The real repository replaces the phase-1 stub with payload create/findByID; toDomain never maps the credential, and getDecryptedCredential(id) is the single server-side decrypt path for the runner handoff (story 07). Contract suite now covers create, write-only behaviour, and the decrypt path against both the mock and the Payload impl (stub runs the real collection hooks). Missing VEECT_SECRET fails production bind/boot with an actionable message; dev-seed boots without it. Env declared in turbo.json globalEnv + .env.example. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
28 lines
732 B
YAML
28 lines
732 B
YAML
# compliance/data-map.yml — PII field inventory
|
|
# Generated by scripts/compliance/emit-data-map.mjs — do not edit manually.
|
|
# Run `pnpm compliance:data-map` to regenerate.
|
|
collections:
|
|
users:
|
|
auth: true
|
|
piiFields:
|
|
- category: identification-username
|
|
exportable: true
|
|
field: displayName
|
|
purpose:
|
|
- service-delivery
|
|
restrictable: true
|
|
source: field-tag
|
|
- category: contact-email
|
|
exportable: true
|
|
field: email
|
|
purpose:
|
|
- account-authentication
|
|
- transactional-notifications
|
|
restrictable: true
|
|
source: auth-default
|
|
slug: users
|
|
workspaces:
|
|
auth: false
|
|
piiFields: []
|
|
slug: workspaces
|