kms

Overview ¶

Package kms is the Fiber-facing subsystem that exposes the embedded luxfi/kms secrets-manager as /v1/kms/* on the unified Hanzo Cloud binary (HIP-0106).

It re-declares luxfi/kms's REST surface (cmd/kms is package main with no mountable handler) on cloud's Fiber app, backed by the SAME embedded SecretStore the in-process cloud.KMSClient uses (clients/kmsembed.Client, built in build.go and handed through deps.KMS), and gated by cloud's ONE auth boundary (SanitizeIdentity → c.Org()/c.IsAdmin()) — never a parallel JWT stack.

GET    /v1/kms/health                 — real probe (503 in health-only mode); public
GET    /v1/kms/config                 — SPA runtime config;                    public
GET    /v1/kms/orgs/:org/secrets      — list a path's secret metadata;         JWT, org-scoped
GET    /v1/kms/orgs/:org/secrets/*    — read one secret value;                 JWT, org-scoped
POST   /v1/kms/orgs/:org/secrets      — upsert a secret (sealed);              JWT, org-scoped
DELETE /v1/kms/orgs/:org/secrets/*    — delete a secret;                       JWT, org-scoped

ORG SCOPING — {org} must equal the caller's validated org (c.Org()); a global admin (c.IsAdmin()) may act on any org. The org is folded into the store PATH as /orgs/{org}{subpath}, so one org can never address another org's records. This mirrors clients/paassvc and clients/admin.