feat(security): secrets and credentials on the storage backend

crates/openhuman-cli/Cargo.toml

@@ -89,6 +89,12 @@ path = "../../tests/storage_approvals_e2e.rs"
 name = "storage_domains_e2e"
 path = "../../tests/storage_domains_e2e.rs"
 
+[[test]]
+# Its own binary: it installs a storage backend into the process-wide slot and
+# sets the keyring master-key environment.
+name = "storage_secrets_e2e"
+path = "../../tests/storage_secrets_e2e.rs"
+
 [[test]]
 name = "embedded_server_shutdown_e2e"
 path = "../../tests/embedded_server_shutdown_e2e.rs"

crates/openhuman-core/Cargo.toml

@@ -152,7 +152,7 @@ tinyagents-registry = { path = "../../vendor/tinyagents/crates/tinyagents-regist
 tinyagents-session = { path = "../../vendor/tinyagents/crates/tinyagents-session", features = ["storage-drivers"] }
 # The storage ports and the URL-to-backend facade (`storage` domain). No driver
 # by default: the `storage-*` features below add them.
-tinystoragedrivers = { path = "../../vendor/tinyagents/vendor/tinystoragedrivers/crates/tinystoragedrivers", default-features = false, features = ["blocking"] }
+tinystoragedrivers = { path = "../../vendor/tinyagents/vendor/tinystoragedrivers/crates/tinystoragedrivers", default-features = false, features = ["blocking", "secrets"] }
 tinyagents-runtime = { path = "../../vendor/tinyagents/crates/tinyagents-runtime" }
 tinyagents-orchestration = { path = "../../vendor/tinyagents/crates/tinyagents-orchestration" }
 tinyagents-tasks = { path = "../../vendor/tinyagents/crates/tinyagents-tasks" }

crates/openhuman-core/src/security/credentials/README.md

@@ -82,6 +82,17 @@ Note: `list_provider_credentials_by_prefix` and the Composio-direct/secret helpe
 - Loads migrate legacy `enc:`/`enc2:` cipher fields and promote secrets into the keychain; unrecoverable (un-decryptable / bad-`kind`) profiles are dropped rather than poisoning the whole store; unparseable files are quarantined to `auth-profiles.corrupt-<ts>.json` and reset to empty.
 - Mutations are guarded by `auth-profiles.lock` (PID-stamped). Stale/leaked/malformed locks are reclaimed by liveness + age checks to avoid the "stuck on Initializing OpenHuman" hang.
 
+### On a storage backend
+
+With a storage backend configured (`crate::storage`), `auth-profiles.json`
+and `http-credentials.json` are not written to disk: the same JSON is kept as
+one encrypted secret each (`file:auth-profiles.json`,
+`file:http-credentials.json`) in the acting agent's scope
+(`storage::secrets`), and per-profile keychain secrets go there through the
+keyring. An unparseable record is an error rather than quarantined, so a
+write never replaces profiles it could not read. Writes are last-writer-wins
+across processes; the local file lock still serializes one host.
+
 ## Dependencies
 
 - `crate::config`: `Config`, config load (`load_config_with_timeout`), user-dir activation (`default_root_openhuman_dir`, `user_openhuman_dir`, `read/write/clear_active_user`, `pre_login_user_dir`), onboarding state.

crates/openhuman-core/src/security/credentials/http_creds.rs

@@ -334,6 +334,44 @@ impl HttpCredentialsStore {
     }
 
     fn read_persisted(&self) -> Result<PersistedHttpCredentials> {
+        if let Some(secrets) = crate::storage::secrets::current()? {
+            return match crate::storage::secrets::get_blocking(&secrets, STORAGE_SECRET_NAME)? {
+                Some(bytes) => serde_json::from_slice(&bytes)
+                    .context("http-credentials record on the storage backend is not valid JSON"),
+                None => {
+                    // First use of the backend: adopt the on-disk store so
+                    // existing credentials stay visible and the next upsert
+                    // cannot replace them. The file is left in place.
+                    let legacy = self.read_file()?;
+                    if self.path.exists() && !legacy.credentials.is_empty() {
+                        let json = serde_json::to_vec(&legacy)
+                            .context("failed to serialize migrated http-credentials store")?;
+                        // A failed adoption keeps the legacy credentials
+                        // readable; the next read retries it.
+                        match crate::storage::secrets::set_blocking(
+                            &secrets,
+                            STORAGE_SECRET_NAME,
+                            &json,
+                        ) {
+                            Ok(()) => log::info!(
+                                target: "credentials",
+                                "[credentials] migrated http-credentials file to storage secret"
+                            ),
+                            Err(_) => log::warn!(
+                                target: "credentials",
+                                "[credentials] http-credentials migration to storage failed; will retry"
+                            ),
+                        }
+                    }
+                    Ok(legacy)
+                }
+            };
+        }
+        self.read_file()
+    }
+
+    /// Reads the on-disk `http-credentials.json` store (empty when absent).
+    fn read_file(&self) -> Result<PersistedHttpCredentials> {
         if !self.path.exists() {
             return Ok(PersistedHttpCredentials::default());
         }
@@ -355,6 +393,12 @@ impl HttpCredentialsStore {
     }
 
     fn write_persisted(&self, persisted: &PersistedHttpCredentials) -> Result<()> {
+        if let Some(secrets) = crate::storage::secrets::current()? {
+            let json = serde_json::to_vec(persisted)
+                .context("failed to serialize http-credentials store")?;
+            crate::storage::secrets::set_blocking(&secrets, STORAGE_SECRET_NAME, &json)?;
+            return Ok(());
+        }
         if let Some(parent) = self.path.parent() {
             fs::create_dir_all(parent).with_context(|| {
                 format!(
@@ -388,6 +432,11 @@ impl HttpCredentialsStore {
     }
 }
 
+/// The secret the store lives in on a storage backend
+/// ([`crate::storage::secrets`]): the same JSON as the file, encrypted as one
+/// secret in the acting agent's scope.
+const STORAGE_SECRET_NAME: &str = "file:http-credentials.json";
+
 fn parse_scheme(raw: &str) -> Option<HttpCredentialScheme> {
     match raw.trim().to_ascii_lowercase().as_str() {
         "bearer" => Some(HttpCredentialScheme::Bearer),

crates/openhuman-core/src/security/credentials/profiles/persistence.rs

@@ -18,6 +18,11 @@ use super::{
     PERSIST_RETRY_BASE_MS, PROFILES_FILENAME,
 };
 
+/// The secret the profiles live in on a storage backend
+/// ([`crate::storage::secrets`]): the same JSON as `auth-profiles.json`,
+/// encrypted as one secret in the acting agent's scope.
+const STORAGE_SECRET_NAME: &str = "file:auth-profiles.json";
+
 impl AuthProfilesStore {
     pub(super) fn save_locked(&self, data: &AuthProfilesData) -> Result<()> {
         let mut persisted = PersistedAuthProfiles {
@@ -114,6 +119,56 @@ impl AuthProfilesStore {
     }
 
     pub(super) fn read_persisted_locked(&self) -> Result<PersistedAuthProfiles> {
+        if let Some(secrets) = crate::storage::secrets::current()? {
+            let Some(bytes) = crate::storage::secrets::get_blocking(&secrets, STORAGE_SECRET_NAME)?
+            else {
+                // First use of the backend: adopt the profiles the on-disk
+                // store holds, so they do not vanish from reads and the next
+                // save cannot replace them with an empty set. The file is left
+                // in place (never deleted by this path).
+                let legacy = self.read_file_locked()?;
+                if self.path.exists() && !legacy.profiles.is_empty() {
+                    let json = serde_json::to_vec(&legacy)
+                        .context("Failed to serialize migrated auth profiles")?;
+                    // A failed adoption keeps the legacy profiles readable;
+                    // the next read retries it.
+                    match crate::storage::secrets::set_blocking(
+                        &secrets,
+                        STORAGE_SECRET_NAME,
+                        &json,
+                    ) {
+                        Ok(()) => tracing::info!(
+                            "[credentials] migrated auth profiles file to storage secret"
+                        ),
+                        Err(_) => tracing::warn!(
+                            "[credentials] auth profiles migration to storage failed; will retry"
+                        ),
+                    }
+                }
+                return Ok(legacy);
+            };
+            // No quarantine on a storage backend: an unparseable record is an
+            // error, so a later write can never replace profiles it could not
+            // read.
+            let mut persisted: PersistedAuthProfiles = serde_json::from_slice(&bytes)
+                .context("auth profile record on the storage backend is not valid JSON")?;
+            if persisted.schema_version == 0 {
+                persisted.schema_version = CURRENT_SCHEMA_VERSION;
+            }
+            if persisted.schema_version > CURRENT_SCHEMA_VERSION {
+                anyhow::bail!(
+                    "Unsupported auth profile schema version {} (max supported: {})",
+                    persisted.schema_version,
+                    CURRENT_SCHEMA_VERSION
+                );
+            }
+            return Ok(persisted);
+        }
+        self.read_file_locked()
+    }
+
+    /// Reads the on-disk `auth-profiles.json` store (empty when absent).
+    fn read_file_locked(&self) -> Result<PersistedAuthProfiles> {
         if !self.path.exists() {
             return Ok(PersistedAuthProfiles::default());
         }
@@ -163,6 +218,12 @@ impl AuthProfilesStore {
     }
 
     pub(super) fn write_persisted_locked(&self, persisted: &PersistedAuthProfiles) -> Result<()> {
+        if let Some(secrets) = crate::storage::secrets::current()? {
+            let json =
+                serde_json::to_vec(persisted).context("Failed to serialize auth profiles")?;
+            crate::storage::secrets::set_blocking(&secrets, STORAGE_SECRET_NAME, &json)?;
+            return Ok(());
+        }
         if let Some(parent) = self.path.parent() {
             fs::create_dir_all(parent).with_context(|| {
                 format!(

crates/openhuman-core/src/security/keyring/README.md

@@ -68,6 +68,21 @@ The workspace dir resolves from `init_workspace`, else `OPENHUMAN_WORKSPACE`, el
 
 Both file backends keep every secret in one file, so a `set` of one key rewrites all of them. That read-modify-write cycle is guarded by `file_store::lock_for_write`. An in-process mutex is not sufficient, because a desktop core, another process embedding the same core, and a `cargo test` run that inherited `OPENHUMAN_WORKSPACE` can all address the same path.
 
+### On a storage backend
+
+When the host configured a storage backend (`OPENHUMAN_STORAGE_URL` /
+`[storage] url`, see `crate::storage`), `get`, `set` and `delete` serve the
+secret from `storage::secrets` instead: one encrypted document per
+namespaced key in the acting agent's storage scope, under a per-scope key
+derived from the master key above. `is_available` reports `true` without
+probing. The app-level keys stay on the process backend: the availability
+probe, `get_or_create_random` and `migrate_from_file` (the config
+encryption key, `secretstore.master_key`) use `process_get` / `process_set` /
+`process_delete`. `backend_name` keeps naming the process backend, which is
+what the consent UI describes. The `enc2:` cipher itself is
+`tinystoragedrivers::secrets::crypto` (byte-compatible; its fixtures were
+written by this module), used by `crypto.rs` and `SecretStore`.
+
 ## Dependencies
 
 Internal openhuman/core modules: none. The keyring module's own files only `use crate::security::keyring::*` (self-internal). It is a leaf infrastructure module. External crates: `keyring`, `chacha20poly1305`, `serde_json`, `parking_lot`, `thiserror`, `anyhow`, `chrono`, `dirs`.

crates/openhuman-core/src/security/keyring/crypto.rs

@@ -3,36 +3,27 @@
 //! Used by both [`super::encrypted_store::SecretStore`] (config field encryption)
 //! and [`super::encrypted_file_backend::EncryptedFileBackend`] (secrets file encryption).
 
-use chacha20poly1305::aead::{Aead, KeyInit, OsRng};
-use chacha20poly1305::{AeadCore, ChaCha20Poly1305, Key, Nonce};
+use chacha20poly1305::aead::OsRng;
+use tinystoragedrivers::secrets::crypto as secrets_crypto;
 
 pub(super) const NONCE_LEN: usize = 12;
 pub(super) const KEY_LEN: usize = 32;
 
 /// Encrypt `plaintext` with ChaCha20-Poly1305. Returns `nonce || ciphertext || tag`.
+///
+/// The cipher is `tinystoragedrivers`' (`secrets::crypto`), the same format
+/// its secret stores read and write.
 pub(super) fn chacha20_encrypt(key: &[u8; KEY_LEN], plaintext: &[u8]) -> Result<Vec<u8>, String> {
-    let cipher = ChaCha20Poly1305::new(Key::from_slice(key));
-    let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);
-    let ciphertext = cipher
-        .encrypt(&nonce, plaintext)
-        .map_err(|e| format!("ChaCha20 encryption failed: {e}"))?;
-
-    let mut blob = Vec::with_capacity(NONCE_LEN + ciphertext.len());
-    blob.extend_from_slice(&nonce);
-    blob.extend_from_slice(&ciphertext);
-    Ok(blob)
+    secrets_crypto::encrypt(key, plaintext).map_err(|e| format!("ChaCha20 encryption failed: {e}"))
 }
 
 /// Decrypt a `nonce || ciphertext || tag` blob produced by [`chacha20_encrypt`].
 pub(super) fn chacha20_decrypt(key: &[u8; KEY_LEN], blob: &[u8]) -> Result<Vec<u8>, String> {
     if blob.len() <= NONCE_LEN {
         return Err("encrypted blob too short (missing nonce)".to_string());
     }
-    let (nonce_bytes, ciphertext) = blob.split_at(NONCE_LEN);
-    let nonce = Nonce::from_slice(nonce_bytes);
-    let cipher = ChaCha20Poly1305::new(Key::from_slice(key));
-    cipher
-        .decrypt(nonce, ciphertext)
+    secrets_crypto::decrypt(key, blob)
+        .map(|plaintext| plaintext.to_vec())
         .map_err(|_| "decryption failed — wrong key or tampered data".to_string())
 }
 

crates/openhuman-core/src/security/keyring/encrypted_file_backend.rs

@@ -45,6 +45,11 @@ type MasterKeyInit = Result<Option<[u8; KEY_LEN]>, String>;
 /// Process-wide master-key outcome, set once by [`init_master_key`].
 static MASTER_KEY: OnceLock<MasterKeyInit> = OnceLock::new();
 
+/// Set when [`init_master_key`] found the OS keychain unable to provide the
+/// key, so storage secrets reuse that outcome instead of retrying the
+/// keychain (and its prompt) on their first operation.
+static KEYCHAIN_UNAVAILABLE: OnceLock<()> = OnceLock::new();
+
 // ── Public API for core startup ──────────────────────────────────────────────
 
 /// Initialize the keyring subsystem: set the workspace directory and load
@@ -109,12 +114,53 @@ pub fn init_master_key() -> Result<(), String> {
                 // Surface the denied state to the frontend instead of silently
                 // resetting — this is the "warn before reset" the issue asks for.
                 crate::security::keyring_consent::policy::notify_master_key_unavailable(&e);
+                let _ = KEYCHAIN_UNAVAILABLE.set(());
                 Ok(None)
             }
         }
     })
 }
 
+/// The master key that encrypts secrets on a configured storage backend
+/// ([`crate::storage::secrets`]): the key [`init_master_key`] loaded when
+/// there is one, otherwise the same resolution run once for storage —
+/// [`MASTER_KEY_ENV`] / [`MASTER_KEY_FILE_ENV`] first, then the OS keychain.
+///
+/// # Errors
+///
+/// When no source can provide the key. Storage secrets then fail closed:
+/// they are never written unencrypted or under a freshly minted key that
+/// would orphan the ones already stored.
+pub(crate) fn storage_master_key() -> Result<[u8; KEY_LEN], String> {
+    // Only a loaded key is cached: a failure (locked keychain, denied prompt)
+    // is retried on the next call so secrets recover once access is restored.
+    static STORAGE_MASTER_KEY: OnceLock<[u8; KEY_LEN]> = OnceLock::new();
+    if let Some(Ok(Some(key))) = MASTER_KEY.get() {
+        return Ok(*key);
+    }
+    // `init_master_key` already tried the keychain this session and it
+    // failed: reuse that outcome, do not prompt again. (`Ok(None)` alone also
+    // means "backend needs no key / init skipped", which must still load.)
+    if KEYCHAIN_UNAVAILABLE.get().is_some() {
+        return Err("OS keychain master key unavailable this session".into());
+    }
+    if let Some(key) = STORAGE_MASTER_KEY.get() {
+        return Ok(*key);
+    }
+    match try_load_master_key() {
+        Ok((key, source)) => {
+            log::info!("[keyring:storage] master key loaded from {source}");
+            Ok(*STORAGE_MASTER_KEY.get_or_init(|| key))
+        }
+        Err(MasterKeyError::Configured(_) | MasterKeyError::Keychain(_)) => {
+            // Fixed message: the underlying error can carry a path taken
+            // from `MASTER_KEY_FILE_ENV`.
+            log::error!("[keyring:storage] master key unavailable");
+            Err("master key unavailable".into())
+        }
+    }
+}
+
 /// Runs `init` at most once per `cell` and reports its outcome on every call.
 ///
 /// A configuration error is stored in the cell rather than leaving it empty