Bitwarden Secrets Manager as a secret provider via an operator-installed bws client

src/lib/server/secretproviders/bitwarden.ts

@@ -202,11 +202,10 @@ async function runBws(args: string[], limits: CommandLimits): Promise<Buffer> {
 		}
 		return await executeBws(stateDir, args, limits);
 	} finally {
-		try {
-			await rm(stateDir, { recursive: true, force: true });
-		} catch {
-			throw new BwsAdapterError('Bitwarden bws temporary state could not be removed');
-		}
+		// Swallow a cleanup failure: throwing here would mask the real error on the
+		// failure path, and turn a successful pull into a thrown error on the happy
+		// path. rm --force rarely fails; a stray temp dir is harmless residue.
+		await rm(stateDir, { recursive: true, force: true }).catch(() => undefined);
 	}
 }
 

src/lib/server/secretproviders/index.ts

@@ -19,6 +19,7 @@ import { infisicalProvider } from './infisical';
 import { vaultProvider } from './vault';
 import { dopplerProvider } from './doppler';
 import { bitwardenProvider } from './bitwarden';
+import { protonProvider } from './proton';
 
 // Registered providers. Adding a new backend means dropping a file in this
 // directory and registering it here; each implements the SecretProvider
@@ -29,7 +30,8 @@ const providers: Record<string, SecretProvider> = {
 	[infisicalProvider.type]: infisicalProvider as SecretProvider,
 	[vaultProvider.type]: vaultProvider as SecretProvider,
 	[dopplerProvider.type]: dopplerProvider as SecretProvider,
-	[bitwardenProvider.type]: bitwardenProvider as SecretProvider
+	[bitwardenProvider.type]: bitwardenProvider as SecretProvider,
+	[protonProvider.type]: protonProvider as SecretProvider
 };
 
 /** Returns the provider for a stored type, or undefined if unknown. */

src/lib/server/secretproviders/shared.ts

@@ -32,6 +32,7 @@ export type SecretProviderType =
 	| 'vault'
 	| 'doppler'
 	| 'bitwarden'
+	| 'proton'
 	// eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents
 	| (string & {});
 
@@ -137,7 +138,12 @@ export interface ConnectConfig {
  */
 export interface InfisicalConfig {
 	host: string;
-	token: string;
+	/** Static service/access token. Supply this OR clientId+clientSecret (Universal Auth). */
+	token?: string;
+	/** Universal Auth (Machine Identity) client ID. Paired with clientSecret. */
+	clientId?: string;
+	/** Universal Auth (Machine Identity) client secret. Paired with clientId. */
+	clientSecret?: string;
 	projectId: string;
 	environment?: string;
 	path?: string;
@@ -177,6 +183,15 @@ export interface BitwardenConfig {
 	serverUrl?: string;
 }
 
+/**
+ * Proton Pass: a Personal Access Token (`pst_...::...`) authenticates an
+ * operator-installed pass-cli client. Bulk pulls one vault (selected by name);
+ * inline `pass://SHARE_ID/ITEM_ID[/FIELD]` references resolve a single field.
+ */
+export interface ProtonConfig {
+	token: string;
+}
+
 /** Persisted (encrypted) config, discriminated by the provider `type`. */
 export type SecretProviderConfig =
 	| ServiceAccountConfig
@@ -184,7 +199,8 @@ export type SecretProviderConfig =
 	| InfisicalConfig
 	| VaultConfig
 	| DopplerConfig
-	| BitwardenConfig;
+	| BitwardenConfig
+	| ProtonConfig;
 
 /**
  * Config keys that hold a SECRET across every provider type. Only these are stripped
@@ -193,7 +209,7 @@ export type SecretProviderConfig =
  * a non-secret coordinate the user needs to see and edit. Keep in sync with the
  * `type: 'password'` fields in ProviderModal.svelte's PROVIDER_FIELDS.
  */
-export const SECRET_CONFIG_KEYS = new Set(['token']);
+export const SECRET_CONFIG_KEYS = new Set(['token', 'clientSecret']);
 
 /**
  * Merges an incoming (edit-form) config OVER the stored one for a write/test: the incoming