feature: the credential store keeps credentials of any kind in config.json with encrypted secrets, with its routes and its dialog.

shared/credentials.ts

@@ -0,0 +1,49 @@
+// The types of a credential store that the server helpers and the web dialog share.
+
+/**
+ * A field of a kind of credential, by its key in config.json: text, a port number, a GUID or one of choices. A
+ * required field must be set; a secret field is kept encrypted, never answered, and may be left out.
+ */
+export type CredentialField = {
+  key: string
+  label: string
+  help: string
+  type: 'text' | 'port' | 'guid' | 'choice'
+  choices?: string[]
+  required: boolean
+  secret: boolean
+}
+
+/** A kind of credential, such as a database connection or a service principal, with its fields. */
+export type CredentialKind = {
+  kind: string
+  label: string
+  fields: CredentialField[]
+}
+
+/**
+ * A credential as the dialog edits it. original is the name it was read with, null for a new one. values holds the
+ * fields that are not secret, as text. secrets holds the secret fields: read answers null for each; a write sends
+ * null to keep the secret of original, '' for none, or the new secret. stored tells which secrets are kept.
+ */
+export type CredentialProfile = {
+  original: string | null
+  name: string
+  kind: string
+  values: Record<string, string>
+  secrets: Record<string, string | null>
+  stored: Record<string, boolean>
+}
+
+/** The read answer of a credential store and of a write: its credentials, kinds and the names it does not allow. */
+export type CredentialsDocument = {
+  /** Identifies the content of config.json; a write sends it back and is refused with 409 when the file changed since. */
+  version: string
+  value: CredentialProfile[]
+  /** The path of config.json. */
+  path: string
+  /** Whether ENCRYPTION_KEY or ENCRYPTION_KEY_FILE gives the server a key, which a secret needs. */
+  encryption: boolean
+  kinds: CredentialKind[]
+  reserved: string[]
+}