fix vault 403 + shared secrets (v1.21.0)

- vault_broker: always reconcile policy content before serving a cached
  token (compare-and-skip), so stale stored policies can't cause a recurring
  403 'permission denied'; policy content is parsed live by OpenBao, so edits
  apply to existing tokens immediately.
- Shared secrets: publish to secret/shared/<owner>/<slug>; grant read to users
  and apps by editing the grantee's policy content (live-applied). New
  SharedSecret/SharedSecretGrant ORM models, /api/shared-secrets router, and a
  Shared tab in the vault UI.
- package.json + lockfile bumped to 1.21.0 to match the tag.

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/views/vault.ejs

@@ -6,6 +6,7 @@
     <ul class="nav nav-pills" id="vault-tabs">
       <li class="nav-item"><button class="nav-link active" data-bs-toggle="pill" data-bs-target="#tab-secrets" type="button">Secrets</button></li>
       <li class="nav-item" id="vault-apps-tab" style="display:none"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#tab-apps" type="button">Apps</button></li>
+      <li class="nav-item"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#tab-shared" type="button">Shared</button></li>
     </ul>
   </div>
 
@@ -83,6 +84,101 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
         </div>
       </div>
     </div>
+
+    <!-- ── Shared tab ─────────────────────────────────────────────────── -->
+    <div class="tab-pane fade" id="tab-shared">
+      <div class="row">
+        <div class="col-md-6">
+          <div class="card shadow-sm">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
+              <h5 class="card-title mb-0">My shared secrets</h5>
+              <button class="btn btn-sm btn-primary" onclick="showCreateSharedModal()"><i class="fas fa-plus"></i> New</button>
+            </div>
+            <div class="list-group list-group-flush" id="shared-mine-list">
+              <div class="list-group-item text-center text-muted">Loading...</div>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-6">
+          <div class="card shadow-sm">
+            <div class="card-header bg-light"><h5 class="card-title mb-0">Shared with me</h5></div>
+            <div class="list-group list-group-flush" id="shared-granted-list">
+              <div class="list-group-item text-center text-muted">Loading...</div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Create Shared Secret Modal -->
+<div class="modal fade" id="sharedCreateModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title">New Shared Secret</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="mb-3">
+          <label class="form-label">Name (slug)</label>
+          <input type="text" class="form-control" id="shared-slug-input" placeholder="e.g. db-creds">
+        </div>
+        <div class="mb-3">
+          <label class="form-label">Description</label>
+          <input type="text" class="form-control" id="shared-desc-input" placeholder="optional">
+        </div>
+        <div class="mb-3">
+          <label class="form-label">Secret Data (JSON)</label>
+          <textarea class="form-control" id="shared-data-input" rows="6" style="font-family: monospace;">{
+  "key": "value"
+}</textarea>
+        </div>
+        <div class="alert alert-danger d-none" id="shared-create-error"></div>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+        <button type="button" class="btn btn-primary" onclick="saveSharedSecret()">Create</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Manage Grants Modal -->
+<div class="modal fade" id="sharedGrantsModal" tabindex="-1">
+  <div class="modal-dialog modal-lg">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title">Share</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="row g-2 mb-3">
+          <div class="col-4"><select class="form-select" id="grant-type-input"><option value="user">User</option><option value="app">App</option></select></div>
+          <div class="col-5"><input class="form-control" id="grant-id-input" placeholder="uid or app name"></div>
+          <div class="col-3"><button class="btn btn-primary w-100" onclick="addGrant()">Grant</button></div>
+        </div>
+        <div class="alert alert-danger d-none" id="grants-error"></div>
+        <div class="list-group" id="grants-list"><div class="list-group-item text-muted">No grants yet.</div></div>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- View Shared Secret Modal -->
+<div class="modal fade" id="sharedViewModal" tabindex="-1">
+  <div class="modal-dialog modal-lg">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="shared-view-title">Secret</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body"><pre id="shared-view-content" class="bg-dark text-light p-3 rounded" style="min-height: 200px;"></pre></div>
+    </div>
   </div>
 </div>
 
@@ -307,6 +403,151 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
     navigator.clipboard.writeText(text).then(() => app.messages.toast('Copied', 'success'));
   }
 
+  // ── Shared secrets tab ──────────────────────────────────────────────
+  let currentShared = null;
+  const sharedCreateModal = new bootstrap.Modal(document.getElementById('sharedCreateModal'));
+  const sharedGrantsModal = new bootstrap.Modal(document.getElementById('sharedGrantsModal'));
+  const sharedViewModal = new bootstrap.Modal(document.getElementById('sharedViewModal'));
+
+  function sharedApi(path, method = 'GET', body = null) {
+    const opts = { method, headers: { 'Content-Type': 'application/json', 'auth-token': app.auth.getToken() } };
+    if (body) opts.body = JSON.stringify(body);
+    return fetch('/api/shared-secrets' + path, opts).then(async res => {
+      if (res.status === 404) return null;
+      if (!res.ok) { const t = await res.text(); throw new Error(`${res.status} ${t}`); }
+      if (res.status === 204) return null;
+      return res.json();
+    });
+  }
+
+  async function loadShared() {
+    try {
+      const res = await sharedApi('/');
+      const items = (res && res.items) || [];
+      renderSharedMine(items.filter(i => i.role === 'owner'));
+      renderSharedGranted(items.filter(i => i.role === 'grantee'));
+    } catch (err) {
+      document.getElementById('shared-mine-list').innerHTML =
+        `<div class="list-group-item text-danger">Error: ${err.message}</div>`;
+    }
+  }
+
+  function renderSharedMine(items) {
+    const el = document.getElementById('shared-mine-list');
+    if (!items.length) { el.innerHTML = '<div class="list-group-item text-center text-muted">No shared secrets yet</div>'; return; }
+    el.innerHTML = '';
+    items.forEach(s => {
+      const row = document.createElement('div');
+      row.className = 'list-group-item d-flex justify-content-between align-items-center';
+      row.innerHTML = `<div><i class="fas fa-share-alt text-secondary me-2"></i><strong>${s.slug}</strong><div class="small text-muted">${s.path}</div></div>
+        <div class="btn-group">
+          <button class="btn btn-sm btn-outline-primary" onclick="openGrants('${s.id}')"><i class="fas fa-users"></i> Share</button>
+          <button class="btn btn-sm btn-outline-danger" onclick="deleteShared('${s.id}')"><i class="fas fa-trash"></i></button>
+        </div>`;
+      el.appendChild(row);
+    });
+  }
+
+  function renderSharedGranted(items) {
+    const el = document.getElementById('shared-granted-list');
+    if (!items.length) { el.innerHTML = '<div class="list-group-item text-center text-muted">Nothing shared with you yet</div>'; return; }
+    el.innerHTML = '';
+    items.forEach(s => {
+      const row = document.createElement('a');
+      row.href = '#';
+      row.className = 'list-group-item list-group-item-action d-flex align-items-center';
+      row.innerHTML = `<i class="fas fa-key text-secondary me-3"></i><span>${s.slug}</span><small class="text-muted ms-auto">by ${s.ownerUid}</small>`;
+      row.onclick = (e) => { e.preventDefault(); viewShared(s); };
+      el.appendChild(row);
+    });
+  }
+
+  function showCreateSharedModal() {
+    currentShared = null;
+    document.getElementById('shared-slug-input').value = '';
+    document.getElementById('shared-desc-input').value = '';
+    document.getElementById('shared-data-input').value = '{\n  "key": "value"\n}';
+    document.getElementById('shared-create-error').classList.add('d-none');
+    sharedCreateModal.show();
+  }
+
+  async function saveSharedSecret() {
+    const err = document.getElementById('shared-create-error');
+    err.classList.add('d-none');
+    let data;
+    try { data = JSON.parse(document.getElementById('shared-data-input').value); }
+    catch (e) { err.textContent = 'Invalid JSON: ' + e.message; err.classList.remove('d-none'); return; }
+    try {
+      await sharedApi('/', 'POST', {
+        slug: document.getElementById('shared-slug-input').value.trim(),
+        description: document.getElementById('shared-desc-input').value.trim(),
+        data
+      });
+      sharedCreateModal.hide();
+      await loadShared();
+    } catch (e) { err.textContent = e.message; err.classList.remove('d-none'); }
+  }
+
+  async function viewShared(s) {
+    document.getElementById('shared-view-title').textContent = s.slug + ' (by ' + s.ownerUid + ')';
+    document.getElementById('shared-view-content').textContent = 'Loading...';
+    sharedViewModal.show();
+    try {
+      const res = await apiCall('GET', 'secret/data/' + s.path);
+      document.getElementById('shared-view-content').textContent =
+        (res && res.data && res.data.data) ? JSON.stringify(res.data.data, null, 2) : 'No data found.';
+    } catch (e) {
+      document.getElementById('shared-view-content').textContent = 'Error: ' + e.message;
+    }
+  }
+
+  async function openGrants(id) {
+    currentShared = id;
+    document.getElementById('grants-error').classList.add('d-none');
+    document.getElementById('grant-id-input').value = '';
+    sharedGrantsModal.show();
+    try {
+      const res = await sharedApi('/' + id + '/grants');
+      const grants = (res && res.grants) || [];
+      const el = document.getElementById('grants-list');
+      el.innerHTML = '';
+      if (!grants.length) el.innerHTML = '<div class="list-group-item text-muted">No grants yet.</div>';
+      grants.forEach(g => {
+        const row = document.createElement('div');
+        row.className = 'list-group-item d-flex justify-content-between align-items-center';
+        row.innerHTML = `<span><span class="badge bg-secondary me-2">${g.granteeType}</span>${g.granteeId}</span>
+          <button class="btn btn-sm btn-outline-danger" onclick="revokeGrant('${g.id}')"><i class="fas fa-times"></i></button>`;
+        el.appendChild(row);
+      });
+    } catch (e) {
+      document.getElementById('grants-list').innerHTML = `<div class="list-group-item text-danger">${e.message}</div>`;
+    }
+  }
+
+  async function addGrant() {
+    const err = document.getElementById('grants-error');
+    err.classList.add('d-none');
+    try {
+      await sharedApi('/' + currentShared + '/grants', 'POST', {
+        granteeType: document.getElementById('grant-type-input').value,
+        granteeId: document.getElementById('grant-id-input').value.trim()
+      });
+      document.getElementById('grant-id-input').value = '';
+      openGrants(currentShared);
+    } catch (e) { err.textContent = e.message; err.classList.remove('d-none'); }
+  }
+
+  async function revokeGrant(grantId) {
+    try { await sharedApi('/' + currentShared + '/grants/' + grantId, 'DELETE'); openGrants(currentShared); }
+    catch (e) { app.messages.toast('Error revoking: ' + e.message, 'danger'); }
+  }
+
+  async function deleteShared(id) {
+    if (!confirm('Delete this shared secret? Grantees will immediately lose access.')) return;
+    try { await sharedApi('/' + id, 'DELETE'); await loadShared(); }
+    catch (e) { app.messages.toast('Error deleting: ' + e.message, 'danger'); }
+  }
+
   (async function init() {
     const user = await app.auth.forceLogin();
     if (!user) return; // not logged in — forceLogin redirected to /login
@@ -320,6 +561,7 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
       document.getElementById('secret-path-input').placeholder = 'e.g. apps/my-service/conf';
     }
     loadSecrets();
+    loadShared();
   })();
 </script>