release: v1.32.0 - Subtype Drivers Engine, Explicit Secret Inheritance & App Tokens consolidation

docs/vault.md

@@ -10,48 +10,20 @@ description: OpenBao-backed personal, shared, and external-app secret storage bu
 
 The Vault Secrets feature integrates with OpenBao to provide a secure key-value store for your environment. It allows you to store sensitive information like passwords, API keys, and credentials, ensuring they are encrypted and access-controlled.
 
-## Usage
+## Location & Access
 
-You can access the Vault UI from the application's top navigation bar. 
+- **External App Tokens**: Managed under **Configuration** (`/conf` -> **App Tokens** tab). Admins can mint and view periodic OpenBao app tokens scoped to `secret/apps/<name>/*`.
+- **Resource Secrets**: Managed under **Directory** (`/directory`) inside each resource's modal under the **Secrets** tab. Stored in OpenBao under `secret/data/resources/<slug>/conf`.
 
-### Creating Secrets
+## External App Tokens (Admin)
 
-1. Click on the **New Secret** button.
-2. Enter a **Secret Path**. This acts as the name/identifier of your secret (e.g., `db-credentials`).
-3. Enter the **Secret Data** in JSON format. For example:
-   ```json
-   {
-     "username": "admin",
-     "password": "supersecretpassword123"
-   }
-   ```
-4. Click **Save Secret**.
+The **App Tokens** tab in **Configuration** (`/conf`) mints a scoped OpenBao token for an **external application** or script so it can read its own configuration out of OpenBao.
 
-### Reading and Editing Secrets
+1. Enter an app **name** (e.g. `build-agent`) and click **Mint token**.
+2. A token is shown **once** — copy it into the external app now; it cannot be recovered later. The app uses it as the `X-Vault-Token` header against `secret/apps/<name>/*`.
+3. The **Active App Tokens** list shows every token created (metadata only — the token itself is never stored). sso-manager keeps each token alive by renewing it periodically.
 
-* To view a secret, click on its name in the **Secrets List**.
-* To update an existing secret, select it and click the **Edit** button. You can then modify the JSON data and save your changes.
-
-### OpenBao Integration
-
-The secrets are stored in a real, initialized-and-unsealed OpenBao backend
-(`setup.sh` handles init/unseal on first run) — not OpenBao's ephemeral dev
-mode, which auto-unseals with an in-memory store and loses everything on
-restart. The default KV (Key-Value) version 2 engine is mounted at `secret/`.
-The built-in UI proxies through `/api/vault/secret/…`, authenticated the same
-way as the rest of the app (session cookie or a personal API token) — the
-server resolves your OpenBao access itself and injects the right scoped
-token; you never see or handle a raw OpenBao token as a UI user.
-
-## Apps tab (admin)
-
-The **Apps** tab mints a scoped OpenBao token for an **external application** so it can read its own configuration out of OpenBao — a downstream-app credential, not a per-user secret.
-
-1. Enter an app **name** (e.g. `my-service`) and click **Mint token**.
-2. A token is shown **once** — copy it into the external app now; it cannot be recovered later. The app uses it as the `X-Vault-Token` header against `secret/apps/<name>/*` (see the connection convention shown on the page).
-3. The **Minted apps** list shows every token you've created (metadata only — the token itself is never stored). sso keeps each token alive by renewing it periodically, so a downstream app's credential stays valid as long as sso runs. If an app shows a **renewal error**, re-mint it here — that revokes the old token and issues a fresh one.
-
-The token is scoped to `secret/apps/<name>/*` only (policy `app-<name>`), so a compromised token can't touch any other secret.
+The token is strictly scoped to `secret/apps/<name>/*` (policy `app-<name>`), so a compromised token can't touch any other secret.
 
 ## Shared tab