feat(rotation): 90-day policy, due runs wait for owner approval (CLI 0.16.0) (#270)

Every automatic secret older than the team's max age (90 days default) is
queued as one run in awaiting-approval. An owner/admin approves it on the
Rotation page or with `teams rotation-approve`; machine keys can queue but
never approve. logicsrc-rotate --queue (*/5 cron) runs approved runs with
propagate + health checks + rollback. rotation_auto_approve per team is the
paid automatic rotation add-on (off by default).

Co-authored-by: Anthony Ettinger <anthony@profullstack.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people

apps/pwa/src/lib/rotation.mjs

@@ -11,6 +11,18 @@ import { planRotations, isoTime } from "@logicsrc/cli/dist/rotation-catalog.js";
 import { DESKTOP_RECIPES } from "@logicsrc/cli/dist/desktop-recipes.js";
 
 const ROTATE_PREFIX = "__ROTATE__";
+const DAY = 24 * 60 * 60 * 1000;
+
+/** Default rotation policy: an automatic secret is due once its value is this many days old. */
+export const DEFAULT_MAX_AGE_DAYS = 90;
+/** One due run carries at most this many keys (the oldest first); the rest wait for the next. */
+export const DUE_RUN_MAX_KEYS = 200;
+
+/** A team's max age in days: its own setting, else the default. */
+export function maxAgeDays(team) {
+  const n = Number(team?.rotation_max_age_days);
+  return Number.isInteger(n) && n > 0 ? n : DEFAULT_MAX_AGE_DAYS;
+}
 
 /** Vault names split the way the CLI does: <project>--<env>. */
 export function splitVaultName(name) {
@@ -23,7 +35,7 @@ export function splitVaultName(name) {
  * `logicsrc teams rotation`. `vaultFilter(name)` limits it to vaults the caller
  * may see (a machine key's scope).
  */
-export async function rotationPlan(teamId, { project, env, keys, vaultFilter = () => true } = {}) {
+export async function rotationPlan(teamId, { project, env, keys, vaultFilter = () => true, maxAge = DEFAULT_MAX_AGE_DAYS, now = Date.now() } = {}) {
   const rows = (await all(
     `SELECT v.name AS vault, s.name AS key, s.fingerprint, s.updated_at
        FROM credshare_secrets s JOIN credshare_vaults v ON v.id = s.vault_id
@@ -50,6 +62,8 @@ export async function rotationPlan(teamId, { project, env, keys, vaultFilter = (
     const spec = p.spec ?? {};
     const recipe = spec.method === "desktop" ? DESKTOP_RECIPES[spec.recipe] : null;
     const everywhere = byFp.get(p.fingerprint) ?? [];
+    const rotatedAt = Date.parse(isoTime(p.oldestUpdate));
+    const ageDays = Number.isFinite(rotatedAt) ? Math.floor((now - rotatedAt) / DAY) : null;
     return {
       key: p.key,
       method: p.method,
@@ -68,6 +82,9 @@ export async function rotationPlan(teamId, { project, env, keys, vaultFilter = (
       vaultCount: everywhere.length || p.vaults.length,
       alsoIn: everywhere.filter((vk) => !p.vaults.some((v) => vk === `${v}:${p.key}`)),
       lastRotated: isoTime(p.oldestUpdate),
+      ageDays,
+      // Past the team's max age: the next due run picks it up (automatic keys only).
+      due: Boolean(p.automatic && !spec.never && ageDays !== null && ageDays >= maxAge),
       // The key's own encrypted instructions override the catalog; only the CLI can read them.
       hasEntry: p.vaults.some((v) => entries.has(`${v}\u0000${p.key}`))
     };
@@ -78,6 +95,8 @@ export async function rotationPlan(teamId, { project, env, keys, vaultFilter = (
 
 const KEY_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 const HOST = /^[A-Za-z0-9._@-]{1,100}$/;
+/** A run still open: a due run is not queued again while one of these exists. */
+export const OPEN_RUN_STATUSES = ["awaiting-approval", "queued", "running"];
 const RESULT_STATUSES = new Set(["rotated", "would-rotate", "todo", "failed", "rolled-back", "skipped", "covered", "needs-login", "busy"]);
 
 export class RotationRunError extends Error {}
@@ -139,6 +158,9 @@ export function runRow(r) {
     approve: Boolean(Number(r.approve)),
     options: parse(r.options, {}),
     status: r.status,
+    due: Boolean(parse(r.options, {}).due),
+    approvedBy: r.approved_by_email ?? r.approved_by ?? null,
+    approvedAt: r.approved_at ? Number(r.approved_at) : null,
     requestedBy: r.requested_by_email ?? r.requested_by,
     claimedBy: r.claimed_by ?? null,
     claimedAt: r.claimed_at ? Number(r.claimed_at) : null,

apps/pwa/src/migrations-pg/011_rotation_policy.sql

@@ -0,0 +1,7 @@
+-- Postgres copy of migrations/011_rotation_policy.sql (INTEGER -> bigint). Additive only.
+-- 90-day rotation policy: due automatic secrets are queued as one run awaiting
+-- owner/admin approval; rotation_auto_approve (paid add-on) skips the click.
+ALTER TABLE credshare_teams ADD COLUMN IF NOT EXISTS rotation_max_age_days integer;
+ALTER TABLE credshare_teams ADD COLUMN IF NOT EXISTS rotation_auto_approve integer NOT NULL DEFAULT 0;
+ALTER TABLE credshare_rotation_runs ADD COLUMN IF NOT EXISTS approved_by text;
+ALTER TABLE credshare_rotation_runs ADD COLUMN IF NOT EXISTS approved_at bigint;

apps/pwa/src/migrations/011_rotation_policy.sql

@@ -0,0 +1,11 @@
+-- 90-day rotation policy (Anthony, 2026-10-29).
+--
+-- Every automatic secret older than the team's max age (NULL = 90 days) is
+-- queued as one run that waits for an owner or admin to approve it
+-- (status 'awaiting-approval'). rotation_auto_approve is the paid add-on:
+-- when 1, due runs are queued already approved and rotate without a click.
+-- approved_by / approved_at record who said yes. Additive only.
+ALTER TABLE credshare_teams ADD COLUMN rotation_max_age_days INTEGER;
+ALTER TABLE credshare_teams ADD COLUMN rotation_auto_approve INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE credshare_rotation_runs ADD COLUMN approved_by TEXT;
+ALTER TABLE credshare_rotation_runs ADD COLUMN approved_at INTEGER;