dashcaddy/dashcaddy-api/routes/credentials.js

const express = require('express');

module.exports = function(ctx) {
  const router = express.Router();

  // List all stored credentials (keys only, no values)
  router.get('/credentials/list', ctx.asyncHandler(async (req, res) => {
    const keys = await ctx.credentialManager.list();
    res.json({ success: true, credentials: keys, count: keys.length });
  }, 'credentials-list'));

  // Rotate encryption key — re-encrypts all stored credentials
  router.post('/credentials/rotate-key', ctx.asyncHandler(async (req, res) => {
    const success = await ctx.credentialManager.rotateEncryptionKey();
    if (success) {
      res.json({ success: true, message: 'Encryption key rotated, all credentials re-encrypted' });
    } else {
      ctx.errorResponse(res, 500, 'Key rotation failed');
    }
  }, 'credentials-rotate'));

  return router;
};