Feature/#12 - SwiftData 기반 Secret CRUD 및 보안 계층 구성

Projects/DVData/Project.swift

@@ -7,7 +7,11 @@ let project = Project.project(
         .target(
             name: DVModule.DVData.name,
             product: Project.product,
-            sources: .sources
+            sources: .sources,
+            dependencies: [
+                .domain(),
+                .core(),
+            ]
         ),
     ]
 )

Projects/DVData/Sources/RepositoryImpl/Secret/InMemorySecretQueryFilter.swift

@@ -0,0 +1,35 @@
+// Copyright © 2026 Devault. All rights reserved
+
+import DVDomain
+import Foundation
+
+/// SwiftData FetchDescriptor로 처리하기 애매한 조건을 Domain Secret 배열에서 후처리하는 필터. 현재는 searchText만 담당
+enum InMemorySecretQueryFilter {
+    static func apply(_ query: SecretQuery, to secrets: [DVDomain.Secret]) -> [DVDomain.Secret] {
+        secrets.filter { matchesSearchText(query.searchText, secret: $0) }
+    }
+
+    private static func matchesSearchText(_ searchText: String?, secret: DVDomain.Secret) -> Bool {
+        guard let searchText else {
+            return true
+        }
+
+        let keyword = searchText.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !keyword.isEmpty else {
+            return true
+        }
+
+        let fields = [
+            secret.name,
+            secret.secretType,
+            secret.subType,
+            secret.service,
+            secret.environment,
+            secret.memo,
+        ]
+
+        return fields.contains {
+            $0?.localizedCaseInsensitiveContains(keyword) == true
+        }
+    }
+}

Projects/DVData/Sources/RepositoryImpl/Secret/SecretFetchDescriptorBuilder.swift

@@ -0,0 +1,102 @@
+// Copyright © 2026 Devault. All rights reserved
+
+import DVDomain
+import Foundation
+import SwiftData
+
+/// Domain의 SecretQuery를 SwiftData의 FetchDescriptor<SwiftDataModel.Secret>로 바꾸는 타입
+enum SecretFetchDescriptorBuilder {
+    static func make(from query: SecretQuery) -> FetchDescriptor<SwiftDataModel.Secret> {
+        var descriptor = FetchDescriptor<SwiftDataModel.Secret>(
+            predicate: predicate(from: query),
+            sortBy: sortDescriptors(from: query.sort)
+        )
+        descriptor.includePendingChanges = true
+        return descriptor
+    }
+
+    private static func predicate(from query: SecretQuery) -> Predicate<SwiftDataModel.Secret> {
+        let hasSecretType = !(query.secretType?.isEmpty ?? true)
+        let secretType = query.secretType ?? ""
+        let hasService = !(query.service?.isEmpty ?? true)
+        let service = query.service ?? ""
+        let hasEnvironment = !(query.environment?.isEmpty ?? true)
+        let environment = query.environment ?? ""
+
+        switch query.collection {
+        case .all:
+            return #Predicate<SwiftDataModel.Secret> { secret in
+                secret.deletedAt == nil &&
+                (!hasSecretType || secret.secretType == secretType) &&
+                (!hasService || secret.service == service) &&
+                (!hasEnvironment || secret.environment == environment)
+            }
+        case .liked:
+            return #Predicate<SwiftDataModel.Secret> { secret in
+                secret.deletedAt == nil &&
+                secret.liked &&
+                (!hasSecretType || secret.secretType == secretType) &&
+                (!hasService || secret.service == service) &&
+                (!hasEnvironment || secret.environment == environment)
+            }
+        case let .expired(referenceDate):
+            return #Predicate<SwiftDataModel.Secret> { secret in
+                secret.deletedAt == nil &&
+                secret.expiresAt != nil &&
+                secret.expiresAt! < referenceDate &&
+                (!hasSecretType || secret.secretType == secretType) &&
+                (!hasService || secret.service == service) &&
+                (!hasEnvironment || secret.environment == environment)
+            }
+        case .deleted:
+            return #Predicate<SwiftDataModel.Secret> { secret in
+                secret.deletedAt != nil &&
+                (!hasSecretType || secret.secretType == secretType) &&
+                (!hasService || secret.service == service) &&
+                (!hasEnvironment || secret.environment == environment)
+            }
+        case let .project(projectID):
+            return #Predicate<SwiftDataModel.Secret> { secret in
+                secret.deletedAt == nil &&
+                secret.projectLinks.contains { link in
+                    link.project.id == projectID
+                } &&
+                (!hasSecretType || secret.secretType == secretType) &&
+                (!hasService || secret.service == service) &&
+                (!hasEnvironment || secret.environment == environment)
+            }
+        }
+    }
+
+    private static func sortDescriptors(
+        from sort: SecretQuery.Sort
+    ) -> [SortDescriptor<SwiftDataModel.Secret>] {
+        switch sort {
+        case .recentlyAdded:
+            return [
+                SortDescriptor(\.createdAt, order: .reverse),
+                SortDescriptor(\.updatedAt, order: .reverse),
+            ]
+        case .oldestFirst:
+            return [
+                SortDescriptor(\.createdAt, order: .forward),
+                SortDescriptor(\.updatedAt, order: .forward),
+            ]
+        case .expiringSoon:
+            return [
+                SortDescriptor(\.expiresAt, order: .forward),
+                SortDescriptor(\.updatedAt, order: .reverse),
+            ]
+        case .nameAscending:
+            return [
+                SortDescriptor(\.name, order: .forward),
+                SortDescriptor(\.updatedAt, order: .reverse),
+            ]
+        case .nameDescending:
+            return [
+                SortDescriptor(\.name, order: .reverse),
+                SortDescriptor(\.updatedAt, order: .reverse),
+            ]
+        }
+    }
+}

Projects/DVData/Sources/RepositoryImpl/Secret/SecretRepositoryImpl.swift

@@ -0,0 +1,208 @@
+// Copyright © 2026 Devault. All rights reserved
+
+import DVDomain
+import Foundation
+import SwiftData
+
+@ModelActor
+public actor SecretRepositoryImpl: SecretRepository {
+    public func create(_ secret: DVDomain.Secret) async throws -> DVDomain.Secret {
+        do {
+            let localSecret = SwiftDataModel.Secret(
+                id: secret.id,
+                name: secret.name,
+                secretType: secret.secretType,
+                subType: secret.subType,
+                service: secret.service,
+                environment: secret.environment,
+                expiresAt: secret.expiresAt,
+                memo: secret.memo,
+                liked: secret.liked,
+                deletedAt: secret.deletedAt,
+                createdAt: secret.createdAt,
+                updatedAt: secret.updatedAt
+            )
+
+            let localPayload = SwiftDataModel.SecretPayload(
+                encryptedData: secret.payload.encryptedData,
+                keyTag: secret.payload.keyTag,
+                schemaVersion: secret.payload.schemaVersion,
+                secret: localSecret
+            )
+            localSecret.payload = localPayload
+
+            modelContext.insert(localSecret)
+            modelContext.insert(localPayload)
+
+            if let metadata = secret.metadata {
+                let localMetadata = SwiftDataModel.SecretMetadata(
+                    metadataJSON: metadata.metadataJSON,
+                    schemaVersion: metadata.schemaVersion,
+                    secret: localSecret
+                )
+                localSecret.metadata = localMetadata
+                modelContext.insert(localMetadata)
+            }
+
+            try modelContext.save()
+
+            return try localSecret.toDomain()
+        } catch let error as SecretRepositoryError {
+            throw error
+        } catch {
+            throw SecretRepositoryError.persistenceFailed
+        }
+    }
+
+    public func fetch(id: UUID) async throws -> DVDomain.Secret? {
+        do {
+            guard let localSecret = try fetchLocalSecret(id: id) else {
+                return nil
+            }
+            return try localSecret.toDomain()
+        } catch let error as SecretRepositoryError {
+            throw error
+        } catch {
+            throw SecretRepositoryError.persistenceFailed
+        }
+    }
+
+    /// SecretFetchDescriptorBuilder로 원하는 조건으로 fetch 후 InMemorySecretQueryFilter로 searchText 보정
+    public func fetch(_ query: SecretQuery) async throws -> [DVDomain.Secret] {
+        do {
+            let descriptor = SecretFetchDescriptorBuilder.make(from: query)
+            let localSecrets = try modelContext.fetch(descriptor)
+            let domainSecrets = try localSecrets.map { try $0.toDomain() }
+            return InMemorySecretQueryFilter.apply(query, to: domainSecrets)
+        } catch let error as SecretRepositoryError {
+            throw error
+        } catch {
+            throw SecretRepositoryError.persistenceFailed
+        }
+    }
+
+    /// SecretPatch 적용하여 update
+    public func patch(id: UUID, with patch: SecretPatch) async throws -> DVDomain.Secret {
+        do {
+            guard let localSecret = try fetchLocalSecret(id: id) else {
+                throw SecretRepositoryError.notFound(id: id)
+            }
+
+            apply(patch, to: localSecret)
+            try modelContext.save()
+
+            return try localSecret.toDomain()
+        } catch let error as SecretRepositoryError {
+            throw error
+        } catch {
+            throw SecretRepositoryError.persistenceFailed
+        }
+    }
+
+    public func delete(id: UUID) async throws {
+        do {
+            guard let localSecret = try fetchLocalSecret(id: id) else {
+                throw SecretRepositoryError.notFound(id: id)
+            }
+
+            modelContext.delete(localSecret)
+            try modelContext.save()
+        } catch let error as SecretRepositoryError {
+            throw error
+        } catch {
+            throw SecretRepositoryError.persistenceFailed
+        }
+    }
+}
+
+extension SecretRepositoryImpl {
+    private func fetchLocalSecret(id: UUID) throws -> SwiftDataModel.Secret? {
+        var descriptor = FetchDescriptor<SwiftDataModel.Secret>(
+            predicate: #Predicate { $0.id == id }
+        )
+        descriptor.fetchLimit = 1
+        return try modelContext.fetch(descriptor).first
+    }
+
+    /// SecretPatch를 SwiftData model에 반영
+    private func apply(_ patch: SecretPatch, to secret: SwiftDataModel.Secret) {
+        if case let .set(name) = patch.name {
+            secret.name = name
+        }
+        if case let .set(secretType) = patch.secretType {
+            secret.secretType = secretType
+        }
+        if case let .set(subType) = patch.subType {
+            secret.subType = subType
+        }
+        if case let .set(service) = patch.service {
+            secret.service = service
+        }
+        if case let .set(environment) = patch.environment {
+            secret.environment = environment
+        }
+        if case let .set(expiresAt) = patch.expiresAt {
+            secret.expiresAt = expiresAt
+        }
+        if case let .set(memo) = patch.memo {
+            secret.memo = memo
+        }
+        if case let .set(liked) = patch.liked {
+            secret.liked = liked
+        }
+        if case let .set(deletedAt) = patch.deletedAt {
+            secret.deletedAt = deletedAt
+        }
+        if case let .set(updatedAt) = patch.updatedAt {
+            secret.updatedAt = updatedAt
+        }
+        if case let .set(payload) = patch.payload {
+            apply(payload, to: secret)
+        }
+        if case let .set(metadata) = patch.metadata {
+            apply(metadata, to: secret)
+        }
+    }
+
+    /// payload가 있으면 업데이트하고, 없으면 새 payload를 만든다.
+    private func apply(_ payload: DVDomain.SecretPayload, to secret: SwiftDataModel.Secret) {
+        if let localPayload = secret.payload {
+            localPayload.encryptedData = payload.encryptedData
+            localPayload.keyTag = payload.keyTag
+            localPayload.schemaVersion = payload.schemaVersion
+        } else {
+            let localPayload = SwiftDataModel.SecretPayload(
+                encryptedData: payload.encryptedData,
+                keyTag: payload.keyTag,
+                schemaVersion: payload.schemaVersion,
+                secret: secret
+            )
+            secret.payload = localPayload
+            modelContext.insert(localPayload)
+        }
+    }
+
+    /// metadata가 nil이면 기존 metadata를 삭제하고, 값이 있으면 업데이트 또는 생성한다.
+    private func apply(_ metadata: DVDomain.SecretMetadata?, to secret: SwiftDataModel.Secret) {
+        guard let metadata else {
+            if let localMetadata = secret.metadata {
+                modelContext.delete(localMetadata)
+            }
+            secret.metadata = nil
+            return
+        }
+
+        if let localMetadata = secret.metadata {
+            localMetadata.metadataJSON = metadata.metadataJSON
+            localMetadata.schemaVersion = metadata.schemaVersion
+        } else {
+            let localMetadata = SwiftDataModel.SecretMetadata(
+                metadataJSON: metadata.metadataJSON,
+                schemaVersion: metadata.schemaVersion,
+                secret: secret
+            )
+            secret.metadata = localMetadata
+            modelContext.insert(localMetadata)
+        }
+    }
+}