CLI command
skarbiec password age
See which passwords have stood the longest, so a rotation starts with them, or when one item's password was set.
Invocation#
skarbiec password age [--set-before <iso8601>]
skarbiec password age <id>Purpose#
See which passwords have stood the longest, so a rotation starts with them, or when one item's password was set.
Required inputs and options#
- An optional --set-before, a UTC time of the vault's stamp form; without it every live login is listed. Or one item id, alone, for that item's moment. POST /v1/operator/items/password-age takes set-before, or id.
Output and state effects#
- For every live login it opens each saved version to find the save that first held its password and the last one that changed it, and prints ok, set_before and logins, oldest first, each with id, set_at and unreadable: the saved versions that would not open, with their error, which the comparison runs past. With --set-before only the logins set before the moment are listed, and a login none of whose versions could be dated, with its error. With an id it prints that one row, id, set_at and unreadable, for an item of any kind. Only moments leave: no value, length or digest. It writes nothing; review lists the same answer under passwords_set_before, and Desktop shows one item's as Password last set in its inspector.
Refusals#
- More than one positional, or an id together with --set-before, exits 2 with `usage: password age [<id>] [--set-before <iso8601>]`, and a --set-before of another shape with `--set-before <value> is not a UTC time of the form <now>`. An unknown id is refused with `no item: <id>`. A login whose versions cannot be read is listed with its error instead of failing the whole list.