@absolutejs/secrets 0.6.1 → 0.7.1

package/dist/index.js

@@ -15,59 +15,6 @@ var __export = (target, all) => {
 };
 var __require = import.meta.require;
 
-// node_modules/@absolutejs/telemetry/dist/index.js
-var NOOP_SPAN_CONTEXT = {
-  spanId: "0000000000000000",
-  traceFlags: 0,
-  traceId: "00000000000000000000000000000000"
-};
-var noopSpan = {
-  addEvent: () => noopSpan,
-  end: () => {},
-  isRecording: () => false,
-  recordException: () => {},
-  setAttribute: () => noopSpan,
-  setAttributes: () => noopSpan,
-  setStatus: () => noopSpan,
-  spanContext: () => NOOP_SPAN_CONTEXT,
-  updateName: () => noopSpan
-};
-var startActiveSpanNoop = (_name, optionsOrFn, maybeFn) => {
-  const fn = typeof optionsOrFn === "function" ? optionsOrFn : maybeFn;
-  return fn(noopSpan);
-};
-var noopTracer = {
-  startActiveSpan: startActiveSpanNoop,
-  startSpan: () => noopSpan
-};
-var tracerOrNoop = (provider, name, version) => provider !== undefined ? provider.getTracer(name, version) : noopTracer;
-var ABS_ATTRS = {
-  tenant: "abs.tenant",
-  shardId: "abs.shard.id",
-  engineId: "abs.engine.id",
-  collection: "abs.collection",
-  mutation: "abs.mutation",
-  mutationAttempt: "abs.mutation.attempt",
-  subscriptionId: "abs.subscription.id",
-  batchSize: "abs.batch.size",
-  clusterMessageOrigin: "abs.cluster.origin",
-  jobId: "abs.job.id",
-  jobKind: "abs.job.kind",
-  jobAttempt: "abs.job.attempt",
-  jobMaxAttempts: "abs.job.max_attempts",
-  workerId: "abs.worker.id",
-  runtimeKey: "abs.runtime.key",
-  runtimePid: "abs.runtime.pid",
-  runtimePort: "abs.runtime.port",
-  runtimeExitReason: "abs.runtime.exit_reason",
-  runtimeReadinessMs: "abs.runtime.readiness_ms",
-  routeShard: "abs.route.shard",
-  routeDecision: "abs.route.decision",
-  secretName: "abs.secret.name",
-  secretFingerprint: "abs.secret.fingerprint",
-  auditKind: "abs.audit.kind"
-};
-
 // node_modules/@absolutejs/agency/dist/index.js
 var normalize = (value) => {
   if (Array.isArray(value))
@@ -254,8 +201,112 @@ var createCredentialOperationBroker = ({
   };
   return { request, resume, revoke: store.revoke };
 };
+// src/postgres.ts
+var namespaceOf = (namespace) => {
+  if (!/^[a-z_][a-z0-9_]*$/.test(namespace))
+    throw new Error("Secrets PostgreSQL namespace must be a simple identifier");
+  return namespace;
+};
+var credentialGrantsPostgresSchemaSql = (namespace = "secrets") => {
+  const ns = namespaceOf(namespace);
+  return `CREATE SCHEMA IF NOT EXISTS ${ns};
+CREATE TABLE IF NOT EXISTS ${ns}.credential_grants (
+  grant_id text PRIMARY KEY, agent_id text NOT NULL, user_id text NOT NULL,
+  provider text NOT NULL, expires_at bigint NOT NULL, maximum_uses integer NOT NULL CHECK (maximum_uses > 0),
+  used integer NOT NULL DEFAULT 0 CHECK (used >= 0 AND used <= maximum_uses), data jsonb NOT NULL
+);
+CREATE INDEX IF NOT EXISTS credential_grants_agent_idx ON ${ns}.credential_grants (agent_id, expires_at);
+CREATE TABLE IF NOT EXISTS ${ns}.pending_operations (
+  action_id text PRIMARY KEY, grant_id text NOT NULL REFERENCES ${ns}.credential_grants(grant_id) ON DELETE CASCADE,
+  created_at timestamptz NOT NULL DEFAULT now(), data jsonb NOT NULL
+);`;
+};
+var createPostgresCredentialGrantStore = ({
+  client,
+  namespace = "secrets"
+}) => {
+  const ns = namespaceOf(namespace);
+  return {
+    consume: async (grantId, now) => {
+      const result = await client.query(`UPDATE ${ns}.credential_grants SET used = used + 1, data = jsonb_set(data, '{used}', to_jsonb(used + 1), true) WHERE grant_id = $1 AND expires_at > $2 AND used < maximum_uses RETURNING data`, [grantId, now]);
+      return result.rows[0]?.data;
+    },
+    get: async (grantId) => (await client.query(`SELECT data FROM ${ns}.credential_grants WHERE grant_id = $1`, [grantId])).rows[0]?.data,
+    getPending: async (actionId) => (await client.query(`SELECT data FROM ${ns}.pending_operations WHERE action_id = $1`, [actionId])).rows[0]?.data,
+    put: async (grant) => {
+      if (grant.maximumUses < 1 || grant.used < 0 || grant.used > grant.maximumUses)
+        throw new Error("Invalid credential grant usage");
+      await client.query(`INSERT INTO ${ns}.credential_grants (grant_id, agent_id, user_id, provider, expires_at, maximum_uses, used, data) VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb) ON CONFLICT (grant_id) DO UPDATE SET expires_at=EXCLUDED.expires_at, maximum_uses=EXCLUDED.maximum_uses, used=EXCLUDED.used, data=EXCLUDED.data`, [
+        grant.grantId,
+        grant.agentId,
+        grant.userId,
+        grant.provider,
+        grant.expiresAt,
+        grant.maximumUses,
+        grant.used,
+        JSON.stringify(grant)
+      ]);
+    },
+    putPending: async (pending) => {
+      await client.query(`INSERT INTO ${ns}.pending_operations (action_id, grant_id, data) VALUES ($1,$2,$3::jsonb) ON CONFLICT (action_id) DO UPDATE SET data=EXCLUDED.data`, [pending.actionId, pending.input.grantId, JSON.stringify(pending)]);
+    },
+    revoke: async (grantId) => (await client.query(`DELETE FROM ${ns}.credential_grants WHERE grant_id = $1`, [grantId])).rowCount === 1
+  };
+};
+// node_modules/@absolutejs/telemetry/dist/index.js
+var NOOP_SPAN_CONTEXT = {
+  spanId: "0000000000000000",
+  traceFlags: 0,
+  traceId: "00000000000000000000000000000000"
+};
+var noopSpan = {
+  addEvent: () => noopSpan,
+  end: () => {},
+  isRecording: () => false,
+  recordException: () => {},
+  setAttribute: () => noopSpan,
+  setAttributes: () => noopSpan,
+  setStatus: () => noopSpan,
+  spanContext: () => NOOP_SPAN_CONTEXT,
+  updateName: () => noopSpan
+};
+var startActiveSpanNoop = (_name, optionsOrFn, maybeFn) => {
+  const fn = typeof optionsOrFn === "function" ? optionsOrFn : maybeFn;
+  return fn(noopSpan);
+};
+var noopTracer = {
+  startActiveSpan: startActiveSpanNoop,
+  startSpan: () => noopSpan
+};
+var tracerOrNoop = (provider, name, version) => provider !== undefined ? provider.getTracer(name, version) : noopTracer;
+var ABS_ATTRS = {
+  tenant: "abs.tenant",
+  shardId: "abs.shard.id",
+  engineId: "abs.engine.id",
+  collection: "abs.collection",
+  mutation: "abs.mutation",
+  mutationAttempt: "abs.mutation.attempt",
+  subscriptionId: "abs.subscription.id",
+  batchSize: "abs.batch.size",
+  clusterMessageOrigin: "abs.cluster.origin",
+  jobId: "abs.job.id",
+  jobKind: "abs.job.kind",
+  jobAttempt: "abs.job.attempt",
+  jobMaxAttempts: "abs.job.max_attempts",
+  workerId: "abs.worker.id",
+  runtimeKey: "abs.runtime.key",
+  runtimePid: "abs.runtime.pid",
+  runtimePort: "abs.runtime.port",
+  runtimeExitReason: "abs.runtime.exit_reason",
+  runtimeReadinessMs: "abs.runtime.readiness_ms",
+  routeShard: "abs.route.shard",
+  routeDecision: "abs.route.decision",
+  secretName: "abs.secret.name",
+  secretFingerprint: "abs.secret.fingerprint",
+  auditKind: "abs.audit.kind"
+};
 
-// src/index.ts
+// src/broker.ts
 class BrokerDrainedError extends Error {
   constructor() {
     super("[secrets] Broker is draining \u2014 resolve/rotate refused. " + "Use the broker before the shutdown handler fires.");
@@ -808,7 +859,12 @@ var createSecretBroker = (options) => {
         counters.resolveHits += 1;
         span.setAttribute(ABS_ATTRS.secretFingerprint, cached.fingerprint);
         span.setAttribute("secrets.cache", "hit");
-        fireAudit({ at: now, event: "resolve.hit", fingerprint: cached.fingerprint, name });
+        fireAudit({
+          at: now,
+          event: "resolve.hit",
+          fingerprint: cached.fingerprint,
+          name
+        });
         span.setStatus({ code: 1 });
         return { fingerprint: cached.fingerprint, value: cached.value };
       }
@@ -824,7 +880,12 @@ var createSecretBroker = (options) => {
       }
       const entry = cacheEntry(name, value, now);
       span.setAttribute(ABS_ATTRS.secretFingerprint, entry.fingerprint);
-      fireAudit({ at: now, event: "resolve.miss", fingerprint: entry.fingerprint, name });
+      fireAudit({
+        at: now,
+        event: "resolve.miss",
+        fingerprint: entry.fingerprint,
+        name
+      });
       span.setStatus({ code: 1 });
       return { fingerprint: entry.fingerprint, value: entry.value };
     } catch (error) {
@@ -863,7 +924,12 @@ var createSecretBroker = (options) => {
       counters.rotates += 1;
       span.setAttribute(ABS_ATTRS.secretFingerprint, entry.fingerprint);
       span.setStatus({ code: 1 });
-      fireAudit({ at: now, event: "rotate", fingerprint: entry.fingerprint, name });
+      fireAudit({
+        at: now,
+        event: "rotate",
+        fingerprint: entry.fingerprint,
+        name
+      });
       fireRotation(name, entry.value, entry.fingerprint, now);
       return { fingerprint: entry.fingerprint, value: entry.value };
     } catch (error) {
@@ -988,12 +1054,14 @@ export {
   inMemoryAdapter,
   envAdapter,
   encryptedFileAdapter,
+  credentialGrantsPostgresSchemaSql,
   createSecretBroker,
+  createPostgresCredentialGrantStore,
   createMemoryCredentialGrantStore,
   createCredentialOperationBroker,
   compositeAdapter,
   BrokerDrainedError
 };
 
-//# debugId=733FE5935B42EE2D64756E2164756E21
+//# debugId=A90019DE57677EBB64756E2164756E21
 //# sourceMappingURL=index.js.map