@axiom-lattice/local-stores 3.2.1 → 3.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/local-stores",
-  "version": "3.2.1",
+  "version": "3.2.2",
   "description": "Local SQLite-based stores for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@types/sql.js": "^1.4.11",
     "sql.js": "^1.14.1",
     "uuid": "^14.0.1",
-    "@axiom-lattice/core": "6.3.1",
-    "@axiom-lattice/protocols": "4.7.0"
+    "@axiom-lattice/core": "6.3.2",
+    "@axiom-lattice/protocols": "4.7.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/LocalConnectionStore.test.ts

@@ -0,0 +1,176 @@
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import path from "path";
+import { tmpdir } from "os";
+import { closeDatabase, initDatabase, type DatabaseWrapper } from "../database";
+import { LocalConnectionStore } from "../stores/LocalConnectionStore";
+import { decrypt, clearEncryptionKeyCache } from "@axiom-lattice/core";
+
+jest.mock("uuid", () => {
+  let id = 0;
+  return { v4: jest.fn(() => `test-id-${++id}`) };
+});
+
+describe("LocalConnectionStore secret field encryption", () => {
+  let store: LocalConnectionStore;
+  let db: DatabaseWrapper;
+
+  function rawConfig(key: string): { config: Record<string, unknown>; secretFields: string | null } {
+    const row = db
+      .prepare("SELECT config, secret_fields FROM connection_configs WHERE tenant_id = ? AND key = ?")
+      .get("t", key) as { config: string; secret_fields: string | null };
+    return { config: JSON.parse(row.config) as Record<string, unknown>, secretFields: row.secret_fields };
+  }
+
+  beforeEach(async () => {
+    const dbPath = path.join(tmpdir(), `lt-conn-${Date.now()}-${Math.random().toString(36).slice(2)}.db`);
+    db = await initDatabase({ dbPath });
+    store = new LocalConnectionStore(db);
+  });
+
+  afterEach(() => closeDatabase());
+
+  it("encrypts declared secret fields at rest and decrypts them on read", async () => {
+    const created = await store.create({
+      tenantId: "t",
+      type: "semantic-metrics",
+      key: "conn",
+      name: "Conn",
+      config: { baseUrl: "https://metrics.example/api/v1", apiKey: "sk-real-secret" },
+      secretFields: ["apiKey"],
+    });
+
+    const raw = rawConfig("conn");
+    expect(raw.config.baseUrl).toBe("https://metrics.example/api/v1");
+    expect(raw.config.apiKey).not.toBe("sk-real-secret");
+    expect(decrypt(raw.config.apiKey as string)).toBe("sk-real-secret");
+    expect(raw.secretFields).toBe(JSON.stringify(["apiKey"]));
+
+    // Create returns the real value to the caller.
+    expect(created.config.apiKey).toBe("sk-real-secret");
+
+    const read = await store.getByKey("t", "semantic-metrics", "conn");
+    expect(read?.config.apiKey).toBe("sk-real-secret");
+    expect(read?.secretFields).toEqual(["apiKey"]);
+
+    const [listed] = await store.listByType("t", "semantic-metrics");
+    expect(listed.config.apiKey).toBe("sk-real-secret");
+  });
+
+  it("reuses the stored secret fields when an update omits them", async () => {
+    await store.create({
+      tenantId: "t",
+      type: "semantic-metrics",
+      key: "conn",
+      name: "Conn",
+      config: { apiKey: "sk-one" },
+      secretFields: ["apiKey"],
+    });
+
+    const updated = await store.update("t", "semantic-metrics", "conn", {
+      config: { apiKey: "sk-two" },
+    });
+
+    expect(updated?.config.apiKey).toBe("sk-two");
+    expect(decrypt(rawConfig("conn").config.apiKey as string)).toBe("sk-two");
+  });
+
+  it("leaves config untouched when only metadata is updated", async () => {
+    await store.create({
+      tenantId: "t",
+      type: "semantic-metrics",
+      key: "conn",
+      name: "Conn",
+      config: { apiKey: "sk-one" },
+      secretFields: ["apiKey"],
+    });
+    const before = rawConfig("conn").config.apiKey;
+
+    await store.update("t", "semantic-metrics", "conn", { name: "Renamed" });
+
+    expect(rawConfig("conn").config.apiKey).toBe(before);
+  });
+
+  it("returns legacy plaintext rows unchanged", async () => {
+    db.run(
+      "INSERT INTO connection_configs (id, tenant_id, type, key, name, description, config, secret_fields, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "legacy-id", "t", "semantic-metrics", "legacy", "Legacy", null,
+      JSON.stringify({ apiKey: "sk-legacy" }), null, "2024-01-01T00:00:00.000Z", "2024-01-01T00:00:00.000Z",
+    );
+
+    const read = await store.getByKey("t", "semantic-metrics", "legacy");
+    expect(read?.config.apiKey).toBe("sk-legacy");
+    expect(read?.secretFields).toBeUndefined();
+  });
+
+  it("adds the secret_fields column to a legacy database and encrypts new writes", async () => {
+    // Simulate a database created before secret_fields existed.
+    db.exec("DROP TABLE connection_configs");
+    db.exec(`
+      CREATE TABLE connection_configs (
+        id TEXT NOT NULL,
+        tenant_id TEXT NOT NULL,
+        type TEXT NOT NULL,
+        key TEXT NOT NULL,
+        name TEXT NOT NULL,
+        description TEXT,
+        config TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (tenant_id, id),
+        UNIQUE (tenant_id, type, key)
+      )
+    `);
+    db.run(
+      "INSERT INTO connection_configs (id, tenant_id, type, key, name, description, config, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "old-id", "t", "semantic-metrics", "legacy", "Legacy", null,
+      JSON.stringify({ apiKey: "sk-legacy" }), "2024-01-01T00:00:00.000Z", "2024-01-01T00:00:00.000Z",
+    );
+
+    const upgraded = new LocalConnectionStore(db);
+    const columns = db.prepare("PRAGMA table_info(connection_configs)").all() as Array<{ name: string }>;
+    expect(columns.some((c) => c.name === "secret_fields")).toBe(true);
+
+    // Legacy plaintext row still reads unchanged after the column is added.
+    expect((await upgraded.getByKey("t", "semantic-metrics", "legacy"))?.config.apiKey).toBe("sk-legacy");
+
+    // New writes on the upgraded store are encrypted.
+    await upgraded.create({
+      tenantId: "t",
+      type: "semantic-metrics",
+      key: "fresh",
+      name: "Fresh",
+      config: { apiKey: "sk-fresh" },
+      secretFields: ["apiKey"],
+    });
+    const raw = db
+      .prepare("SELECT config FROM connection_configs WHERE tenant_id = ? AND key = ?")
+      .get("t", "fresh") as { config: string };
+    expect(JSON.parse(raw.config).apiKey).not.toBe("sk-fresh");
+  });
+
+  it("fails closed when stored secrets cannot be decrypted with the current key", async () => {
+    const previous = process.env.LATTICE_ENCRYPTION_KEY;
+    try {
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-one";
+      clearEncryptionKeyCache();
+      await store.create({
+        tenantId: "t",
+        type: "semantic-metrics",
+        key: "conn",
+        name: "Conn",
+        config: { apiKey: "sk-one" },
+        secretFields: ["apiKey"],
+      });
+
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-two";
+      clearEncryptionKeyCache();
+
+      await expect(store.getByKey("t", "semantic-metrics", "conn"))
+        .rejects.toThrow("Failed to decrypt connection configuration");
+    } finally {
+      if (previous === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+      else process.env.LATTICE_ENCRYPTION_KEY = previous;
+      clearEncryptionKeyCache();
+    }
+  });
+});

package/src/stores/LocalConnectionStore.ts

@@ -4,6 +4,7 @@
 import { DatabaseWrapper, ensureTable, nowISO } from "../database";
 import type { ConnectionEntry, ConnectionStore } from "@axiom-lattice/protocols";
 import { v4 as uuid } from "uuid";
+import { encryptConfigFields, decryptConfigFields } from "@axiom-lattice/core";
 
 const DDL = `
 CREATE TABLE IF NOT EXISTS connection_configs (
@@ -14,6 +15,7 @@ CREATE TABLE IF NOT EXISTS connection_configs (
   name TEXT NOT NULL,
   description TEXT,
   config TEXT NOT NULL,
+  secret_fields TEXT,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL,
   PRIMARY KEY (tenant_id, id),
@@ -30,16 +32,39 @@ interface ConnectionRow {
   name: string;
   description: string | null;
   config: string;
+  secret_fields: string | null;
   created_at: string;
   updated_at: string;
 }
 
+/** Parse a persisted secret-field list; null/empty means "no encrypted fields". */
+function parseSecretFields(raw: string | null): string[] | undefined {
+  if (!raw) return undefined;
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string") && parsed.length > 0) {
+      return parsed as string[];
+    }
+  } catch {
+    /* fall through */
+  }
+  return undefined;
+}
+
 export class LocalConnectionStore implements ConnectionStore {
   private db: DatabaseWrapper;
 
   constructor(db: DatabaseWrapper) {
     this.db = db;
     ensureTable(db, DDL);
+    this.ensureColumn("connection_configs", "secret_fields", "secret_fields TEXT");
+  }
+
+  private ensureColumn(table: string, column: string, ddl: string): void {
+    const cols = this.db.prepare(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
+    if (!cols.some((c) => c.name === column)) {
+      this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl}`);
+    }
   }
 
   async listByTenant(tenantId: string): Promise<ConnectionEntry[]> {
@@ -66,13 +91,19 @@ export class LocalConnectionStore implements ConnectionStore {
   async create(entry: Omit<ConnectionEntry, "id" | "createdAt" | "updatedAt">): Promise<ConnectionEntry> {
     const id = uuid();
     const now = nowISO();
+    const secretFields = entry.secretFields?.length ? entry.secretFields : undefined;
 
     this.db.prepare(
-      `INSERT INTO connection_configs (id, tenant_id, type, key, name, description, config, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    ).run(id, entry.tenantId, entry.type, entry.key, entry.name, entry.description || null, JSON.stringify(entry.config), now, now);
-
-    return { id, ...entry, createdAt: now, updatedAt: now };
+      `INSERT INTO connection_configs (id, tenant_id, type, key, name, description, config, secret_fields, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(
+      id, entry.tenantId, entry.type, entry.key, entry.name, entry.description || null,
+      JSON.stringify(encryptConfigFields(entry.config, secretFields)),
+      secretFields ? JSON.stringify(secretFields) : null,
+      now, now,
+    );
+
+    return { id, ...entry, secretFields, createdAt: now, updatedAt: now };
   }
 
   async update(
@@ -93,8 +124,13 @@ export class LocalConnectionStore implements ConnectionStore {
       values.push(updates.description || null);
     }
     if (updates.config !== undefined) {
+      const secretFields = updates.secretFields?.length
+        ? updates.secretFields
+        : (existing.secretFields?.length ? existing.secretFields : undefined);
       setClauses.push("config = ?");
-      values.push(JSON.stringify(updates.config));
+      values.push(JSON.stringify(encryptConfigFields(updates.config, secretFields)));
+      setClauses.push("secret_fields = ?");
+      values.push(secretFields ? JSON.stringify(secretFields) : null);
     }
 
     if (setClauses.length === 0) return existing;
@@ -119,6 +155,8 @@ export class LocalConnectionStore implements ConnectionStore {
   }
 
   private mapRow(row: ConnectionRow): ConnectionEntry {
+    const secretFields = parseSecretFields(row.secret_fields);
+    const storedConfig = JSON.parse(row.config) as Record<string, unknown>;
     return {
       id: row.id,
       tenantId: row.tenant_id,
@@ -126,7 +164,8 @@ export class LocalConnectionStore implements ConnectionStore {
       key: row.key,
       name: row.name,
       description: row.description || undefined,
-      config: JSON.parse(row.config) as Record<string, unknown>,
+      config: decryptConfigFields(storedConfig, secretFields),
+      secretFields,
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };