@axiom-lattice/local-stores 3.2.4 → 3.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/local-stores",
-  "version": "3.2.4",
+  "version": "3.2.6",
   "description": "Local SQLite-based stores for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,7 +25,7 @@
     "@types/sql.js": "^1.4.11",
     "sql.js": "^1.14.1",
     "uuid": "^14.0.1",
-    "@axiom-lattice/core": "6.4.0",
+    "@axiom-lattice/core": "7.0.0",
     "@axiom-lattice/protocols": "4.8.0"
   },
   "devDependencies": {

package/src/__tests__/LocalA2AApiKeyStore.test.ts

@@ -9,10 +9,23 @@ import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
 import { tmpdir } from "os";
 import path from "path";
 
-jest.mock("@axiom-lattice/core", () => ({
-  encrypt: (value: string) => `enc:${value}`,
-  decrypt: (value: string) => value.replace(/^enc:/, ""),
-}));
+jest.mock("@axiom-lattice/core", () => {
+  const decrypt = (value: string): string => {
+    if (!value.startsWith("enc:")) throw new Error("Failed to decrypt");
+    return value.replace(/^enc:/, "");
+  };
+  return {
+    encrypt: (value: string) => `enc:${value}`,
+    decrypt,
+    safeDecrypt: (value: string) => {
+      try {
+        return decrypt(value);
+      } catch {
+        return "";
+      }
+    },
+  };
+});
 
 import { initDatabase, closeDatabase, type DatabaseWrapper } from "../database";
 import { LocalA2AApiKeyStore } from "../stores/LocalA2AApiKeyStore";
@@ -125,4 +138,20 @@ describe("LocalA2AApiKeyStore", () => {
     const record = await store.findById(created.id);
     expect(record?.grants).toEqual(grants);
   });
+
+  it("empties an undecryptable key value but still lists the record", async () => {
+    const now = new Date().toISOString();
+    db.prepare(
+      `INSERT INTO lt_a2a_api_keys
+        (key_value, tenant_id, project_id, label, enabled, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    ).run("plaintext-legacy-key", "t1", "p1", "broken", 1, now, now);
+
+    store = new LocalA2AApiKeyStore(db);
+    const records = await store.list({ tenantId: "t1" });
+
+    expect(records).toHaveLength(1);
+    expect(records[0].key).toBe("");
+    expect(records[0].projectId).toBe("p1");
+  });
 });

package/src/__tests__/LocalConnectionStore.test.ts

@@ -148,7 +148,30 @@ describe("LocalConnectionStore secret field encryption", () => {
     expect(JSON.parse(raw.config).apiKey).not.toBe("sk-fresh");
   });
 
-  it("fails closed when stored secrets cannot be decrypted with the current key", async () => {
+  it("re-encrypts a legacy plaintext secret when the store is constructed", async () => {
+    db.run(
+      "INSERT INTO connection_configs (id, tenant_id, type, key, name, description, config, secret_fields, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "legacy-secret-id", "t", "business-objects", "legacy", "Legacy", null,
+      JSON.stringify({ boStoreKey: "plain-store-key", baseUrl: "https://bo.example" }),
+      JSON.stringify(["boStoreKey"]),
+      "2024-01-01T00:00:00.000Z", "2024-01-01T00:00:00.000Z",
+    );
+
+    const upgraded = new LocalConnectionStore(db);
+
+    const raw = db
+      .prepare("SELECT config FROM connection_configs WHERE id = ?")
+      .get("legacy-secret-id") as { config: string };
+    const parsed = JSON.parse(raw.config) as Record<string, unknown>;
+    expect(parsed.boStoreKey).not.toBe("plain-store-key");
+    expect(decrypt(parsed.boStoreKey as string)).toBe("plain-store-key");
+    expect(parsed.baseUrl).toBe("https://bo.example");
+
+    const read = await upgraded.getByKey("t", "business-objects", "legacy");
+    expect(read?.config.boStoreKey).toBe("plain-store-key");
+  });
+
+  it("empties an undecryptable secret field but still lists the connection", async () => {
     const previous = process.env.LATTICE_ENCRYPTION_KEY;
     try {
       process.env.LATTICE_ENCRYPTION_KEY = "test-key-one";
@@ -158,15 +181,22 @@ describe("LocalConnectionStore secret field encryption", () => {
         type: "semantic-metrics",
         key: "conn",
         name: "Conn",
-        config: { apiKey: "sk-one" },
+        config: { baseUrl: "https://metrics.example/api/v1", apiKey: "sk-one" },
         secretFields: ["apiKey"],
       });
 
       process.env.LATTICE_ENCRYPTION_KEY = "test-key-two";
       clearEncryptionKeyCache();
 
-      await expect(store.getByKey("t", "semantic-metrics", "conn"))
-        .rejects.toThrow("Failed to decrypt connection configuration");
+      // A wrong key no longer throws; the secret is empty but the entry (and
+      // its non-secret fields) is still visible so connections can be listed.
+      const read = await store.getByKey("t", "semantic-metrics", "conn");
+      expect(read?.config.apiKey).toBe("");
+      expect(read?.config.baseUrl).toBe("https://metrics.example/api/v1");
+
+      const listed = await store.listByType("t", "semantic-metrics");
+      expect(listed).toHaveLength(1);
+      expect(listed[0].config.apiKey).toBe("");
     } finally {
       if (previous === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
       else process.env.LATTICE_ENCRYPTION_KEY = previous;

package/src/__tests__/LocalMcpServerConfigStore.test.ts

@@ -10,6 +10,7 @@ import path from "path";
 
 import { closeDatabase, initDatabase } from "../database";
 import { LocalMcpServerConfigStore } from "../stores/LocalMcpServerConfigStore";
+import { clearEncryptionKeyCache } from "@axiom-lattice/core";
 
 const nextDbPath = (): string => path.join(
   tmpdir(), `lt-mcp-config-${Date.now()}-${Math.random().toString(36).slice(2)}.db`,
@@ -74,4 +75,31 @@ describe("LocalMcpServerConfigStore secret handling", () => {
     const read = await store.getConfigByKey("tenant-1", "remote");
     expect(read?.config.headers?.Authorization).toBe("Bearer rotated-token");
   });
+
+  it("empties undecryptable secrets but still lists and returns the config", async () => {
+    const previous = process.env.LATTICE_ENCRYPTION_KEY;
+    try {
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-one";
+      clearEncryptionKeyCache();
+      await store.createConfig("tenant-1", "cfg-4", {
+        key: "remote",
+        config: { ...httpConfig, env: { MCP_TOKEN: "env-secret" } },
+      });
+
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-two";
+      clearEncryptionKeyCache();
+
+      const read = await store.getConfigByKey("tenant-1", "remote");
+      expect(read?.config.env?.MCP_TOKEN).toBe("");
+      expect(read?.config.headers?.Authorization).toBe("");
+      expect(read?.config.url).toBe("https://mcp.example.com/mcp");
+
+      const listed = await store.getAllConfigs("tenant-1");
+      expect(listed).toHaveLength(1);
+    } finally {
+      if (previous === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+      else process.env.LATTICE_ENCRYPTION_KEY = previous;
+      clearEncryptionKeyCache();
+    }
+  });
 });

package/src/__tests__/LocalModelProviderStore.test.ts

@@ -0,0 +1,65 @@
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import { tmpdir } from "os";
+import path from "path";
+
+import { closeDatabase, initDatabase, type DatabaseWrapper } from "../database";
+import { LocalModelProviderStore } from "../stores/LocalModelProviderStore";
+import { clearEncryptionKeyCache } from "@axiom-lattice/core";
+
+describe("LocalModelProviderStore secret handling", () => {
+  let store: LocalModelProviderStore;
+  let db: DatabaseWrapper;
+
+  beforeEach(async () => {
+    const dbPath = path.join(tmpdir(), `lt-model-${Date.now()}-${Math.random().toString(36).slice(2)}.db`);
+    db = await initDatabase({ dbPath });
+    store = new LocalModelProviderStore(db);
+  });
+
+  afterEach(() => closeDatabase());
+
+  async function createProvider(id: string, apiKey: string): Promise<void> {
+    await store.createProvider("t", id, {
+      name: `provider-${id}`,
+      protocol: "openai-compatible",
+      baseURL: `https://${id}.example.com/v1`,
+      apiKey,
+    });
+  }
+
+  it("decrypts the API key on read", async () => {
+    await createProvider("p1", "sk-one");
+    const read = await store.getProviderById("t", "p1");
+    expect(read?.apiKey).toBe("sk-one");
+    expect(read?.baseURL).toBe("https://p1.example.com/v1");
+  });
+
+  it("empties an undecryptable API key but still lists the provider", async () => {
+    const previous = process.env.LATTICE_ENCRYPTION_KEY;
+    try {
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-one";
+      clearEncryptionKeyCache();
+      await createProvider("p1", "sk-one");
+
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-two";
+      clearEncryptionKeyCache();
+
+      const read = await store.getProviderById("t", "p1");
+      expect(read?.apiKey).toBe("");
+      expect(read?.baseURL).toBe("https://p1.example.com/v1");
+
+      const listed = await store.listProviders("t");
+      expect(listed).toHaveLength(1);
+    } finally {
+      if (previous === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+      else process.env.LATTICE_ENCRYPTION_KEY = previous;
+      clearEncryptionKeyCache();
+    }
+  });
+});

package/src/stores/LocalA2AApiKeyStore.ts

@@ -12,7 +12,7 @@ import type {
   OpenGrant,
 } from "@axiom-lattice/protocols";
 import { ensureTable, nowISO, parseISO } from "../database";
-import { encrypt, decrypt } from "@axiom-lattice/core";
+import { encrypt, decrypt, safeDecrypt } from "@axiom-lattice/core";
 import { randomUUID } from "crypto";
 
 const DDL = `
@@ -241,11 +241,9 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
 }
 
 function mapRowToRecord(row: KeyRow): A2AApiKeyRecord {
-  let key = "";
-  try { key = decrypt(row.key_value); } catch { key = row.key_value; }
   return {
     id: row.id,
-    key,
+    key: safeDecrypt(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),

package/src/stores/LocalConnectionStore.ts

@@ -4,7 +4,7 @@
 import { DatabaseWrapper, ensureTable, nowISO } from "../database";
 import type { ConnectionEntry, ConnectionStore } from "@axiom-lattice/protocols";
 import { v4 as uuid } from "uuid";
-import { encryptConfigFields, decryptConfigFields } from "@axiom-lattice/core";
+import { encryptConfigFields, decryptConfigFields, encrypt, isEncryptedValue } from "@axiom-lattice/core";
 
 const DDL = `
 CREATE TABLE IF NOT EXISTS connection_configs (
@@ -58,6 +58,7 @@ export class LocalConnectionStore implements ConnectionStore {
     this.db = db;
     ensureTable(db, DDL);
     this.ensureColumn("connection_configs", "secret_fields", "secret_fields TEXT");
+    this.reencryptLegacySecrets();
   }
 
   private ensureColumn(table: string, column: string, ddl: string): void {
@@ -67,6 +68,49 @@ export class LocalConnectionStore implements ConnectionStore {
     }
   }
 
+  /**
+   * Re-encrypt declared secret fields that are still stored as plaintext.
+   *
+   * A plugin can mark a field as a secret after connections already exist (e.g.
+   * a field renamed from a plaintext key to a password), leaving legacy rows
+   * with plaintext where ciphertext is now expected. This one-time, idempotent
+   * pass encrypts any declared secret field that does not look like our
+   * ciphertext; values that do look encrypted are left untouched, so genuine
+   * ciphertext written under another key is never destroyed.
+   */
+  private reencryptLegacySecrets(): void {
+    const rows = this.db.prepare(
+      `SELECT id, tenant_id, config, secret_fields FROM connection_configs WHERE secret_fields IS NOT NULL`,
+    ).all() as unknown as Array<{ id: string; tenant_id: string; config: string; secret_fields: string | null }>;
+
+    for (const row of rows) {
+      const secretFields = parseSecretFields(row.secret_fields);
+      if (!secretFields?.length) continue;
+
+      let config: Record<string, unknown>;
+      try {
+        config = JSON.parse(row.config) as Record<string, unknown>;
+      } catch {
+        continue;
+      }
+
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !isEncryptedValue(value)) {
+          config[field] = encrypt(value);
+          changed = true;
+        }
+      }
+
+      if (changed) {
+        this.db.prepare(
+          `UPDATE connection_configs SET config = ?, updated_at = ? WHERE tenant_id = ? AND id = ?`,
+        ).run(JSON.stringify(config), nowISO(), row.tenant_id, row.id);
+      }
+    }
+  }
+
   async listByTenant(tenantId: string): Promise<ConnectionEntry[]> {
     const rows = this.db.prepare(
       `SELECT * FROM connection_configs WHERE tenant_id = ? ORDER BY created_at`,

package/src/stores/LocalMcpServerConfigStore.ts

@@ -11,7 +11,7 @@ import type {
   McpServerConfig,
 } from "@axiom-lattice/protocols";
 import { ensureTable, nowISO, parseISO } from "../database";
-import { encrypt, decrypt } from "@axiom-lattice/core";
+import { encrypt, safeDecrypt } from "@axiom-lattice/core";
 
 const DDL = `
 CREATE TABLE IF NOT EXISTS lt_mcp_configs (
@@ -179,29 +179,19 @@ function mapRowToEntry(row: ConfigRow): McpServerConfigEntry {
   const config: McpServerConfig = JSON.parse(row.config);
 
   if (config.env && row.is_env_encrypted) {
-    try {
-      const decryptedEnv: Record<string, string> = {};
-      for (const [key, value] of Object.entries(config.env)) {
-        decryptedEnv[key] = decrypt(value);
-      }
-      config.env = decryptedEnv;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server env:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedEnv: Record<string, string> = {};
+    for (const [key, value] of Object.entries(config.env)) {
+      decryptedEnv[key] = safeDecrypt(value);
     }
+    config.env = decryptedEnv;
   }
 
   if (config.headers && row.is_env_encrypted) {
-    try {
-      const decryptedHeaders: Record<string, string> = {};
-      for (const [key, value] of Object.entries(config.headers)) {
-        decryptedHeaders[key] = decrypt(value);
-      }
-      config.headers = decryptedHeaders;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server headers:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedHeaders: Record<string, string> = {};
+    for (const [key, value] of Object.entries(config.headers)) {
+      decryptedHeaders[key] = safeDecrypt(value);
     }
+    config.headers = decryptedHeaders;
   }
 
   return {

package/src/stores/LocalModelProviderStore.ts

@@ -16,7 +16,7 @@ import type {
   ProviderModelInput,
 } from "@axiom-lattice/protocols";
 import { ensureTable, nowISO, parseISO } from "../database";
-import { encrypt, decrypt } from "@axiom-lattice/core";
+import { encrypt, safeDecrypt } from "@axiom-lattice/core";
 
 const DDL = `
 CREATE TABLE IF NOT EXISTS lt_model_providers (
@@ -457,12 +457,7 @@ function mapRowToEntry(row: ProviderRow): ModelProviderEntry {
   let apiKey: string | undefined;
 
   if (row.api_key_enc) {
-    try {
-      apiKey = decrypt(row.api_key_enc);
-    } catch (error) {
-      console.error("Failed to decrypt model provider API key:", error);
-      throw new Error("Failed to decrypt model provider API key");
-    }
+    apiKey = safeDecrypt(row.api_key_enc);
   }
 
   return {