@axiom-lattice/pg-stores 3.3.1 → 3.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/pg-stores",
-  "version": "3.3.1",
+  "version": "3.3.3",
   "description": "PG stores implementation for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@langchain/core": "1.1.30",
     "pg": "^8.16.3",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "6.3.1",
-    "@axiom-lattice/protocols": "4.7.0"
+    "@axiom-lattice/core": "6.3.3",
+    "@axiom-lattice/protocols": "4.7.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/PostgreSQLConnectionStore.integration.test.ts

@@ -0,0 +1,106 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { PostgreSQLConnectionStore } from "../stores/PostgreSQLConnectionStore";
+import {
+  createConnectionConfigsTable,
+  addConnectionSecretFields,
+} from "../migrations/connection_config_migrations";
+import { decrypt } from "@axiom-lattice/core";
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLConnectionStore secret field encryption", () => {
+  let pool: Pool;
+  let store: PostgreSQLConnectionStore;
+  const tenantId = `conn-secrets-${randomUUID()}`;
+  const type = "semantic-metrics";
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const client = await pool.connect();
+    try {
+      await createConnectionConfigsTable.up(client);
+      await addConnectionSecretFields.up(client);
+    } finally {
+      client.release();
+    }
+    store = new PostgreSQLConnectionStore(pool);
+  });
+
+  afterEach(async () => {
+    await pool.query("DELETE FROM lattice_connection_configs WHERE tenant_id = $1", [tenantId]);
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  it("encrypts declared secret fields at rest and decrypts them on read", async () => {
+    const created = await store.create({
+      tenantId,
+      type,
+      key: "conn",
+      name: "Conn",
+      config: { baseUrl: "https://metrics.example/api/v1", apiKey: "sk-real-secret" },
+      secretFields: ["apiKey"],
+    });
+
+    const raw = await pool.query<{ config: Record<string, unknown>; secret_fields: string[] }>(
+      "SELECT config, secret_fields FROM lattice_connection_configs WHERE tenant_id = $1 AND key = $2",
+      [tenantId, "conn"],
+    );
+    expect(raw.rows[0].config.baseUrl).toBe("https://metrics.example/api/v1");
+    expect(raw.rows[0].config.apiKey).not.toBe("sk-real-secret");
+    expect(decrypt(raw.rows[0].config.apiKey as string)).toBe("sk-real-secret");
+    expect(raw.rows[0].secret_fields).toEqual(["apiKey"]);
+
+    expect(created.config.apiKey).toBe("sk-real-secret");
+
+    const read = await store.getByKey(tenantId, type, "conn");
+    expect(read?.config.apiKey).toBe("sk-real-secret");
+    expect(read?.secretFields).toEqual(["apiKey"]);
+
+    const [listed] = await store.listByType(tenantId, type);
+    expect(listed.config.apiKey).toBe("sk-real-secret");
+  });
+
+  it("reuses stored secret fields when an update omits them", async () => {
+    await store.create({
+      tenantId,
+      type,
+      key: "conn",
+      name: "Conn",
+      config: { apiKey: "sk-one" },
+      secretFields: ["apiKey"],
+    });
+
+    const updated = await store.update(tenantId, type, "conn", { config: { apiKey: "sk-two" } });
+    expect(updated?.config.apiKey).toBe("sk-two");
+
+    const raw = await pool.query<{ config: Record<string, unknown> }>(
+      "SELECT config FROM lattice_connection_configs WHERE tenant_id = $1 AND key = $2",
+      [tenantId, "conn"],
+    );
+    expect(decrypt(raw.rows[0].config.apiKey as string)).toBe("sk-two");
+  });
+
+  it("returns legacy rows without secret fields unchanged", async () => {
+    await pool.query(
+      `INSERT INTO lattice_connection_configs (id, tenant_id, type, key, name, config, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`,
+      [randomUUID(), tenantId, type, "legacy", "Legacy", JSON.stringify({ apiKey: "sk-legacy" })],
+    );
+
+    const read = await store.getByKey(tenantId, type, "legacy");
+    expect(read?.config.apiKey).toBe("sk-legacy");
+    expect(read?.secretFields).toBeUndefined();
+  });
+});

package/src/createPgStoreConfig.ts

@@ -55,7 +55,7 @@ import { createChannelInstallationsTable } from "./migrations/channel_installati
 import { alterChannelInstallationsTable } from "./migrations/channel_installations_alter_migration";
 import { createChannelBindingsTable } from "./migrations/channel_bindings_migration";
 import { createDatabaseConfigsTable } from "./migrations/database_config_migrations";
-import { createConnectionConfigsTable } from "./migrations/connection_config_migrations";
+import { createConnectionConfigsTable, addConnectionSecretFields } from "./migrations/connection_config_migrations";
 import { createMetricsConfigsTable } from "./migrations/metrics_config_migrations";
 import { createMcpServerConfigsTable } from "./migrations/mcp_server_config_migrations";
 import { registerThreadMessageQueueMigrations } from "./migrations/queue_migrations";
@@ -178,6 +178,7 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(addModelProviderModelStale);      // v184
   mm.register(createDistributedLeases);        // v185
   mm.register(createOutboxTable);              // v187
+  mm.register(addConnectionSecretFields);      // v188
 
   await mm.migrate();
 

package/src/migrations/connection_config_migrations.ts

@@ -48,3 +48,28 @@ export const createConnectionConfigsTable: Migration = {
     await client.query("DROP TABLE IF EXISTS lattice_connection_configs");
   },
 };
+
+/**
+ * Tracks which config fields a connection holds secrets in.
+ *
+ * The gateway derives this list from a plugin's connection schema (password
+ * fields) and passes it on write; the store then encrypts those fields at rest
+ * and decrypts them on read, so the API always returns real values. Existing
+ * rows keep NULL (plaintext) and are converted on their next save.
+ */
+export const addConnectionSecretFields: Migration = {
+  version: 188,
+  name: "add_connection_secret_fields",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_connection_configs
+        ADD COLUMN IF NOT EXISTS secret_fields JSONB
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_connection_configs
+        DROP COLUMN IF EXISTS secret_fields
+    `);
+  },
+};

package/src/stores/PostgreSQLConnectionStore.ts

@@ -5,6 +5,7 @@
 import { Pool } from "pg";
 import type { ConnectionEntry, ConnectionStore } from "@axiom-lattice/protocols";
 import { v4 as uuid } from "uuid";
+import { encryptConfigFields, decryptConfigFields } from "@axiom-lattice/core";
 
 interface ConnectionRow {
   id: string;
@@ -14,6 +15,7 @@ interface ConnectionRow {
   name: string;
   description: string | null;
   config: unknown;
+  secret_fields: string[] | string | null;
   status: string;
   last_test_result: unknown;
   metadata: unknown;
@@ -58,17 +60,21 @@ export class PostgreSQLConnectionStore implements ConnectionStore {
   async create(entry: Omit<ConnectionEntry, "id" | "createdAt" | "updatedAt">): Promise<ConnectionEntry> {
     const id = uuid();
     const now = new Date().toISOString();
+    const secretFields = entry.secretFields?.length ? entry.secretFields : undefined;
 
     await this.db.query(
-      `INSERT INTO ${TABLE} (id, tenant_id, type, key, name, description, config, status, created_at, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, 'active', $8::timestamp, $9::timestamp)`,
+      `INSERT INTO ${TABLE} (id, tenant_id, type, key, name, description, config, secret_fields, status, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, 'active', $9::timestamp, $10::timestamp)`,
       [
         id, entry.tenantId, entry.type, entry.key, entry.name,
-        entry.description || null, JSON.stringify(entry.config), now, now,
+        entry.description || null,
+        JSON.stringify(encryptConfigFields(entry.config, secretFields)),
+        secretFields ? JSON.stringify(secretFields) : null,
+        now, now,
       ],
     );
 
-    return { id, ...entry, createdAt: now, updatedAt: now };
+    return { id, ...entry, secretFields, createdAt: now, updatedAt: now };
   }
 
   async update(
@@ -90,8 +96,13 @@ export class PostgreSQLConnectionStore implements ConnectionStore {
       values.push(updates.description || null);
     }
     if (updates.config !== undefined) {
+      const secretFields = updates.secretFields?.length
+        ? updates.secretFields
+        : (existing.secretFields?.length ? existing.secretFields : undefined);
       setClauses.push(`config = $${paramIndex++}`);
-      values.push(JSON.stringify(updates.config));
+      values.push(JSON.stringify(encryptConfigFields(updates.config, secretFields)));
+      setClauses.push(`secret_fields = $${paramIndex++}::jsonb`);
+      values.push(secretFields ? JSON.stringify(secretFields) : null);
     }
 
     if (setClauses.length === 0) return existing;
@@ -121,6 +132,13 @@ export class PostgreSQLConnectionStore implements ConnectionStore {
   }
 
   private mapRow(row: ConnectionRow): ConnectionEntry {
+    const parsedSecretFields = typeof row.secret_fields === "string"
+      ? (JSON.parse(row.secret_fields) as unknown)
+      : row.secret_fields;
+    const secretFields = Array.isArray(parsedSecretFields) && parsedSecretFields.length > 0
+      ? parsedSecretFields.filter((field): field is string => typeof field === "string")
+      : undefined;
+    const storedConfig = (typeof row.config === "string" ? JSON.parse(row.config) : row.config) as Record<string, unknown>;
     return {
       id: row.id,
       tenantId: row.tenant_id,
@@ -128,7 +146,8 @@ export class PostgreSQLConnectionStore implements ConnectionStore {
       key: row.key,
       name: row.name,
       description: row.description || undefined,
-      config: (typeof row.config === "string" ? JSON.parse(row.config) : row.config) as Record<string, unknown>,
+      config: decryptConfigFields(storedConfig, secretFields),
+      secretFields,
       createdAt: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at),
       updatedAt: row.updated_at instanceof Date ? row.updated_at.toISOString() : String(row.updated_at),
     };