@bevel-software/platform-core-backend 0.1.0

package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts

@@ -0,0 +1,92 @@
+import type { Database } from '../database/connection.js';
+import { type ISecretsVaultService, type SecretSummary, type SecretConfigStatus, type PutStaticSecretInput, type PutSharedStaticSecretInput, type CreateOAuthSecretInput, type OAuthProviderConfig, type VariableScopeResolver } from './secrets-vault.contract.js';
+/**
+ * Postgres-backed `ISecretsVaultService`. Secret material is encrypted at rest
+ * with `TokenCrypto` (AES-256-GCM); a DB leak alone yields only ciphertext. Per-
+ * user isolation is enforced by including `userId` in every WHERE clause — a
+ * `get`/`remove` for another user's row matches zero rows and reads as "not
+ * found", exactly like a row that doesn't exist.
+ *
+ * Two provisioning tiers share the `secrets` table (see the schema): per-user
+ * rows (`user_id` set) and shared/admin rows (`user_id NULL`). At `resolve` time
+ * the injected `scopeOf` decides which tier a variable reads — an `admin` var
+ * reads the one shared row; a `user` var reads only the caller's row.
+ */
+export declare class DbSecretsVaultService implements ISecretsVaultService {
+    private readonly db;
+    /** 32-byte AES key (hex/base64); empty disables secret read/write with a clear error. */
+    private readonly encKey;
+    private readonly now;
+    /**
+     * The provisioning scope of a UTCP-namespaced key (`<manual>_<VAR>`). Bound
+     * to the tool-manuals catalog at composition. Absent ⇒ everything is `admin`
+     * (shared) — the safe default (never falls through to a per-user row for an
+     * unclassified var).
+     */
+    private readonly scopeOf?;
+    private cryptoInstance;
+    constructor(db: Database, 
+    /** 32-byte AES key (hex/base64); empty disables secret read/write with a clear error. */
+    encKey: string, now?: () => number, 
+    /**
+     * The provisioning scope of a UTCP-namespaced key (`<manual>_<VAR>`). Bound
+     * to the tool-manuals catalog at composition. Absent ⇒ everything is `admin`
+     * (shared) — the safe default (never falls through to a per-user row for an
+     * unclassified var).
+     */
+    scopeOf?: VariableScopeResolver | undefined);
+    /** Lazily build the cipher — an empty key fails loudly only when a secret is actually touched. */
+    private crypto;
+    list(userId: string): Promise<SecretSummary[]>;
+    getById(userId: string, id: string): Promise<SecretSummary | null>;
+    putStatic(input: PutStaticSecretInput): Promise<SecretSummary>;
+    createOAuth(input: CreateOAuthSecretInput): Promise<SecretSummary>;
+    remove(userId: string, id: string): Promise<void>;
+    putSharedStatic(input: PutSharedStaticSecretInput): Promise<SecretSummary>;
+    removeShared(key: string): Promise<void>;
+    removeUserByKey(userId: string, key: string): Promise<void>;
+    statusFor(userId: string, keys: string[]): Promise<SecretConfigStatus[]>;
+    /**
+     * Decrypt+parse an oauth row's token set once, or undefined if the blob can't be
+     * read — a corrupted row or rotated encKey must degrade to "not authorized", not throw.
+     * Callers derive `authorized` / `grantedScopes` from this so decrypt happens once per row.
+     */
+    private readTokensSafe;
+    beginOAuth(userId: string, id: string, redirectUri: string, state: string): Promise<string>;
+    completeOAuth(userId: string, id: string, code: string, redirectUri: string): Promise<void>;
+    putSharedOAuthClientSecret(input: {
+        key: string;
+        clientSecret: string;
+        provider: OAuthProviderConfig;
+    }): Promise<void>;
+    beginToolOAuthByKey(input: {
+        userId: string;
+        key: string;
+        redirectUri: string;
+        state: string;
+        scopes?: string[];
+    }): Promise<{
+        id: string;
+        url: string;
+    }>;
+    resolve(userId: string, key: string): Promise<string | null>;
+    putSharedOAuthProvider(input: {
+        key: string;
+        label?: string | null;
+        provider: OAuthProviderConfig;
+    }): Promise<void>;
+    getSharedOAuthProvider(key: string): Promise<OAuthProviderConfig | null>;
+    private tokenRequest;
+    private row;
+    private requireRow;
+    private readBlob;
+    private readMeta;
+    private publicProviderMeta;
+    private requireProvider;
+    private requireUrl;
+    private requireUserId;
+    private requireKey;
+    private normaliseLabel;
+    private toSummary;
+}
+//# sourceMappingURL=db-secrets-vault.service.d.ts.map

package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-secrets-vault.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAI3B,MAAM,6BAA6B,CAAC;AAqCrC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAI9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAb3B,OAAO,CAAC,cAAc,CAA4B;gBAG/B,EAAE,EAAE,QAAQ;IAC7B,yFAAyF;IACxE,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB;IAC7C;;;;;OAKG;IACc,OAAO,CAAC,EAAE,qBAAqB,YAAA;IAGlD,kGAAkG;IAClG,OAAO,CAAC,MAAM;IAYR,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAS9C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKlE,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwB9D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAuBlE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB1E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA4B9E;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQhB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiD3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B3F,0BAA0B,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBX,mBAAmB,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAiGlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyG5D,sBAAsB,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBX,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAgBhE,YAAY;YA2CZ,GAAG;YASH,UAAU;IAMxB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;CAelB"}