@conduitplatform/module-tools 0.17.0-alpha.6 → 0.17.0-alpha.7

package/dist/index.cjs

@@ -48,6 +48,8 @@ __export(index_exports, {
   RouteBuilder: () => RouteBuilder,
   RoutingManager: () => RoutingManager,
   addServiceToServer: () => addServiceToServer,
+  containsRedactedMarker: () => containsRedactedMarker,
+  convictConfigParser: () => convictConfigParser,
   createParsedRouterRequest: () => createParsedRouterRequest,
   createServer: () => createServer,
   exportModel: () => exportModel,
@@ -57,7 +59,12 @@ __export(index_exports, {
   linearBackoffTimeoutAsync: () => linearBackoffTimeoutAsync,
   merge: () => merge,
   readConduitPeersManifest: () => readConduitPeersManifest,
+  reconcileStoredModuleConfig: () => reconcileStoredModuleConfig,
+  redactSensitiveConfig: () => redactSensitiveConfig,
+  restoreRedactedSecrets: () => restoreRedactedSecrets,
   sanitizeDocumentsForExport: () => sanitizeDocumentsForExport,
+  stableConfigJson: () => stableConfigJson,
+  storedConfigsEquivalent: () => storedConfigsEquivalent,
   stripInternalFields: () => stripInternalFields,
   wrapFunctionsAsync: () => wrapFunctionsAsync,
   wrapGrpcFunctions: () => wrapGrpcFunctions,
@@ -284,11 +291,19 @@ function wrapGrpcFunctions(functions, postponeRestart, noAuth = false) {
       try {
         invoked = functions[name](call, callback);
       } catch (error) {
-        return throwError(callback, error.message);
+        return throwError(
+          callback,
+          error.message,
+          error instanceof import_grpc_sdk3.GrpcError ? error.code : import_grpc_js2.status.INTERNAL
+        );
       }
       if (typeof invoked?.then === "function") {
         invoked.then().catch((error) => {
-          return throwError(callback, error.message);
+          return throwError(
+            callback,
+            error.message,
+            error instanceof import_grpc_sdk3.GrpcError ? error.code : import_grpc_js2.status.INTERNAL
+          );
         });
       }
     };
@@ -1775,6 +1790,110 @@ var convictConfigParser = (config) => {
   return config;
 };
 
+// src/utilities/redactSensitiveConfig.ts
+var WELL_KNOWN_SECRET_KEYS = /^(apiKey|api_key|password|secret|privateKey|private_key)$/i;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSchemaLeaf(value) {
+  return isRecord(value) && ("default" in value || "format" in value || "type" in value) && !isRecord(value._cvtProperties);
+}
+function isSensitiveLeaf(value) {
+  return isSchemaLeaf(value) && value.sensitive === true;
+}
+function unwrapSchema(schema) {
+  if (isRecord(schema) && isRecord(schema._cvtProperties)) {
+    return schema._cvtProperties;
+  }
+  return schema;
+}
+var REDACTED_MARKER = "[REDACTED]";
+function containsRedactedMarker(value) {
+  if (value === REDACTED_MARKER) return true;
+  if (Array.isArray(value)) {
+    return value.some(containsRedactedMarker);
+  }
+  if (!isRecord(value)) return false;
+  return Object.values(value).some(containsRedactedMarker);
+}
+function redactSensitiveConfig(config, schema) {
+  if (!isRecord(config)) return config;
+  const redacted = Array.isArray(config) ? [...config] : { ...config };
+  const node = unwrapSchema(schema);
+  for (const [key, value] of Object.entries(redacted)) {
+    const childSchema = isRecord(node) ? node[key] : void 0;
+    if (isSensitiveLeaf(childSchema) || WELL_KNOWN_SECRET_KEYS.test(key)) {
+      if (typeof value === "string" && value.length > 0) {
+        redacted[key] = REDACTED_MARKER;
+      }
+      continue;
+    }
+    if (isRecord(value) || Array.isArray(value)) {
+      redacted[key] = redactSensitiveConfig(
+        value,
+        childSchema
+      );
+    }
+  }
+  return redacted;
+}
+function restoreRedactedSecrets(incoming, current, schema) {
+  if (Array.isArray(incoming) && Array.isArray(current)) {
+    return incoming.map(
+      (item, index) => restoreRedactedSecrets(item, current[index], schema)
+    );
+  }
+  if (!isRecord(incoming) || !isRecord(current)) return incoming;
+  const restored = { ...incoming };
+  const node = unwrapSchema(schema);
+  for (const [key, value] of Object.entries(restored)) {
+    const childSchema = isRecord(node) ? node[key] : void 0;
+    const currentValue = current[key];
+    if (isSensitiveLeaf(childSchema) || WELL_KNOWN_SECRET_KEYS.test(key)) {
+      if (value === REDACTED_MARKER && typeof currentValue === "string" && currentValue.length > 0 && currentValue !== REDACTED_MARKER) {
+        restored[key] = currentValue;
+      }
+      continue;
+    }
+    if ((isRecord(value) || Array.isArray(value)) && (isRecord(currentValue) || Array.isArray(currentValue))) {
+      restored[key] = restoreRedactedSecrets(value, currentValue, childSchema);
+    }
+  }
+  return restored;
+}
+
+// src/utilities/reconcileModuleConfig.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sortJson(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJson);
+  }
+  if (!isRecord2(value)) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortJson(nested)])
+  );
+}
+function stableConfigJson(value) {
+  return JSON.stringify(sortJson(value));
+}
+function storedConfigsEquivalent(left, right) {
+  return stableConfigJson(left) === stableConfigJson(right);
+}
+async function reconcileStoredModuleConfig(args) {
+  if (storedConfigsEquivalent(args.stored, args.migrated)) {
+    return { config: args.migrated, persisted: false };
+  }
+  if (containsRedactedMarker(args.migrated)) {
+    return { config: args.migrated, persisted: false };
+  }
+  const persisted = await args.configureOverride(args.migrated);
+  return { config: persisted, persisted: true };
+}
+
 // src/routing/RoutingController.ts
 var import_grpc_js5 = require("@grpc/grpc-js");
 var RoutingController = class {
@@ -1827,6 +1946,9 @@ var ManagedModule = class extends ConduitServiceModule {
       throw new Error("Failed to initialize grpcSdk");
     }
   }
+  get configInitialized() {
+    return this._configInitialized;
+  }
   get name() {
     return this._moduleName;
   }
@@ -2018,9 +2140,10 @@ var ManagedModule = class extends ConduitServiceModule {
         });
       }
       let config = JSON.parse(call.request.newConfig);
-      config = merge(this.config.getProperties(), config);
-      config = await this.preConfig(config);
       const previousConfig = this.config.getProperties();
+      config = merge(previousConfig, config);
+      config = restoreRedactedSecrets(config, previousConfig, this.configSchema);
+      config = await this.preConfig(config);
       try {
         this.config.load(config).validate({
           allowed: "warn"
@@ -2096,7 +2219,21 @@ var ManagedModule = class extends ConduitServiceModule {
         this.configOverride
       );
       ConfigController.getInstance();
-      if (config) ConfigController.getInstance().config = config;
+      if (config) {
+        const migrated = await this.preConfig(config);
+        this.config.load(migrated).validate({
+          allowed: "warn"
+        });
+        const persistable = this.config.getProperties();
+        const reconciled = await reconcileStoredModuleConfig({
+          stored: config,
+          migrated: persistable,
+          configureOverride: (next) => this.grpcSdk.config.configure(next, convictConfigParser(configSchema), true)
+        });
+        config = reconciled.config;
+        this.config.load(config);
+        ConfigController.getInstance().config = this.config.getProperties();
+      }
       if (!config || config.active || !config.hasOwnProperty("active"))
         await this.onConfig();
     }
@@ -2141,6 +2278,8 @@ var ModuleError = class extends import_grpc_sdk15.GrpcError {
   RouteBuilder,
   RoutingManager,
   addServiceToServer,
+  containsRedactedMarker,
+  convictConfigParser,
   createParsedRouterRequest,
   createServer,
   exportModel,
@@ -2150,7 +2289,12 @@ var ModuleError = class extends import_grpc_sdk15.GrpcError {
   linearBackoffTimeoutAsync,
   merge,
   readConduitPeersManifest,
+  reconcileStoredModuleConfig,
+  redactSensitiveConfig,
+  restoreRedactedSecrets,
   sanitizeDocumentsForExport,
+  stableConfigJson,
+  storedConfigsEquivalent,
   stripInternalFields,
   wrapFunctionsAsync,
   wrapGrpcFunctions,