@cosmicdrift/kumiko-dev-server 0.110.0 → 0.112.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.110.0",
+  "version": "0.112.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.110.0",
-    "@cosmicdrift/kumiko-framework": "0.110.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.112.0",
+    "@cosmicdrift/kumiko-framework": "0.112.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/boot/apply-boot-seeds.ts

@@ -1,6 +1,7 @@
 import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
-import type { DbConnection, EncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 
 // Single boot-seed entry-point. runDevApp + runProdApp both call this
 // from their post-stack hook, so the wiring lives in exactly one place
@@ -12,7 +13,7 @@ import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 export async function applyBootSeeds(deps: {
   registry: Registry;
   db: DbConnection;
-  encryption?: EncryptionProvider;
+  cipher?: EnvelopeCipher;
 }): Promise<void> {
-  await seedAllConfigValues(deps.registry, deps.db, deps.encryption);
+  await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
 }

package/src/boot/boot-crypto.ts

@@ -0,0 +1,82 @@
+// One place that turns env/options into the app-wide crypto objects:
+// the MasterKeyProvider (KUMIKO_SECRETS_MASTER_KEY_V<n> keyring) and the
+// EnvelopeCipher for `encrypted: true` config keys. runProdApp and
+// runDevApp both resolve this once and thread it into
+// buildBootExtraContext + applyBootSeeds so resolver, set-handler and
+// seeds share the same cipher instance (and DEK cache).
+
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createDekCache,
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+  type DekCache,
+  type EnvelopeCipher,
+  type MasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+
+// Keyring detection without throwing: only build the env provider when at
+// least one versioned KEK is actually set. Covers (a) apps without any
+// encryption — no KEK requirement, and (b) dev with an app-supplied
+// provider in options.masterKey — env stays irrelevant.
+const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
+export function envHasMasterKek(env: Record<string, string | undefined>): boolean {
+  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
+}
+
+export type BootCrypto = {
+  readonly masterKeyProvider?: MasterKeyProvider;
+  // Cipher for encrypted config keys. Present exactly when a master key is
+  // available. Decrypts legacy CONFIG_ENCRYPTION_KEY values as fallback
+  // until the config re-encrypt job migrated them.
+  readonly configCipher?: EnvelopeCipher;
+  // Cipher for `encrypted: true` entity fields — same master key, but the
+  // legacy fallback reads the pre-envelope ENCRYPTION_KEY format. Identical
+  // to configCipher when no ENCRYPTION_KEY is set.
+  readonly entityFieldCipher?: EnvelopeCipher;
+  readonly dekCache: DekCache;
+};
+
+export function resolveBootCrypto(
+  envSource: Record<string, string | undefined>,
+  masterKeyOverride?: MasterKeyProvider,
+): BootCrypto {
+  const masterKeyProvider =
+    masterKeyOverride ??
+    (envHasMasterKek(envSource)
+      ? createEnvMasterKeyProvider({
+          // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
+          // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
+          env: {
+            ...envSource,
+            KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
+              envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
+          },
+        })
+      : undefined);
+
+  const dekCache = createDekCache();
+  const legacyConfigKey = envSource["CONFIG_ENCRYPTION_KEY"];
+  const configCipher = masterKeyProvider
+    ? createEnvelopeCipher(masterKeyProvider, {
+        dekCache,
+        ...(legacyConfigKey ? { legacy: createEncryptionProvider(legacyConfigKey) } : {}),
+      })
+    : undefined;
+
+  const legacyEntityKey = envSource["ENCRYPTION_KEY"];
+  const entityFieldCipher =
+    masterKeyProvider && legacyEntityKey
+      ? createEnvelopeCipher(masterKeyProvider, {
+          dekCache,
+          legacy: createEncryptionProvider(legacyEntityKey),
+        })
+      : configCipher;
+
+  return {
+    ...(masterKeyProvider && { masterKeyProvider }),
+    ...(configCipher && { configCipher }),
+    ...(entityFieldCipher && { entityFieldCipher }),
+    dekCache,
+  };
+}

package/src/run-dev-app.ts

@@ -37,6 +37,7 @@ import {
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import type { PatResolver, SessionMetadata } from "@cosmicdrift/kumiko-framework/api";
 import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectWriteHandlerQns,
   createRegistry,
@@ -50,10 +51,11 @@ import {
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
+import { resolveBootCrypto } from "./boot/boot-crypto";
 
 import { watchAndRegenerate } from "./codegen";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
@@ -311,8 +313,17 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // throwaway-Registry hier extrahiert nur die config-Keys, weil der
   // configResolver vor dem Server-Boot konstruiert wird (stack.registry
   // gibt's erst onAfterSetup) — createKumikoServer baut intern seine eigene.
+  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+  // App-wide cipher for `encrypted: true` entity fields (symmetrisch zu
+  // runProdApp) — executors resolve it lazily.
+  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const cfgExtra = effectiveAuth
-    ? mergeConfigResolverDefault(options.extraContext, createRegistry(features), envSource)
+    ? mergeConfigResolverDefault(
+        options.extraContext,
+        createRegistry(features),
+        envSource,
+        bootCrypto.configCipher,
+      )
     : options.extraContext;
   // Auto-wire textContent (immer) + secrets (feature-gated), symmetrisch zu
   // runProdApp. Anders als prod existiert die db hier erst im Factory-deps
@@ -327,7 +338,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       registry: deps.registry,
       hasAuth: false,
       sseBroker: deps.sseBroker,
-      ...(options.masterKey && { masterKey: options.masterKey }),
+      crypto: bootCrypto,
     });
     const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
     return { ...boot, ...base };
@@ -482,7 +493,11 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       // Runs before user-supplied seed callbacks so those can read /
       // override the deploy-defaults. The helper indirection is what
       // config-seed-boot.integration.ts pins — keep it as a single call.
-      await applyBootSeeds({ registry: stack.registry, db: stack.db });
+      await applyBootSeeds({
+        registry: stack.registry,
+        db: stack.db,
+        ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
+      });
       for (const seed of options.seeds ?? []) {
         await seed(stack);
       }
@@ -518,10 +533,12 @@ export function mergeConfigResolverDefault(
   ctx: CreateKumikoServerOptions["extraContext"],
   registry: Registry,
   envSource: Record<string, string | undefined>,
+  cipher?: EnvelopeCipher,
 ): CreateKumikoServerOptions["extraContext"] {
   const defaults = {
     configResolver: createConfigResolver({
       appOverrides: buildEnvConfigOverrides(registry, envSource),
+      ...(cipher && { cipher }),
     }),
   };
   // ctx.config wird per-Request aus _configAccessorFactory geminted (siehe

package/src/run-prod-app.ts

@@ -78,6 +78,7 @@ import {
   type SseBroker,
 } from "@cosmicdrift/kumiko-framework/api";
 import {
+  configureEntityFieldEncryption,
   createDbConnection,
   type DbConnection,
   type DbRunner,
@@ -123,13 +124,11 @@ import {
   createEventDedup,
   createIdempotencyGuard,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import {
-  createEnvMasterKeyProvider,
-  type MasterKeyProvider,
-} from "@cosmicdrift/kumiko-framework/secrets";
+import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import Redis from "ioredis";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
+import { type BootCrypto, resolveBootCrypto } from "./boot/boot-crypto";
 import { ASSETS_DIR } from "./build-prod-bundle";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import { type ExtraRoutesSystemDeps, makeDispatchSystemWrite } from "./extra-routes-deps";
@@ -597,18 +596,13 @@ export function addConfigAccessorFactory<T extends { readonly configResolver?: C
 // nur einen db-gebundenen Accessor). secrets wird nur auto-verdrahtet wenn
 // das secrets-Feature gemountet ist UND ein KEK tatsächlich verfügbar ist
 // (masterKey-Override ODER env-KEK present) — sonst skip, damit der eager
-// createEnvMasterKeyProvider nicht wirft. Das deckt zwei Fälle: (a) App ohne
-// secrets → kein KEK-Zwang; (b) dev mit App-eigenem DEV-KEK in extraContext
-// (kein env-KEK) → kein Boot-Crash, die App-explizite secrets-Wiring gewinnt.
+// KEK-Detection + Provider/Cipher-Aufbau leben in boot/boot-crypto.ts
+// (envHasMasterKek, resolveBootCrypto) — gemeinsam mit runDevApp.
 // Prod-Misconfig (secrets gemountet, kein KEK) fängt schon secretsEnvSchema
 // beim Boot; fehlt der env-Schema-Pfad, wirft requireSecretsContext beim
 // ersten ctx.secrets-Zugriff mit Wiring-Hinweis. configResolver nur im
 // Auth-Mode. Exportiert + pure für Unit-Tests; der merge mit App-Werten
 // passiert beim Caller (App gewinnt).
-const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
-function envHasMasterKek(env: Record<string, string | undefined>): boolean {
-  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
-}
 
 // Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
 // in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
@@ -635,12 +629,16 @@ export function buildBootExtraContext(opts: {
   readonly envSource: Record<string, string | undefined>;
   readonly registry: Registry;
   readonly hasAuth: boolean;
+  // Resolved once per boot via resolveBootCrypto — shared by secrets,
+  // config-resolver, config-set-handler and boot-seeds. Absent (tests
+  // that don't care about encryption) ⇒ resolved from envSource here.
+  readonly crypto?: BootCrypto;
   readonly masterKey?: MasterKeyProvider;
   readonly sseBroker?: SseBroker;
 }): Record<string, unknown> {
+  const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
-  const wireSecrets =
-    hasSecretsFeature && (opts.masterKey !== undefined || envHasMasterKek(opts.envSource));
+  const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
   return {
     textContent: createTextContentApi(opts.db),
@@ -651,25 +649,25 @@ export function buildBootExtraContext(opts: {
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
       }),
     }),
-    ...(wireSecrets && {
-      secrets: createSecretsContext({
-        db: opts.db,
-        masterKeyProvider:
-          opts.masterKey ??
-          createEnvMasterKeyProvider({
-            // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
-            // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
-            env: {
-              ...opts.envSource,
-              KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
-                opts.envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
-            },
-          }),
+    // Top-level provider so feature jobs (secrets rotate, config reencrypt)
+    // reach it via ctx — previously only test-stack wired it.
+    ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
+    // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
+    // whenever a master key exists — NOT gated on the secrets feature,
+    // config encryption must work without mounting ctx.secrets.
+    ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
+    ...(wireSecrets &&
+      crypto.masterKeyProvider && {
+        secrets: createSecretsContext({
+          db: opts.db,
+          masterKeyProvider: crypto.masterKeyProvider,
+          dekCache: crypto.dekCache,
+        }),
       }),
-    }),
     ...(opts.hasAuth && {
       configResolver: createConfigResolver({
         appOverrides: buildEnvConfigOverrides(opts.registry, opts.envSource),
+        ...(crypto.configCipher && { cipher: crypto.configCipher }),
       }),
     }),
   };
@@ -920,6 +918,10 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
 
   // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
   // gewinnen immer (z.B. money-horse's eigener configResolver).
+  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+  // App-wide cipher for `encrypted: true` entity fields — executors resolve
+  // it lazily, entities without encrypted fields never touch it.
+  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const autoExtraContext = buildBootExtraContext({
     db,
     features,
@@ -927,7 +929,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     registry,
     hasAuth: !!effectiveAuth,
     sseBroker,
-    ...(options.masterKey && { masterKey: options.masterKey }),
+    crypto: bootCrypto,
   });
   const extraContext = addConfigAccessorFactory(
     { ...autoExtraContext, ...resolvedExtraContext },
@@ -1106,7 +1108,11 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   if (effectiveAuth) {
     await seedAdmin(db, effectiveAuth.admin);
   }
-  await applyBootSeeds({ registry, db });
+  await applyBootSeeds({
+    registry,
+    db,
+    ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
+  });
   for (const seed of options.seeds ?? []) {
     await seed({ db });
   }