@cosmicdrift/kumiko-server-runtime 0.292.0 → 0.294.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.292.0",
+  "version": "0.294.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,9 +80,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.292.0",
-    "@cosmicdrift/kumiko-framework": "0.292.0",
-    "@cosmicdrift/kumiko-headless": "0.292.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.294.0",
+    "@cosmicdrift/kumiko-framework": "0.294.0",
+    "@cosmicdrift/kumiko-headless": "0.294.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/run-prod-app-kms-slots.test.ts

@@ -0,0 +1,108 @@
+// A schema field marked `kms` is decrypted once at boot and the RESOLVED env
+// feeds the master-key probe: a ciphertext-only KUMIKO_SECRETS_MASTER_KEY_V1
+// boots, and without any key the probe still fails. Boot-mode runs without
+// Postgres/Redis (see run-prod-app-env-source.test.ts).
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import type { ComposedEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { z } from "zod";
+import { runProdApp } from "../run-prod-app";
+import { withClearedBootEnv } from "./boot-probe-fixture";
+
+const MASTER_KEY = Buffer.alloc(32, 7).toString("base64");
+
+const encryptedFeature = defineFeature("kms-slots-probe", (r) => {
+  r.entity(
+    "note",
+    createEntity({
+      table: "kms_slots_probe_note",
+      fields: {
+        body: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
+      },
+    }),
+  );
+});
+
+const envSchema: ComposedEnvSchema = {
+  schema: z.object({
+    KUMIKO_SECRETS_MASTER_KEY_V1: z.string().meta({ kumiko: { kms: true } }),
+  }),
+  sources: {},
+};
+
+const BASE_ENV = {
+  KUMIKO_DRY_RUN_ENV: "boot",
+  DATABASE_URL: "postgres://smoke:smoke@127.0.0.1:1/smoke",
+  REDIS_URL: "redis://127.0.0.1:1",
+  JWT_SECRET: "smokesmokesmokesmokesmokesmokesmokesmoke",
+} as const;
+
+const originalFetch = globalThis.fetch;
+const originalLog = console.log;
+const originalInfo = console.info;
+
+function bootWith(env: Record<string, string>): ReturnType<typeof runProdApp> {
+  return runProdApp({
+    features: [encryptedFeature],
+    envSchema,
+    autoListen: false,
+    migrations: false,
+    envSource: { ...BASE_ENV, ...env },
+  });
+}
+
+describe("runProdApp kms slots", () => {
+  withClearedBootEnv();
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    console.log = originalLog;
+    console.info = originalInfo;
+  });
+
+  test("boots with a master key that exists only as Key Manager ciphertext", async () => {
+    const decrypted: string[] = [];
+    globalThis.fetch = (async (_url: string | URL, init?: RequestInit) => {
+      decrypted.push(JSON.parse(String(init?.body)).ciphertext);
+      return new Response(JSON.stringify({ plaintext: MASTER_KEY }), { status: 200 });
+    }) as unknown as typeof globalThis.fetch;
+    console.log = () => {};
+    console.info = () => {};
+
+    const handle = await bootWith({
+      KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: "Y2lwaGVy",
+      PLATFORM_KEK_KMS_KEY_ID: "key-1",
+      PLATFORM_KEK_KMS_TOKEN: "token",
+    });
+
+    await handle.stop();
+    expect(decrypted).toEqual(["Y2lwaGVy"]);
+  });
+
+  test("a plaintext master key boots without any Key Manager request", async () => {
+    let requests = 0;
+    globalThis.fetch = (async () => {
+      requests += 1;
+      throw new Error("must not be called");
+    }) as unknown as typeof globalThis.fetch;
+    console.log = () => {};
+    console.info = () => {};
+
+    const handle = await bootWith({
+      KUMIKO_SECRETS_MASTER_KEY_V1: MASTER_KEY,
+      KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: "Y2lwaGVy",
+    });
+
+    await handle.stop();
+    expect(requests).toBe(0);
+  });
+
+  test("without plaintext or ciphertext the boot probe still rejects", async () => {
+    console.log = () => {};
+    console.info = () => {};
+
+    await expect(bootWith({ KUMIKO_SECRETS_MASTER_KEY_V1: "" })).rejects.toThrow(
+      /no usable master key/,
+    );
+  });
+});

package/src/__tests__/run-worker-app-boot.test.ts

@@ -5,6 +5,7 @@
 
 import { describe, expect, spyOn, test } from "bun:test";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { runWorkerApp } from "../run-worker-app";
 import { makeProbeFeature, withClearedBootEnv } from "./boot-probe-fixture";
 
@@ -132,4 +133,51 @@ describe("runWorkerApp boot-mode", () => {
       console.log = originalLog;
     }
   });
+
+  test("kmsSlots: a master key that exists only as ciphertext reaches the boot probe", async () => {
+    const encryptedFeature = defineFeature("worker-kms-probe", (r) => {
+      r.entity(
+        "note",
+        createEntity({
+          table: "worker_kms_probe_note",
+          fields: {
+            body: createTextField({ personal: false, reason: "test_fixture", encrypted: true }),
+          },
+        }),
+      );
+    });
+    const originalFetch = globalThis.fetch;
+    const originalLog = console.log;
+    const originalInfo = console.info;
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ plaintext: Buffer.alloc(32, 7).toString("base64") }), {
+        status: 200,
+      })) as unknown as typeof globalThis.fetch;
+    console.log = () => {};
+    console.info = () => {};
+    const env = {
+      ...DUMMY_ENV,
+      KUMIKO_DRY_RUN_ENV: "boot",
+      KUMIKO_SECRETS_MASTER_KEY_V1_CIPHERTEXT: "Y2lwaGVy",
+      PLATFORM_KEK_KMS_KEY_ID: "key-1",
+      PLATFORM_KEK_KMS_TOKEN: "token",
+    };
+    try {
+      await expect(
+        runWorkerApp({ features: [encryptedFeature], migrations: false, envSource: env }),
+      ).rejects.toThrow(/no usable master key/);
+
+      const handle = await runWorkerApp({
+        features: [encryptedFeature],
+        migrations: false,
+        envSource: env,
+        kmsSlots: ["KUMIKO_SECRETS_MASTER_KEY_V1"],
+      });
+      await handle.stop();
+    } finally {
+      globalThis.fetch = originalFetch;
+      console.log = originalLog;
+      console.info = originalInfo;
+    }
+  });
 });

package/src/boot/__tests__/job-run-logger.integration.test.ts

@@ -22,7 +22,6 @@ import {
   createTextField,
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createDispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestDb,
@@ -56,7 +55,6 @@ beforeAll(async () => {
   testRedis = await createTestRedis();
   db = testDb.db;
   await unsafePushTables(db, { jobRunsTable, jobRunLogsTable });
-  await createEventsTable(db);
 });
 
 afterAll(async () => {

package/src/run-prod-app.ts

@@ -81,6 +81,7 @@ import {
   configureBlindIndexKey,
   configurePiiSubjectKms,
   type KmsAdapter,
+  resolvePlatformKeks,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   configureEntityFieldEncryption,
@@ -108,6 +109,7 @@ import {
 import {
   type ComposedEnvSchema,
   KumikoBootError,
+  kmsSlotsOf,
   parseEnv,
 } from "@cosmicdrift/kumiko-framework/env";
 import { type DryRunMode, renderDryRun } from "@cosmicdrift/kumiko-framework/env/dry-run";
@@ -706,8 +708,8 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   //    at parse-time before the polyfill loads. Plain strings + .regex /
   //    .min / .email / .url cover every env-var shape we've actually
   //    needed in 9.1's audit (37 references, 25 distinct vars).
-  const envSource = options.envSource ?? process.env;
-  const runMode = parseRunMode(envSource["KUMIKO_DRY_RUN_ENV"]);
+  const rawEnvSource = options.envSource ?? process.env;
+  const runMode = parseRunMode(rawEnvSource["KUMIKO_DRY_RUN_ENV"]);
   if (options.envSchema) {
     if (isRenderMode(runMode)) {
       // biome-ignore lint/suspicious/noConsole: dry-run output IS the deliverable
@@ -729,7 +731,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     // a real env-check (all required vars present + schema-valid) before
     // it asserts feature-wiring works.
     try {
-      parseEnv(options.envSchema.schema, envSource, {
+      parseEnv(options.envSchema.schema, rawEnvSource, {
         sources: options.envSchema.sources,
         ...(options.pulumiPrefix ? { pulumiPrefix: options.pulumiPrefix } : {}),
       });
@@ -742,6 +744,15 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     }
   }
 
+  // Slots the schema marks `kms` are decrypted once here so every consumer
+  // below (boot probe, master-key keyring, config) sees the same resolved env.
+  const envSource: Record<string, string | undefined> = options.envSchema
+    ? await resolvePlatformKeks(rawEnvSource, {
+        slots: kmsSlotsOf(options.envSchema.schema),
+        logPrefix: "[runProdApp]",
+      })
+    : rawEnvSource;
+
   // 1. Polyfill before anything else — feature code references Temporal.
   const { ensureTemporalPolyfill } = await import("@cosmicdrift/kumiko-framework/time");
   await ensureTemporalPolyfill();
@@ -818,7 +829,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     ...(composeAuthOptions && { authOptions: composeAuthOptions }),
   });
 
-  validateBoot(features, options.validateBootOptions);
+  validateBoot(features, { env: envSource, ...options.validateBootOptions });
   warnIfNonUtcServerTimeZone();
   validateAppCustomScreenWriteQns(process.cwd(), collectWriteHandlerQns(features));
   assertPiiBootInvariants(features, {

package/src/run-worker-app.ts

@@ -20,6 +20,7 @@ import {
   configureBlindIndexKey,
   configurePiiSubjectKms,
   type KmsAdapter,
+  resolvePlatformKeks,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   configureEntityFieldEncryption,
@@ -136,6 +137,10 @@ export type RunWorkerAppOptions = {
   /** Override `process.env` for env-validation (see
    *  RunProdAppOptions["envSource"]). */
   readonly envSource?: Record<string, string | undefined>;
+  /** Env names to decrypt from their `_CIPHERTEXT` twin at boot, typically
+   *  `kmsSlotsOf(composedEnv.schema)`. The worker parses no env schema, so it
+   *  cannot derive them; without this it reads the env as is. */
+  readonly kmsSlots?: readonly string[];
   readonly observability?: ObservabilityProvider;
   readonly observabilityOptions?: ObservabilityOptions;
 };
@@ -157,7 +162,13 @@ function makeBootModeHandle(): WorkerAppHandle {
 }
 
 export async function runWorkerApp(options: RunWorkerAppOptions): Promise<WorkerAppHandle> {
-  const envSource = options.envSource ?? process.env;
+  const rawEnvSource = options.envSource ?? process.env;
+  const envSource: Record<string, string | undefined> = options.kmsSlots
+    ? await resolvePlatformKeks(rawEnvSource, {
+        slots: options.kmsSlots,
+        logPrefix: "[runWorkerApp]",
+      })
+    : rawEnvSource;
 
   // 1. Polyfill before anything else — exactly the bug fw#1725 reports:
   //    without it, every job in the worker fails with "Temporal is not
@@ -180,7 +191,7 @@ export async function runWorkerApp(options: RunWorkerAppOptions): Promise<Worker
   const features = composeFeatures(options.features, {
     includeBundled: !!options.includeBundled,
   });
-  validateBoot(features, options.validateBootOptions);
+  validateBoot(features, { env: envSource, ...options.validateBootOptions });
   warnIfNonUtcServerTimeZone();
   assertPiiBootInvariants(features, {
     kms: options.kms,