@forklaunch/core 1.5.20 → 1.6.0

package/lib/persistence/keyRotation.d.ts

@@ -0,0 +1,118 @@
+import type { EntityManager } from '@mikro-orm/core';
+import { isEncryptedCiphertext, type FieldEncryptor } from './fieldEncryptor';
+export declare const isEncryptedValue: typeof isEncryptedCiphertext;
+export type RotationOutcome = {
+    kind: 'plaintext';
+} | {
+    kind: 'current';
+    tenantId: string;
+    keyId: string;
+} | {
+    kind: 'rewritten';
+    tenantId: string;
+    keyId: string;
+    next: string;
+} | {
+    kind: 'unreadable';
+};
+/**
+ * Classify one stored value against the encryptor's ring. `tenantIds` are
+ * the row's likely tenants, most likely first; `fallbackTenantIds` are
+ * tried only when none of those open the value with any key.
+ */
+export declare function classifyEncryptedValue(value: unknown, encryptor: FieldEncryptor, tenantIds: readonly string[], fallbackTenantIds?: readonly string[]): RotationOutcome;
+export interface RotationTableReport {
+    table: string;
+    columns: string[];
+    scanned: number;
+    plaintext: number;
+    current: number;
+    rewritten: number;
+    unreadable: number;
+    /** Row ids (primary key as string) with at least one unreadable value. */
+    unreadableIds: string[];
+    /** How many values each previous key still held before this pass. */
+    byKeyId: Record<string, number>;
+    /** Stamped key ids seen on unreadable values: keys that must be added to the ring. */
+    missingKeyIds: Record<string, number>;
+}
+export type SqlExecute = (sql: string, params?: unknown[]) => Promise<unknown>;
+export interface ReencryptOptions {
+    em: EntityManager;
+    /** The ring: current key plus every previous key. */
+    encryptor: FieldEncryptor;
+    /** Report only; write nothing. */
+    dryRun?: boolean;
+    /**
+     * Candidate tenant ids for a row, most likely first. The default tries
+     * the row's `organization_id` (when the table has one) and then the empty
+     * tenant. Modules with other tenant shapes (an organization is its own
+     * tenant) extend it.
+     */
+    tenantIdsFor?: (entityName: string, row: Record<string, unknown>) => string[];
+    /**
+     * Tenants to try only when a row's own candidates open nothing. Pass the
+     * result of {@link collectFallbackTenantIds} to catch rows written under a
+     * mismatched context. Empty by default.
+     */
+    fallbackTenantIds?: readonly string[];
+    /**
+     * How to run SQL. A migration must pass its own `this.execute`: MikroORM
+     * applies pending migrations inside one transaction, and a pooled
+     * connection cannot see tables that earlier migrations created but have
+     * not committed yet. Defaults to the entity manager's connection.
+     */
+    execute?: SqlExecute;
+    log?: (message: string) => void;
+}
+/** `organization_id` first when the row carries one, then the empty tenant. */
+export declare function defaultTenantIdsFor(_entityName: string, row: Record<string, unknown>): string[];
+/**
+ * Every tenant id the database knows: the distinct `organization_id` of
+ * every table in the current schema that has one, plus `organization.id`
+ * where the module owns organizations. Used as the last-resort tenant list.
+ * PostgreSQL only (information_schema + to_regclass).
+ */
+export declare function collectFallbackTenantIds(execute: SqlExecute): Promise<string[]>;
+export interface EntityMetadataLike {
+    className: string;
+    tableName?: string;
+    abstract?: boolean;
+    embeddable?: boolean;
+    primaryKeys: readonly string[];
+    properties: Record<string, {
+        fieldNames: string[];
+        columnTypes?: string[];
+    } | undefined>;
+}
+/**
+ * Every entity MikroORM discovered. `getMetadata().getAll()` is a Map in
+ * MikroORM 7 and was a plain object before; accept both shapes.
+ */
+export declare function entityMetadataList(em: EntityManager): EntityMetadataLike[];
+/**
+ * Walk every registered entity with encrypted compliance fields and rewrite
+ * previous-key ciphertexts under the current key. Safe to re-run: every
+ * value is classified before anything is written.
+ */
+export declare function reencryptEncryptedColumns(options: ReencryptOptions): Promise<RotationTableReport[]>;
+/**
+ * How many values in a column are stamped with each key (`v3`), and how
+ * many are unstamped (`v1`/`v2`). Cheap, read-only, no decryption: the
+ * answer to "can this key be dropped yet?" once a table is on `v3`.
+ */
+export declare function countValuesByKeyId(execute: SqlExecute, table: string, column: string): Promise<{
+    byKeyId: Record<string, number>;
+    unstamped: number;
+    plaintext: number;
+}>;
+/** Sum a report field across tables. */
+export declare function rotationTotals(reports: readonly RotationTableReport[]): {
+    tables: number;
+    scanned: number;
+    rewritten: number;
+    current: number;
+    plaintext: number;
+    unreadable: number;
+};
+//# sourceMappingURL=keyRotation.d.ts.map

package/lib/persistence/keyRotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyRotation.d.ts","sourceRoot":"","sources":["../../src/persistence/keyRotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,qBAAqB,EAErB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAqC1B,eAAO,MAAM,gBAAgB,8BAAwB,CAAC;AAEtD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAc3B;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,eAAe,CAmBjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,aAAa,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,cAAc,CAAC;IAC1B,kCAAkC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;IAC9E;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,EAAE,CAQV;AAID;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAChB,MAAM,EACN;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,SAAS,CAC7D,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,aAAa,GAAG,kBAAkB,EAAE,CAO1E;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkIhC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAaD;AAED,wCAAwC;AACxC,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE;IAIlE,MAAM;IACN,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,UAAU;EAEb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forklaunch/core",
-  "version": "1.5.20",
+  "version": "1.6.0",
   "description": "forklaunch-js core package. Contains useful building blocks.",
   "homepage": "https://github.com/forklaunch/forklaunch-js#readme",
   "bugs": {