@griffin-app/griffin-executor 0.1.0

package/src/secrets/secrets.test.ts

@@ -0,0 +1,402 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { isSecretRef, isStringLiteral } from "./types.js";
+import { EnvSecretProvider } from "./providers/env.js";
+import {
+  resolveSecretsInMonitor,
+  collectSecretsFromMonitor,
+  planHasSecrets,
+} from "./resolver.js";
+import { MonitorV1 } from "@griffin-app/griffin-hub-sdk";
+
+// Helper to create a secret ref (mirrors the DSL's secret function)
+function createSecretRef(ref: string) {
+  return { $secret: { ref } };
+}
+
+// Helper to create a string literal (mirrors the schema's StringLiteral)
+function createStringLiteral(value: string) {
+  return { $literal: value };
+}
+
+describe("Secret Types", () => {
+  describe("isSecretRef", () => {
+    it("should return true for valid secret refs", () => {
+      expect(isSecretRef({ $secret: { ref: "API_KEY" } })).toBe(true);
+      expect(
+        isSecretRef({
+          $secret: { ref: "my-secret", version: "1" },
+        }),
+      ).toBe(true);
+    });
+
+    it("should return false for non-secret values", () => {
+      expect(isSecretRef("string")).toBe(false);
+      expect(isSecretRef(123)).toBe(false);
+      expect(isSecretRef(null)).toBe(false);
+      expect(isSecretRef(undefined)).toBe(false);
+      expect(isSecretRef({})).toBe(false);
+      expect(isSecretRef({ secret: { ref: "KEY" } })).toBe(false); // wrong key
+      expect(isSecretRef({ $literal: "value" })).toBe(false); // string literal
+    });
+  });
+
+  describe("isStringLiteral", () => {
+    it("should return true for valid string literals", () => {
+      expect(isStringLiteral({ $literal: "application/json" })).toBe(true);
+      expect(isStringLiteral({ $literal: "" })).toBe(true);
+      expect(isStringLiteral({ $literal: "Bearer token-123" })).toBe(true);
+    });
+
+    it("should return false for non-literal values", () => {
+      expect(isStringLiteral("string")).toBe(false);
+      expect(isStringLiteral(123)).toBe(false);
+      expect(isStringLiteral(null)).toBe(false);
+      expect(isStringLiteral(undefined)).toBe(false);
+      expect(isStringLiteral({})).toBe(false);
+      expect(isStringLiteral({ literal: "value" })).toBe(false); // wrong key
+      expect(isStringLiteral({ $secret: { ref: "KEY" } })).toBe(false); // secret ref
+    });
+  });
+});
+
+describe("EnvSecretProvider", () => {
+  it("should resolve environment variables", async () => {
+    const provider = new EnvSecretProvider({
+      env: { MY_API_KEY: "test-key-123" },
+    });
+
+    const result = await provider.resolve("MY_API_KEY");
+    expect(result).toBe("test-key-123");
+  });
+
+  it("should throw for missing environment variables", async () => {
+    const provider = new EnvSecretProvider({ env: {} });
+
+    await expect(provider.resolve("MISSING_VAR")).rejects.toThrow(/not set/);
+  });
+
+  it("should support prefix", async () => {
+    const provider = new EnvSecretProvider({
+      env: { APP_API_KEY: "prefixed-value" },
+      prefix: "APP_",
+    });
+
+    const result = await provider.resolve("API_KEY");
+    expect(result).toBe("prefixed-value");
+  });
+});
+
+describe("Monitor Secret Resolution", () => {
+  const createTestMonitor = (
+    headers?: Record<string, unknown>,
+    body?: unknown,
+  ): MonitorV1 =>
+    ({
+      id: "test-monitor-1",
+      name: "Test Monitor",
+      version: "1.0",
+      environment: "default",
+      project: "test-project",
+      frequency: { every: 1, unit: "MINUTE" },
+      nodes: [
+        {
+          id: "endpoint-1",
+          type: "HTTP_REQUEST",
+          method: "GET",
+          path: "/api/test",
+          base: "https://api.example.com",
+          response_format: "JSON",
+          headers,
+          body,
+        },
+      ],
+      edges: [
+        { from: "__START__", to: "endpoint-1" },
+        { from: "endpoint-1", to: "__END__" },
+      ],
+    }) as MonitorV1;
+
+  describe("planHasSecrets", () => {
+    it("should return false for monitors without secrets or literals", () => {
+      const monitor = createTestMonitor({ "Content-Type": "application/json" });
+      expect(planHasSecrets(monitor)).toBe(false);
+    });
+
+    it("should return true for monitors with secret refs in headers", () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+      });
+      expect(planHasSecrets(monitor)).toBe(true);
+    });
+
+    it("should return true for monitors with secret refs in body", () => {
+      const monitor = createTestMonitor(undefined, {
+        token: createSecretRef("TOKEN"),
+      });
+      expect(planHasSecrets(monitor)).toBe(true);
+    });
+
+    it("should return true for monitors with string literals in headers", () => {
+      const monitor = createTestMonitor({
+        "Content-Type": createStringLiteral("application/json"),
+      });
+      expect(planHasSecrets(monitor)).toBe(true);
+    });
+
+    it("should return true for monitors with string literals in body", () => {
+      const monitor = createTestMonitor(undefined, {
+        type: createStringLiteral("test"),
+      });
+      expect(planHasSecrets(monitor)).toBe(true);
+    });
+  });
+
+  describe("collectSecretsFromMonitor", () => {
+    it("should collect secrets from headers", () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+        "X-Custom": createSecretRef("custom-secret"),
+      });
+
+      const collected = collectSecretsFromMonitor(monitor);
+
+      expect(collected.refs).toHaveLength(2);
+      expect(collected.refs).toContainEqual({ ref: "API_KEY" });
+      expect(collected.refs).toContainEqual({ ref: "custom-secret" });
+    });
+
+    it("should collect secrets from nested body", () => {
+      const monitor = createTestMonitor(undefined, {
+        auth: {
+          token: createSecretRef("TOKEN"),
+        },
+        items: [{ key: createSecretRef("ITEM_KEY") }],
+      });
+
+      const collected = collectSecretsFromMonitor(monitor);
+
+      expect(collected.refs).toHaveLength(2);
+      expect(collected.refs).toContainEqual({ ref: "TOKEN" });
+      expect(collected.refs).toContainEqual({ ref: "ITEM_KEY" });
+    });
+
+    it("should deduplicate secret refs", () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+        "X-Backup-Auth": createSecretRef("API_KEY"),
+      });
+
+      const collected = collectSecretsFromMonitor(monitor);
+
+      expect(collected.refs).toHaveLength(1);
+      expect(collected.paths).toHaveLength(2);
+    });
+
+    it("should collect string literals from headers", () => {
+      const monitor = createTestMonitor({
+        "Content-Type": createStringLiteral("application/json"),
+        Accept: createStringLiteral("application/xml"),
+      });
+
+      const collected = collectSecretsFromMonitor(monitor);
+
+      expect(collected.refs).toHaveLength(0);
+      expect(collected.literalPaths).toHaveLength(2);
+      expect(collected.literalPaths).toContainEqual({
+        path: ["nodes", 0, "headers", "Content-Type"],
+        value: "application/json",
+      });
+      expect(collected.literalPaths).toContainEqual({
+        path: ["nodes", 0, "headers", "Accept"],
+        value: "application/xml",
+      });
+    });
+
+    it("should collect both secrets and literals", () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+        "Content-Type": createStringLiteral("application/json"),
+      });
+
+      const collected = collectSecretsFromMonitor(monitor);
+
+      expect(collected.refs).toHaveLength(1);
+      expect(collected.refs).toContainEqual({ ref: "API_KEY" });
+      expect(collected.literalPaths).toHaveLength(1);
+      expect(collected.literalPaths).toContainEqual({
+        path: ["nodes", 0, "headers", "Content-Type"],
+        value: "application/json",
+      });
+    });
+  });
+
+  describe("resolveSecretsInMonitor", () => {
+    it("should resolve secrets in headers", async () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+        "Content-Type": "application/json",
+      });
+
+      const provider = new EnvSecretProvider({
+        env: { API_KEY: "Bearer secret-token" },
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, provider);
+
+      const endpoint = resolved.nodes[0];
+      if (endpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(endpoint.headers?.Authorization).toBe("Bearer secret-token");
+      expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+    });
+
+    it("should resolve secrets in body", async () => {
+      const monitor = createTestMonitor(undefined, {
+        token: createSecretRef("TOKEN"),
+        data: "plain-value",
+      });
+
+      const provider = new EnvSecretProvider({
+        env: { TOKEN: "resolved-token" },
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, provider);
+
+      const endpoint = resolved.nodes[0];
+      if (endpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect((endpoint.body as { token: string }).token).toBe("resolved-token");
+      expect((endpoint.body as { data: string }).data).toBe("plain-value");
+    });
+
+    it("should not modify original monitor", async () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+      });
+
+      const provider = new EnvSecretProvider({
+        env: { API_KEY: "secret" },
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, provider);
+
+      // Original should still have secret ref
+      const originalEndpoint = monitor.nodes[0];
+      if (originalEndpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(originalEndpoint.headers?.Authorization).toEqual(
+        createSecretRef("API_KEY"),
+      );
+
+      // Resolved should have string
+      const resolvedEndpoint = resolved.nodes[0];
+      if (resolvedEndpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(resolvedEndpoint.headers?.Authorization).toBe("secret");
+    });
+
+    it("should throw when no provider configured", async () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+      });
+
+      await expect(resolveSecretsInMonitor(monitor, null)).rejects.toThrow(
+        /Monitor contains secret references but no secret provider was provided/,
+      );
+    });
+
+    it("should throw for missing secret", async () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("MISSING_KEY"),
+      });
+
+      const provider = new EnvSecretProvider({ env: {} });
+
+      await expect(resolveSecretsInMonitor(monitor, provider)).rejects.toThrow(
+        /not set/,
+      );
+    });
+
+    it("should unwrap string literals in headers", async () => {
+      const monitor = createTestMonitor({
+        "Content-Type": createStringLiteral("application/json"),
+        Accept: createStringLiteral("application/xml"),
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, null);
+
+      const endpoint = resolved.nodes[0];
+      if (endpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+      expect(endpoint.headers?.Accept).toBe("application/xml");
+    });
+
+    it("should unwrap string literals in body", async () => {
+      const monitor = createTestMonitor(undefined, {
+        type: createStringLiteral("test-type"),
+        data: "plain-value",
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, null);
+
+      const endpoint = resolved.nodes[0];
+      if (endpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect((endpoint.body as { type: string }).type).toBe("test-type");
+      expect((endpoint.body as { data: string }).data).toBe("plain-value");
+    });
+
+    it("should resolve both secrets and literals", async () => {
+      const monitor = createTestMonitor({
+        Authorization: createSecretRef("API_KEY"),
+        "Content-Type": createStringLiteral("application/json"),
+      });
+
+      const provider = new EnvSecretProvider({
+        env: { API_KEY: "Bearer secret-token" },
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, provider);
+
+      const endpoint = resolved.nodes[0];
+      if (endpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(endpoint.headers?.Authorization).toBe("Bearer secret-token");
+      expect(endpoint.headers?.["Content-Type"]).toBe("application/json");
+    });
+
+    it("should not modify original monitor with literals", async () => {
+      const monitor = createTestMonitor({
+        "Content-Type": createStringLiteral("application/json"),
+      });
+
+      const resolved = await resolveSecretsInMonitor(monitor, null);
+
+      // Original should still have literal wrapper
+      const originalEndpoint = monitor.nodes[0];
+      if (originalEndpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(originalEndpoint.headers?.["Content-Type"]).toEqual(
+        createStringLiteral("application/json"),
+      );
+
+      // Resolved should have unwrapped string
+      const resolvedEndpoint = resolved.nodes[0];
+      if (resolvedEndpoint.type !== "HTTP_REQUEST") {
+        throw new Error("HttpRequest not found");
+      }
+      expect(resolvedEndpoint.headers?.["Content-Type"]).toBe(
+        "application/json",
+      );
+    });
+  });
+});

package/src/secrets/types.ts

@@ -0,0 +1,106 @@
+import { StringLiteral } from "@griffin-app/griffin-hub-sdk";
+
+/**
+ * Data structure for a secret reference as it appears in a monitor.
+ */
+export interface SecretRefData {
+  ref: string;
+  version?: string;
+  field?: string;
+}
+
+/**
+ * Secret reference marker in monitor JSON.
+ */
+export interface SecretRef {
+  $secret: SecretRefData;
+}
+
+/**
+ * Options passed to secret resolution.
+ */
+export interface SecretResolveOptions {
+  version?: string;
+  field?: string;
+}
+
+/**
+ * Interface that all secret providers must implement.
+ */
+export interface SecretProvider {
+  /** Unique name of the provider (e.g., "env", "aws", "vault") */
+  readonly name: string;
+
+  /**
+   * Resolve a single secret reference.
+   * @param ref - The secret path/identifier within this provider
+   * @param options - Optional version or field extraction
+   * @returns The resolved secret value
+   * @throws Error if secret cannot be resolved
+   */
+  resolve(ref: string, options?: SecretResolveOptions): Promise<string>;
+
+  /**
+   * Optional batch resolution for efficiency.
+   * Default implementation calls resolve() for each ref.
+   */
+  resolveMany?(
+    refs: Array<{ ref: string; options?: SecretResolveOptions }>,
+  ): Promise<Map<string, string>>;
+
+  /**
+   * Optional validation/health check.
+   * Called during provider initialization.
+   */
+  validate?(): Promise<void>;
+}
+
+/**
+ * Error thrown when secret resolution fails.
+ */
+export class SecretResolutionError extends Error {
+  public readonly ref: string;
+  public readonly cause?: Error;
+
+  constructor(message: string, details: { ref: string; cause?: unknown }) {
+    super(message);
+    this.name = "SecretResolutionError";
+    this.ref = details.ref;
+    if (details.cause instanceof Error) {
+      this.cause = details.cause;
+    }
+  }
+}
+
+/**
+ * Type guard to check if a value is a secret reference.
+ */
+export function isSecretRef(value: unknown): value is SecretRef {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+
+  const obj = value as Record<string, unknown>;
+  if (
+    !("$secret" in obj) ||
+    typeof obj.$secret !== "object" ||
+    obj.$secret === null
+  ) {
+    return false;
+  }
+
+  const secretData = obj.$secret as Record<string, unknown>;
+  return typeof secretData.ref === "string";
+}
+
+/**
+ * Type guard to check if a value is a string literal.
+ */
+export function isStringLiteral(value: unknown): value is StringLiteral {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+
+  const obj = value as Record<string, unknown>;
+  return "$literal" in obj && typeof obj.$literal === "string";
+}

package/src/shared.ts

@@ -0,0 +1,46 @@
+import {
+  TSchema,
+  TSchemaOptions,
+  TUnsafe,
+  Static,
+  Unsafe,
+  Type,
+} from "typebox";
+import { Value } from "typebox/value";
+import { Memory } from "typebox/system";
+
+export function Ref<T extends TSchema>(
+  t: T,
+  options: TSchemaOptions = {},
+): TUnsafe<Static<T>> {
+  const id = (t as unknown as Record<string, string | undefined>).$id;
+  if (!id) {
+    throw new Error("missing ID on schema");
+  }
+  return Unsafe<Static<T>>({ ...t, $ref: id, $id: undefined, ...options });
+}
+
+export class TUnionOneOf<Types extends TSchema[] = TSchema[]> extends Type.Base<
+  TSchema[]
+> {
+  public oneOf: Types;
+  constructor(oneOf: Types) {
+    super();
+    this.oneOf = oneOf;
+  }
+}
+export function UnionOneOf(oneOf: TSchema[]): TUnionOneOf {
+  return new TUnionOneOf(oneOf);
+}
+
+//export interface TUnionOneOf<Types extends TSchema[] = TSchema[]> extends TSchema {
+//  '~kind': 'UnionOneOf'
+//  //static: { [K in keyof Types]: Static<Types[K]> }[number]
+//  oneOf: Types
+//}
+//
+//export function UnionOneOf<Types extends TSchema[]>(oneOf: [...Types], options: TSchemaOptions = {}) {
+//  return { ...options, ["~kind"]: 'UnionOneOf', oneOf } as TUnionOneOf<Types>
+//
+//  ///return Memory.Create({ '~kind': 'UnionOneOf' }, { oneOf }, options) as never
+//}

package/src/test-monitor-types.ts

@@ -0,0 +1,49 @@
+export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
+export type ResponseFormat = "JSON" | "XML" | "TEXT";
+
+export interface HttpRequest {
+  id: string;
+  type: "HTTP_REQUEST";
+  method: HttpMethod;
+  path: string;
+  response_format: ResponseFormat;
+  headers?: Record<string, string>;
+  body?: any;
+}
+
+export interface WaitNode {
+  id: string;
+  type: "WAIT";
+  duration_ms: number;
+}
+
+export interface AssertionNode {
+  id: string;
+  type: "ASSERTION";
+  assertions: Assertion[];
+}
+
+export interface Assertion {
+  type: string;
+  expected?: any;
+  actual?: any;
+  message?: string;
+}
+
+export interface Edge {
+  from: string;
+  to: string;
+}
+
+export interface Frequency {
+  every: number;
+  unit: "minute" | "hour" | "day";
+}
+
+export interface TestMonitor {
+  name: string;
+  endpoint_host: string;
+  frequency?: Frequency;
+  nodes: (HttpRequest | WaitNode | AssertionNode)[];
+  edges: Edge[];
+}