@onlineapps/service-wrapper 3.0.17 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/service-wrapper",
-  "version": "3.0.17",
+  "version": "3.2.0",
   "description": "Thin orchestration layer for microservices - delegates all infrastructure concerns to specialized connectors",
   "main": "src/index.js",
   "scripts": {
@@ -29,8 +29,9 @@
     "@onlineapps/conn-base-state": "1.0.1",
     "@onlineapps/conn-infra-error-handler": "1.0.11",
     "@onlineapps/conn-infra-mq": "1.1.70",
+    "@onlineapps/conn-infra-secrets": "1.0.0",
     "@onlineapps/conn-orch-cookbook": "2.1.3",
-    "@onlineapps/conn-orch-orchestrator": "2.0.3",
+    "@onlineapps/conn-orch-orchestrator": "2.1.0",
     "@onlineapps/conn-orch-registry": "1.2.1",
     "@onlineapps/conn-orch-validator": "3.1.2",
     "@onlineapps/monitoring-core": "1.0.23",

package/src/ContextBuilder.js

@@ -92,6 +92,9 @@ class ContextBuilder {
     const httpClient = this._connectors.http;
     const secretsAdapter = this._connectors.secrets;
     const secrets = {
+      // Handlers call ctx.secrets.get(ref); the facade injects the invocation
+      // scope so the connector can resolve the tenant/workspace projection
+      // (see api/docs/architecture/secretbox.md §6).
       get: (name) => {
         if (!secretsAdapter || typeof secretsAdapter.get !== 'function') {
           throw new Error(
@@ -99,7 +102,10 @@ class ContextBuilder {
             'wire a secrets connector before using ctx.secrets'
           );
         }
-        return secretsAdapter.get(name);
+        return secretsAdapter.get(name, {
+          tenant_id: envelope.tenant_id ?? null,
+          workspace_id: envelope.workspace_id ?? null
+        });
       }
     };
 

package/src/ServiceWrapper.js

@@ -20,6 +20,7 @@ const OrchestratorConnector = require('@onlineapps/conn-orch-orchestrator');
 const CookbookConnector = require('@onlineapps/conn-orch-cookbook');
 const CacheConnector = require('@onlineapps/conn-base-cache');
 const StateConnector = require('@onlineapps/conn-base-state');
+const SecretsConnector = require('@onlineapps/conn-infra-secrets');
 const ErrorHandlerConnector = require('@onlineapps/conn-infra-error-handler');
 const { ValidationOrchestrator } = require('@onlineapps/conn-orch-validator');
 const runtimeCfg = require('./config');
@@ -146,6 +147,7 @@ class ServiceWrapper {
     this.registryClient = null;
     this.orchestrator = null;
     this.cacheConnector = null;
+    this.secretsConnector = null;
     this.monitoring = null;
     this.logger = null;
 
@@ -734,6 +736,15 @@ class ServiceWrapper {
         }
       }
 
+      if (this.secretsConnector) {
+        try {
+          await this.secretsConnector.disconnect();
+          console.log(`[CLEANUP] ✓ Closed Redis secrets connection`);
+        } catch (err) {
+          console.warn(`[CLEANUP] Failed to close Redis secrets connection:`, err.message);
+        }
+      }
+
       // 5. Clear state variables
       this.workflowInitConsumerTag = null;
       this.workflowControlConsumerTag = null;
@@ -897,6 +908,12 @@ class ServiceWrapper {
         await this._initializeState();
       }
 
+      // Initialize secrets connector if configured (SecretBox resolution for
+      // ctx.secrets.get(ref)). Critical when enabled — let it throw.
+      if (this.config.wrapper?.secrets?.enabled === true) {
+        await this._initializeSecrets();
+      }
+
       // v3 handler-registry pipeline (RFC §5.9). Replaces the v2 HTTP-loopback
       // invocation path. Must run AFTER connectors are instantiated (storage,
       // cache, monitoring, mq) and BEFORE MQ messages are dispatched.
@@ -1463,6 +1480,32 @@ class ServiceWrapper {
     this.logger?.info('State connector initialized');
   }
 
+  /**
+   * Initialize secrets connector (SecretBox). Resolves ctx.secrets.get(ref) by
+   * reading the encrypted Redis projection written by api_secrets and decrypting
+   * in-process. Redis reuses wrapper.cache.url (shared api_node_cache); the AES
+   * master key is required from env (no fallback).
+   * @private
+   */
+  async _initializeSecrets() {
+    const { requireEnv } = require('@onlineapps/service-common');
+    const secretsConfig = this.config.wrapper?.secrets || {};
+    const redisUrl = secretsConfig.url || this.config.wrapper?.cache?.url
+      || requireEnv('REDIS_URL', 'Redis connection URL for secrets projection');
+    const masterKeyBase64 = secretsConfig.masterKey
+      || requireEnv('SECRETS_MASTER_KEY', 'base64-encoded 32-byte AES-256-GCM master key for secret resolution');
+
+    this.secretsConnector = new SecretsConnector({
+      redisUrl,
+      masterKeyBase64,
+      password: secretsConfig.password,
+      db: secretsConfig.db
+    });
+
+    await this.secretsConnector.connect();
+    this.logger?.info('Secrets connector initialized');
+  }
+
   /**
    * Setup health check endpoint
    * @private
@@ -1761,7 +1804,24 @@ class ServiceWrapper {
       cache: this.cacheConnector,
       errorHandler: errorHandler,
       logger: this.logger,
-      defaultTimeout: timeout
+      defaultTimeout: timeout,
+      operationMutatesLookup: (_executingServiceName, step) => {
+        const opsMap =
+          (this.operations && this.operations.operations) ||
+          this.operations ||
+          {};
+        const opKey =
+          step && typeof step.operation === 'string' && step.operation.length > 0
+            ? step.operation
+            : step && typeof step.step_id === 'string'
+              ? step.step_id
+              : '';
+        const spec = opsMap[opKey];
+        return {
+          mutates: !!(spec && spec.mutates === true),
+          resource_type: spec ? spec.resource_type : undefined
+        };
+      }
     });
 
     this.logger?.info('Orchestrator initialized');
@@ -2270,7 +2330,7 @@ class ServiceWrapper {
         storage: null,
         cache: this.cacheConnector || null,
         http: null,
-        secrets: null,
+        secrets: this.secretsConnector || null,
         monitoring: this.monitoring || null,
         mq: this.mqClient || null,
         state: this.stateConnector || null
@@ -2748,6 +2808,11 @@ class ServiceWrapper {
         await this.stateConnector.disconnect();
       }
 
+      // Disconnect from secrets
+      if (this.secretsConnector) {
+        await this.secretsConnector.disconnect();
+      }
+
       // Disconnect from MQ
       if (this.mqClient) {
         await this.mqClient.disconnect();