@onlineapps/service-wrapper 3.1.0 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/service-wrapper",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Thin orchestration layer for microservices - delegates all infrastructure concerns to specialized connectors",
   "main": "src/index.js",
   "scripts": {
@@ -29,6 +29,7 @@
     "@onlineapps/conn-base-state": "1.0.1",
     "@onlineapps/conn-infra-error-handler": "1.0.11",
     "@onlineapps/conn-infra-mq": "1.1.70",
+    "@onlineapps/conn-infra-secrets": "1.0.0",
     "@onlineapps/conn-orch-cookbook": "2.1.3",
     "@onlineapps/conn-orch-orchestrator": "2.1.0",
     "@onlineapps/conn-orch-registry": "1.2.1",

package/src/ContextBuilder.js

@@ -92,6 +92,9 @@ class ContextBuilder {
     const httpClient = this._connectors.http;
     const secretsAdapter = this._connectors.secrets;
     const secrets = {
+      // Handlers call ctx.secrets.get(ref); the facade injects the invocation
+      // scope so the connector can resolve the tenant/workspace projection
+      // (see api/docs/architecture/secretbox.md §6).
       get: (name) => {
         if (!secretsAdapter || typeof secretsAdapter.get !== 'function') {
           throw new Error(
@@ -99,7 +102,10 @@ class ContextBuilder {
             'wire a secrets connector before using ctx.secrets'
           );
         }
-        return secretsAdapter.get(name);
+        return secretsAdapter.get(name, {
+          tenant_id: envelope.tenant_id ?? null,
+          workspace_id: envelope.workspace_id ?? null
+        });
       }
     };
 

package/src/ServiceWrapper.js

@@ -20,6 +20,7 @@ const OrchestratorConnector = require('@onlineapps/conn-orch-orchestrator');
 const CookbookConnector = require('@onlineapps/conn-orch-cookbook');
 const CacheConnector = require('@onlineapps/conn-base-cache');
 const StateConnector = require('@onlineapps/conn-base-state');
+const SecretsConnector = require('@onlineapps/conn-infra-secrets');
 const ErrorHandlerConnector = require('@onlineapps/conn-infra-error-handler');
 const { ValidationOrchestrator } = require('@onlineapps/conn-orch-validator');
 const runtimeCfg = require('./config');
@@ -146,6 +147,7 @@ class ServiceWrapper {
     this.registryClient = null;
     this.orchestrator = null;
     this.cacheConnector = null;
+    this.secretsConnector = null;
     this.monitoring = null;
     this.logger = null;
 
@@ -734,6 +736,15 @@ class ServiceWrapper {
         }
       }
 
+      if (this.secretsConnector) {
+        try {
+          await this.secretsConnector.disconnect();
+          console.log(`[CLEANUP] ✓ Closed Redis secrets connection`);
+        } catch (err) {
+          console.warn(`[CLEANUP] Failed to close Redis secrets connection:`, err.message);
+        }
+      }
+
       // 5. Clear state variables
       this.workflowInitConsumerTag = null;
       this.workflowControlConsumerTag = null;
@@ -897,6 +908,12 @@ class ServiceWrapper {
         await this._initializeState();
       }
 
+      // Initialize secrets connector if configured (SecretBox resolution for
+      // ctx.secrets.get(ref)). Critical when enabled — let it throw.
+      if (this.config.wrapper?.secrets?.enabled === true) {
+        await this._initializeSecrets();
+      }
+
       // v3 handler-registry pipeline (RFC §5.9). Replaces the v2 HTTP-loopback
       // invocation path. Must run AFTER connectors are instantiated (storage,
       // cache, monitoring, mq) and BEFORE MQ messages are dispatched.
@@ -1463,6 +1480,32 @@ class ServiceWrapper {
     this.logger?.info('State connector initialized');
   }
 
+  /**
+   * Initialize secrets connector (SecretBox). Resolves ctx.secrets.get(ref) by
+   * reading the encrypted Redis projection written by api_secrets and decrypting
+   * in-process. Redis reuses wrapper.cache.url (shared api_node_cache); the AES
+   * master key is required from env (no fallback).
+   * @private
+   */
+  async _initializeSecrets() {
+    const { requireEnv } = require('@onlineapps/service-common');
+    const secretsConfig = this.config.wrapper?.secrets || {};
+    const redisUrl = secretsConfig.url || this.config.wrapper?.cache?.url
+      || requireEnv('REDIS_URL', 'Redis connection URL for secrets projection');
+    const masterKeyBase64 = secretsConfig.masterKey
+      || requireEnv('SECRETS_MASTER_KEY', 'base64-encoded 32-byte AES-256-GCM master key for secret resolution');
+
+    this.secretsConnector = new SecretsConnector({
+      redisUrl,
+      masterKeyBase64,
+      password: secretsConfig.password,
+      db: secretsConfig.db
+    });
+
+    await this.secretsConnector.connect();
+    this.logger?.info('Secrets connector initialized');
+  }
+
   /**
    * Setup health check endpoint
    * @private
@@ -2287,7 +2330,7 @@ class ServiceWrapper {
         storage: null,
         cache: this.cacheConnector || null,
         http: null,
-        secrets: null,
+        secrets: this.secretsConnector || null,
         monitoring: this.monitoring || null,
         mq: this.mqClient || null,
         state: this.stateConnector || null
@@ -2765,6 +2808,11 @@ class ServiceWrapper {
         await this.stateConnector.disconnect();
       }
 
+      // Disconnect from secrets
+      if (this.secretsConnector) {
+        await this.secretsConnector.disconnect();
+      }
+
       // Disconnect from MQ
       if (this.mqClient) {
         await this.mqClient.disconnect();