@opengeni/core 3.1.2 → 3.2.2

package/src/domain/vaults/remote-provider-runtime.ts

@@ -0,0 +1,129 @@
+import type { Settings } from "@opengeni/config";
+import {
+  DestinationPolicyError,
+  ResponseBodyLimitError,
+  isLocalTestEnvironment,
+  pinnedFetch,
+  readResponseTextBounded,
+  validateHttpUrl,
+  type OutboundNetworkSettings,
+} from "@opengeni/network";
+import {
+  RemoteVaultTransportError,
+  VaultProviderError,
+  createRemoteVaultProvider,
+  type RemoteVaultTransport,
+} from "@opengeni/vaults";
+import type { ExternalVaultProviderFactories } from "./external-provider-connections";
+
+/** Shared by API and worker. No credential-bearing request uses ambient fetch. */
+export function createPinnedRemoteVaultTransport(
+  settings: OutboundNetworkSettings,
+  fetchImpl: typeof pinnedFetch = pinnedFetch,
+): RemoteVaultTransport {
+  return {
+    async post(request) {
+      if (request.signal?.aborted) throw new RemoteVaultTransportError("aborted", false);
+      const controller = new AbortController();
+      let timedOut = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+      }, request.timeoutMs);
+      const onAbort = () => controller.abort();
+      request.signal?.addEventListener("abort", onAbort, { once: true });
+      let rejectAborted: (() => void) | undefined;
+      try {
+        // The deadline includes DNS, connect, headers and the complete body.
+        // Racing DNS does not retry it: pinnedFetch receives the aborted signal
+        // and cannot send a later request if lookup completes after the deadline.
+        const aborted = new Promise<never>((_resolve, reject) => {
+          rejectAborted = () =>
+            reject(new RemoteVaultTransportError(timedOut ? "timeout" : "aborted", true));
+          controller.signal.addEventListener("abort", rejectAborted, { once: true });
+          if (controller.signal.aborted) rejectAborted();
+        });
+        const exchange = async () => {
+          const response = await fetchImpl(
+            request.url,
+            {
+              method: "POST",
+              headers: { ...request.headers },
+              body: request.body,
+              redirect: "manual",
+              signal: controller.signal,
+            },
+            settings,
+            { label: "Vault provider", requireHttpsOutsideLocalTest: true },
+          );
+          if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new RemoteVaultTransportError("redirect", true);
+          }
+          return {
+            status: response.status,
+            headers: response.headers,
+            body: await readResponseTextBounded(
+              response,
+              request.maxResponseBytes,
+              "Vault provider",
+              { signal: controller.signal },
+            ),
+          };
+        };
+        return await Promise.race([exchange(), aborted]);
+      } catch (error) {
+        if (error instanceof RemoteVaultTransportError) throw error;
+        if (error instanceof DestinationPolicyError)
+          throw new RemoteVaultTransportError("refused", false);
+        if (error instanceof ResponseBodyLimitError)
+          throw new RemoteVaultTransportError("too_large", true);
+        throw new RemoteVaultTransportError(
+          timedOut ? "timeout" : controller.signal.aborted ? "aborted" : "network",
+          true,
+        );
+      } finally {
+        clearTimeout(timer);
+        request.signal?.removeEventListener("abort", onAbort);
+        if (rejectAborted) controller.signal.removeEventListener("abort", rejectAborted);
+      }
+    },
+  };
+}
+
+export function createRemoteExternalVaultFactories(
+  settings: Pick<Settings, "environment" | "integrationsAllowPrivateNetworkTargets">,
+): ExternalVaultProviderFactories {
+  const transport = createPinnedRemoteVaultTransport(settings);
+  const factory: NonNullable<ExternalVaultProviderFactories["external"]> = async ({
+    credentials,
+    operations,
+  }) => {
+    if (credentials.provider !== "external" && credentials.provider !== "bitwarden")
+      throw new VaultProviderError("provider_auth_invalid", "Vault provider does not match.");
+    let endpoint: string;
+    try {
+      endpoint = validateHttpUrl(credentials.endpoint, {
+        allowLoopbackHttp: isLocalTestEnvironment(settings.environment),
+        label: "Vault provider",
+      });
+    } catch {
+      throw new VaultProviderError(
+        "provider_auth_invalid",
+        "Use an HTTPS vault endpoint without URL credentials or a fragment.",
+      );
+    }
+    return {
+      credentials: { ...credentials, endpoint },
+      provider: createRemoteVaultProvider({
+        provider: credentials.provider,
+        endpoint,
+        signingSecret: credentials.signingSecret,
+        transport,
+        allowInsecureHttp: isLocalTestEnvironment(settings.environment),
+        ...(operations ? { operations } : {}),
+      }),
+    };
+  };
+  return { external: factory, bitwarden: factory };
+}

package/src/domain/vaults/secret-resolver.ts

@@ -4,6 +4,16 @@
  * chosen here (archived dropped, lowest tier, names over aliases, otherwise
  * ambiguous), provider values are fetched, hosted values decrypted, and the
  * batch is recorded. A call resolves all of its references or none (I2).
+ *
+ * A reference that finds nothing first refreshes the connected vaults that
+ * could change the answer: those that could hold it at the priority tier that
+ * decided the lookup or above, even when a hosted item matched without the
+ * field. When one of those could not be checked (unreachable, rate limited,
+ * needing reconnection or still refreshing), the failure names that source
+ * instead of reporting the secret missing, so no missing-secret ask card is
+ * made for a secret that may exist (external vaults §9). Hosted and
+ * explicitly named healthy vaults are never blocked by unrelated outages, and
+ * lower-priority vaults never block a miss a higher tier decided.
  */
 import {
   buildMissingSecretAskCard,
@@ -11,6 +21,7 @@ import {
   isValidTotpInput,
   parseTotpInput,
   referenceKey,
+  secretNameKey,
   SecretReferenceError,
   VAULT_LIMITS,
   type ResolvedSecretValue,
@@ -20,6 +31,7 @@ import {
   type SecretReferenceFailure,
   type SecretResolver,
   type SecretUseContext,
+  type VaultProviderFreshness,
 } from "@opengeni/contracts";
 import {
   decryptEnvironmentValue,
@@ -29,6 +41,7 @@ import {
   type SecretReferenceCandidate,
   type SecretReferenceLookup,
   type SecretResolutionMeta,
+  type VaultRow,
 } from "@opengeni/db";
 import {
   createProviderCallBudget,
@@ -38,7 +51,11 @@ import {
   type VaultProviderErrorCode,
   type VaultProviderRegistry,
 } from "@opengeni/vaults";
-import { LINKED_VAULT_MISS_MAX_AGE_MS, refreshStaleLinkedVaults } from "./provider-sync";
+import {
+  LINKED_VAULT_MISS_MAX_AGE_MS,
+  providerVaultFreshness,
+  refreshLinkedVaults,
+} from "./provider-sync";
 import type { VaultServiceDeps } from "./types";
 
 export type SecretResolverOptions = {
@@ -204,6 +221,108 @@ function providerFailureCode(code: VaultProviderErrorCode): SecretReferenceFailu
   return "provider_unavailable";
 }
 
+/**
+ * The connected vaults whose mirror decides a reference that found nothing.
+ *
+ * Where the item could be: the vault a three-segment reference names; for two
+ * segments the named vault when the first segment names one (else every
+ * connected vault, since it may be `Item/field`); every connected vault for a
+ * bare item name; none for an ID.
+ *
+ * When some item matched but lacks the field (or the one-time password), the
+ * lookup keeps the highest-priority tier, so only vaults at that tier or above
+ * can change the answer: the connected vaults of matched items there that lack
+ * the field, and the connected vaults that could hold the item there but have
+ * no match yet. A hosted match never hides a higher-priority connected vault
+ * whose provider gained the item or its one-time password, and a vault of a
+ * lower-priority tier that is out of date or unavailable never turns a
+ * definite miss into an unchecked one.
+ */
+export function relevantProviderVaults(
+  reference: SecretReference,
+  candidates: readonly SecretReferenceCandidate[],
+  reachable: readonly VaultRow[],
+): VaultRow[] {
+  const connected = reachable.filter((vault) => vault.source !== "opengeni");
+  if (connected.length === 0) return [];
+  const where = possibleProviderVaults(reference, reachable, connected);
+  const live = candidates.filter((candidate) => !candidate.archived);
+  if (live.length === 0) return where;
+  const deciding = Math.min(...live.map((candidate) => candidate.tier));
+  const lacking = new Set(
+    live
+      .filter(
+        (candidate) =>
+          candidate.tier <= deciding &&
+          candidate.source !== "opengeni" &&
+          (candidate.missing === "field" || candidate.missing === "totp_field"),
+      )
+      .map((candidate) => candidate.vaultId),
+  );
+  const matched = new Set(live.map((candidate) => candidate.vaultId));
+  const unmatched = new Set(
+    where
+      .filter((vault) => vault.tier <= deciding && !matched.has(vault.id))
+      .map((vault) => vault.id),
+  );
+  return connected.filter((vault) => lacking.has(vault.id) || unmatched.has(vault.id));
+}
+
+/** The connected vaults a reference's path could point into, matched or not. */
+function possibleProviderVaults(
+  reference: SecretReference,
+  reachable: readonly VaultRow[],
+  connected: readonly VaultRow[],
+): VaultRow[] {
+  if (reference.target.form !== "path") return [];
+  const segments = reference.target.segments;
+  if (segments.length === 1) return [...connected];
+  const nameKey = secretNameKey(segments[0]!);
+  const named = reachable.filter((vault) => secretNameKey(vault.name) === nameKey);
+  if (segments.length === 2 && named.length === 0) return [...connected];
+  return named.filter((vault) => vault.source !== "opengeni");
+}
+
+/** A miss that cannot be trusted because a relevant connected vault was not checked. */
+function uncheckedSourceFailure(
+  reference: SecretReference,
+  unchecked: ReadonlyArray<{ vault: VaultRow; freshness: VaultProviderFreshness }>,
+): SecretReferenceFailure {
+  const authExpired = unchecked.filter(({ vault }) => vault.syncStatus === "auth_expired");
+  const rateLimited = unchecked.filter(
+    ({ freshness }) => freshness.state === "unavailable" && freshness.retryAt !== null,
+  );
+  const [code, named, why] =
+    authExpired.length > 0
+      ? (["provider_auth_expired", authExpired, "needs to be reconnected"] as const)
+      : rateLimited.length > 0
+        ? (["provider_rate_limited", rateLimited, "is rate limited by its provider"] as const)
+        : ([
+            "provider_unavailable",
+            unchecked,
+            unchecked.every(({ freshness }) => freshness.state === "refreshing")
+              ? "is still refreshing"
+              : "could not be checked",
+          ] as const);
+  const names = named
+    .slice(0, 3)
+    .map(({ vault }) => vault.name)
+    .join(", ");
+  const retryAt = rateLimited
+    .map(({ freshness }) => freshness.retryAt!)
+    .sort()
+    .at(0);
+  return {
+    raw: reference.raw,
+    code,
+    message:
+      `not found in the vaults that could be checked, but ${names} ${why}, so it may be there` +
+      (code === "provider_rate_limited" && retryAt
+        ? `; try again after ${retryAt}`
+        : "; try again later"),
+  };
+}
+
 function decodeBase64(value: string): Uint8Array {
   return new Uint8Array(Buffer.from(value, "base64"));
 }
@@ -292,38 +411,86 @@ export function createSecretResolver(
       const { meta, candidates } = await resolveSecretReferenceCandidates(deps.db, context, {
         refs: references.map((reference, index) => lookupFor(reference, index)),
       });
-      const failures: SecretReferenceFailure[] = [];
-      const chosen: Chosen[] = [];
-      references.forEach((reference, index) => {
-        const outcome = chooseSecretCandidate(
-          reference,
-          candidates.filter((candidate) => candidate.refIndex === index),
-          meta,
-        );
-        if ("failure" in outcome) failures.push(outcome.failure);
-        else chosen.push({ reference, candidate: outcome.candidate });
+      const outcomes = references.map((reference, index) => {
+        const own = candidates.filter((candidate) => candidate.refIndex === index);
+        return { reference, candidates: own, outcome: chooseSecretCandidate(reference, own, meta) };
       });
-      return { meta, failures, chosen };
+      return { meta, outcomes };
+    };
+    let { meta, outcomes } = await choose();
+    // One provider registry per resolve, made only when a connected vault is needed.
+    let registry: VaultProviderRegistry | null | undefined;
+    const providers = (): VaultProviderRegistry | null => {
+      if (registry === undefined) {
+        registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId) ?? null;
+      }
+      return registry;
     };
-    let { meta, failures, chosen } = await choose();
+    const misses = () =>
+      outcomes.filter(
+        (entry) => "failure" in entry.outcome && entry.outcome.failure.code === "not_found",
+      );
     // A reference to an item added straight in a connected provider (1Password)
-    // finds nothing until the vault's mirror catches up: refresh stale linked
-    // vaults once and look again before reporting it missing.
-    if (failures.some((failure) => failure.code === "not_found")) {
-      const registry = deps.providers ?? opts.providersForSubject?.(meta.subjectId);
-      if (registry) {
-        const reachable = await listVaultsForSubject(deps.db, context, {
-          workspaceId: principal.workspaceId,
-        });
-        const changed = await refreshStaleLinkedVaults({
+    // finds nothing until the vault's mirror catches up: refresh the relevant
+    // stale linked vaults once and look again before reporting it missing.
+    let reachable: VaultRow[] | null = null;
+    let refreshing = new Set<string>();
+    if (misses().length > 0) {
+      reachable = await listVaultsForSubject(deps.db, context, {
+        workspaceId: principal.workspaceId,
+      });
+      const relevant = new Map<string, VaultRow>();
+      for (const entry of misses()) {
+        for (const vault of relevantProviderVaults(entry.reference, entry.candidates, reachable)) {
+          relevant.set(vault.id, vault);
+        }
+      }
+      const refreshProviders = relevant.size > 0 ? providers() : null;
+      if (refreshProviders) {
+        const report = await refreshLinkedVaults({
           db: deps.db,
           context,
-          vaults: reachable,
-          providers: registry,
+          vaults: [...relevant.values()],
+          providers: refreshProviders,
           maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS,
         });
-        if (changed.length > 0) ({ meta, failures, chosen } = await choose());
+        refreshing = new Set(report.pending);
+        if (
+          report.changed.length > 0 ||
+          report.outcomes.some((outcome) => outcome.result?.status === "superseded")
+        )
+          ({ meta, outcomes } = await choose());
+        if (
+          report.outcomes.some((outcome) => outcome.state === "done" || outcome.state === "failed")
+        ) {
+          reachable = await listVaultsForSubject(deps.db, context, {
+            workspaceId: principal.workspaceId,
+          });
+        }
+      }
+    }
+    const failures: SecretReferenceFailure[] = [];
+    const chosen: Chosen[] = [];
+    const checkedAt = new Date();
+    for (const entry of outcomes) {
+      if ("candidate" in entry.outcome) {
+        chosen.push({ reference: entry.reference, candidate: entry.outcome.candidate });
+        continue;
+      }
+      let failure = entry.outcome.failure;
+      if (failure.code === "not_found" && reachable) {
+        const unchecked = relevantProviderVaults(entry.reference, entry.candidates, reachable)
+          .map((vault) => ({
+            vault,
+            freshness: providerVaultFreshness(vault, checkedAt, {
+              maxAgeMs: LINKED_VAULT_MISS_MAX_AGE_MS,
+              refreshing: refreshing.has(vault.id),
+            })!,
+          }))
+          .filter(({ freshness }) => freshness.state !== "current");
+        if (unchecked.length > 0) failure = uncheckedSourceFailure(entry.reference, unchecked);
       }
+      failures.push(failure);
     }
     const hasActingHuman = meta.humanExpected && meta.humanValid;
     if (failures.length > 0) {
@@ -344,17 +511,18 @@ export function createSecretResolver(
     for (const group of providerGroups.values()) {
       const first = group[0]!.candidate;
       try {
-        const registry =
-          deps.providers ??
-          opts.providersForSubject?.(meta.subjectId) ??
-          EMPTY_VAULT_PROVIDER_REGISTRY;
-        const provider = await registry.forVault({
+        const provider = await (providers() ?? EMPTY_VAULT_PROVIDER_REGISTRY).forVault({
           source: first.source,
           providerConnectionId: first.providerConnectionId,
         });
-        // The provider charges `budget` per call (one readFields per item).
+        // The provider charges `budget` per call (one readFields per item). The
+        // durable epoch invalidates its value cache after a refresh anywhere.
         const values = await provider.readFields(
-          { connectionId: first.providerConnectionId, budget },
+          {
+            connectionId: first.providerConnectionId,
+            budget,
+            cacheEpoch: first.providerCacheEpoch ?? null,
+          },
           first.providerVaultRef ?? "",
           first.providerItemRef ?? "",
           [...new Set(group.map((entry) => entry.candidate.providerFieldRef ?? ""))],
@@ -375,7 +543,9 @@ export function createSecretResolver(
                 ? "the connected vault is rate limited; try again later"
                 : code === "provider_auth_expired"
                   ? "the connected vault needs to be reconnected"
-                  : "the connected vault is unavailable",
+                  : code === "not_found"
+                    ? "the connected vault no longer has this item"
+                    : "the connected vault is unavailable",
           });
         }
       }