@pdpp/local-collector 0.1.0-beta.7 → 0.1.0-beta.8

package/dist/polyfill-connectors/src/static-secret-injection.js

@@ -0,0 +1,155 @@
+function freezeStaticSecretDescriptor(descriptor) {
+    if (descriptor.secretEnvVars) {
+        Object.freeze(descriptor.secretEnvVars);
+    }
+    if (descriptor.secretFieldEnvVars) {
+        for (const value of Object.values(descriptor.secretFieldEnvVars)) {
+            Object.freeze(value);
+        }
+        Object.freeze(descriptor.secretFieldEnvVars);
+    }
+    if (descriptor.setupFieldEnvVars) {
+        for (const value of Object.values(descriptor.setupFieldEnvVars)) {
+            Object.freeze(value);
+        }
+        Object.freeze(descriptor.setupFieldEnvVars);
+    }
+    return Object.freeze(descriptor);
+}
+export const STATIC_SECRET_CONNECTOR_REGISTRY = Object.freeze({
+    gmail: freezeStaticSecretDescriptor({
+        credentialKind: "app_password",
+        secretEnvVars: ["GOOGLE_APP_PASSWORD_PDPP", "GMAIL_APP_PASSWORD"],
+        setupFieldEnvVars: {
+            account_email: ["GMAIL_ADDRESS", "GMAIL_USER"],
+        },
+    }),
+    github: freezeStaticSecretDescriptor({
+        credentialKind: "personal_access_token",
+        secretEnvVars: ["GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_TOKEN"],
+    }),
+    ynab: freezeStaticSecretDescriptor({
+        credentialKind: "personal_access_token",
+        secretEnvVars: ["YNAB_PERSONAL_ACCESS_TOKEN", "YNAB_PAT"],
+    }),
+    slack: freezeStaticSecretDescriptor({
+        credentialKind: "secret_bundle",
+        secretFieldEnvVars: {
+            slack_token: ["SLACK_TOKEN"],
+            slack_cookie: ["SLACK_COOKIE"],
+        },
+        setupFieldEnvVars: {
+            slack_workspace: ["SLACK_WORKSPACE"],
+        },
+    }),
+    reddit: freezeStaticSecretDescriptor({
+        credentialKind: "secret_bundle",
+        secretFieldEnvVars: {
+            reddit_password: ["REDDIT_PASSWORD"],
+            reddit_client_secret: ["REDDIT_CLIENT_SECRET"],
+        },
+        setupFieldEnvVars: {
+            reddit_username: ["REDDIT_USERNAME"],
+            reddit_client_id: ["REDDIT_CLIENT_ID"],
+        },
+    }),
+});
+export class StaticSecretInjectionError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "StaticSecretInjectionError";
+        this.code = code;
+    }
+}
+export function isStaticSecretConnector(connectorId) {
+    return Object.hasOwn(STATIC_SECRET_CONNECTOR_REGISTRY, connectorId);
+}
+function setupFieldsFromSourceBinding(sourceBinding) {
+    if (!sourceBinding || typeof sourceBinding !== "object" || Array.isArray(sourceBinding)) {
+        return {};
+    }
+    const raw = sourceBinding.setup_fields;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return {};
+    }
+    const fields = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value === "string" && value.trim().length > 0) {
+            fields[key] = value.trim();
+        }
+    }
+    return fields;
+}
+function secretBundleFields(connectorId, secret) {
+    let parsed;
+    try {
+        parsed = JSON.parse(secret);
+    }
+    catch {
+        throw new StaticSecretInjectionError("recovered_secret_bundle_invalid", `Connector '${connectorId}' expects a sealed JSON credential bundle; recovered secret was not valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new StaticSecretInjectionError("recovered_secret_bundle_invalid", `Connector '${connectorId}' expects a sealed JSON credential bundle object.`);
+    }
+    const fields = {};
+    for (const [key, value] of Object.entries(parsed)) {
+        if (typeof value === "string" && value.trim().length > 0) {
+            fields[key] = value.trim();
+        }
+    }
+    return fields;
+}
+function assertRecoveredSecretMatches(connectorId, descriptor, recovered) {
+    if (!recovered || typeof recovered.secret !== "string" || recovered.secret.length === 0) {
+        throw new StaticSecretInjectionError("recovered_secret_invalid", `Cannot inject an empty credential for connector '${connectorId}'.`);
+    }
+    if (recovered.credentialKind !== descriptor.credentialKind) {
+        throw new StaticSecretInjectionError("credential_kind_mismatch", `Connector '${connectorId}' expects credential kind '${descriptor.credentialKind}', ` +
+            `but the recovered credential is '${recovered.credentialKind}'.`);
+    }
+}
+function injectSingleSecret(fragment, envVars, secret) {
+    for (const envVar of envVars ?? []) {
+        fragment[envVar] = secret;
+    }
+}
+function injectSecretBundle(fragment, connectorId, secret, secretFieldEnvVars) {
+    if (!secretFieldEnvVars) {
+        return;
+    }
+    const bundle = secretBundleFields(connectorId, secret);
+    for (const [fieldName, envVars] of Object.entries(secretFieldEnvVars)) {
+        const value = bundle[fieldName];
+        if (!value) {
+            throw new StaticSecretInjectionError("recovered_secret_bundle_field_missing", `Connector '${connectorId}' credential bundle is missing required field '${fieldName}'.`);
+        }
+        for (const envVar of envVars) {
+            fragment[envVar] = value;
+        }
+    }
+}
+function injectSetupFields(fragment, setupFieldEnvVars, sourceBinding) {
+    const setupFields = setupFieldsFromSourceBinding(sourceBinding);
+    for (const [fieldName, envVars] of Object.entries(setupFieldEnvVars ?? {})) {
+        const value = setupFields[fieldName];
+        if (!value) {
+            continue;
+        }
+        for (const envVar of envVars) {
+            fragment[envVar] = value;
+        }
+    }
+}
+export function buildConnectionScopedSecretEnv(connectorId, recovered, sourceBinding) {
+    const descriptor = STATIC_SECRET_CONNECTOR_REGISTRY[connectorId];
+    if (!descriptor) {
+        throw new StaticSecretInjectionError("not_a_static_secret_connector", `Connector '${connectorId}' is not a known static-secret connector; refusing to invent secret env vars for it.`);
+    }
+    assertRecoveredSecretMatches(connectorId, descriptor, recovered);
+    const fragment = {};
+    injectSingleSecret(fragment, descriptor.secretEnvVars, recovered.secret);
+    injectSecretBundle(fragment, connectorId, recovered.secret, descriptor.secretFieldEnvVars);
+    injectSetupFields(fragment, descriptor.setupFieldEnvVars, sourceBinding);
+    return fragment;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pdpp/local-collector",
-  "version": "0.1.0-beta.7",
+  "version": "0.1.0-beta.8",
   "description": "Publishable local collector runtime for PDPP: filesystem-class connectors (Claude Code, Codex) plus the device-exporter ingest client.",
   "type": "module",
   "private": false,