@pgpm/encrypted-secrets 0.15.2 → 0.15.4

package/Makefile

@@ -1,5 +1,5 @@
 EXTENSION = pgpm-encrypted-secrets
-DATA = sql/pgpm-encrypted-secrets--0.14.0.sql
+DATA = sql/pgpm-encrypted-secrets--0.15.3.sql
 
 PG_CONFIG = pg_config
 PGXS := $(shell $(PG_CONFIG) --pgxs)

package/README.md

@@ -446,6 +446,22 @@ SELECT encrypted_secrets.secrets_upsert('uuid', 'key', 'value');
 SELECT * FROM secrets_schema.secrets_table WHERE secrets_owned_field = 'uuid';
 ```
 
+### With PGPM roles
+
+Ensure the standard roles exist before granting:
+
+```bash
+pgpm admin-users bootstrap
+```
+
+```sql
+-- Only authenticated users can manage secrets
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_upsert TO authenticated;
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_getter TO authenticated;
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_verify TO authenticated;
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_delete TO authenticated;
+```
+
 ### With @pgpm/jwt-claims
 
 Use JWT claims for owner context:
@@ -468,6 +484,7 @@ SELECT encrypted_secrets.secrets_getter(
 
 ## Dependencies
 
+- PGPM roles (anonymous, authenticated, administrator)
 - `@pgpm/encrypted-secrets-table`: Storage layer
 - `@pgpm/verify`: Verification utilities
 - PostgreSQL pgcrypto extension (for encryption functions)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/encrypted-secrets",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "description": "Encrypted secrets management for PostgreSQL",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,11 +21,11 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/encrypted-secrets-table": "0.15.2",
-    "@pgpm/verify": "0.15.2"
+    "@pgpm/encrypted-secrets-table": "0.15.4",
+    "@pgpm/verify": "0.15.4"
   },
   "devDependencies": {
-    "pgpm": "^1.0.0"
+    "pgpm": "^1.2.2"
   },
   "repository": {
     "type": "git",
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "92a241bab64c7b20e85e55a7bd314089907fabba"
+  "gitHead": "aad0dbef0336d6c18d027120ef9addc418822edd"
 }

package/pgpm-encrypted-secrets.control

@@ -1,6 +1,6 @@
 # pgpm-encrypted-secrets extension
 comment = 'pgpm-encrypted-secrets extension'
-default_version = '0.14.0'
+default_version = '0.15.3'
 module_pathname = '$libdir/pgpm-encrypted-secrets'
 requires = 'pgcrypto,plpgsql,uuid-ossp,pgpm-encrypted-secrets-table,pgpm-verify'
 relocatable = false

package/__tests__/__snapshots__/secrets.test.ts.snap

@@ -1,28 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`encrypted secrets encrypt_field_bytea_to_text 1`] = `"value-there-and-back"`;
-
-exports[`encrypted secrets encrypt_field_pgp_get 1`] = `"my-secret"`;
-
-exports[`encrypted secrets encrypt_field_set 1`] = `
-{
-  "data": [
-    109,
-    121,
-    118,
-    97,
-    108,
-    117,
-    101,
-  ],
-  "type": "Buffer",
-}
-`;
-
-exports[`encrypted secrets secrets_getter 1`] = `"my-secret"`;
-
-exports[`encrypted secrets secrets_upsert 1`] = `true`;
-
-exports[`encrypted secrets secrets_upsert 2`] = `true`;
-
-exports[`encrypted secrets secrets_verify 1`] = `true`;

package/__tests__/secrets.test.ts

@@ -1,193 +0,0 @@
-import { getConnections, PgTestClient } from 'pgsql-test';
-
-let pg: PgTestClient;
-let teardown: () => Promise<void>;
-
-const user_id = 'dc474833-318a-41f5-9239-ee563ab657a6';
-
-describe('encrypted secrets', () => {
-  beforeAll(async () => {
-    ({ pg, teardown } = await getConnections());
-  });
-
-  afterAll(async () => {
-    await teardown();
-  });
-
-  beforeEach(async () => {
-    await pg.beforeEach();
-    
-    // Insert test data
-    await pg.any(`
-      INSERT INTO secrets_schema.secrets_table
-      ( secrets_owned_field,
-        name,
-        secrets_value_field,
-        secrets_enc_field
-      ) VALUES
-      (
-        $1::uuid,
-        'my-secret-name',
-        'my-secret'::bytea,
-        'pgp'
-      )
-    `, [user_id]);
-  });
-
-  afterEach(async () => {
-    await pg.afterEach();
-  });
-
-  it('encrypt_field_pgp_get', async () => {
-    const [{ encrypt_field_pgp_get }] = await pg.any(
-      `SELECT encrypted_secrets.encrypt_field_pgp_get(secrets_value_field, secrets_owned_field::text) 
-       FROM secrets_schema.secrets_table 
-       WHERE secrets_owned_field = $1`,
-      [user_id]
-    );
-    expect(encrypt_field_pgp_get).toMatchSnapshot();
-  });
-
-  it('encrypt_field_set', async () => {
-    const [{ encrypt_field_set }] = await pg.any(
-      `SELECT encrypted_secrets.encrypt_field_set('myvalue')`
-    );
-    expect(encrypt_field_set).toMatchSnapshot();
-  });
-
-  it('encrypt_field_bytea_to_text', async () => {
-    const [{ encrypt_field_bytea_to_text }] = await pg.any(
-      `SELECT encrypted_secrets.encrypt_field_bytea_to_text(
-        encrypted_secrets.encrypt_field_set('value-there-and-back')
-      )`
-    );
-    expect(encrypt_field_bytea_to_text).toMatchSnapshot();
-  });
-
-  it('secrets_getter', async () => {
-    const [{ secrets_getter }] = await pg.any(
-      `SELECT encrypted_secrets.secrets_getter(
-        $1::uuid,
-        'my-secret-name'
-      )`,
-      [user_id]
-    );
-    expect(secrets_getter).toMatchSnapshot();
-  });
-
-  it('secrets_verify', async () => {
-    const [{ secrets_verify }] = await pg.any(
-      `SELECT encrypted_secrets.secrets_verify(
-        $1::uuid,
-        'my-secret-name',
-        'my-secret'
-      )`,
-      [user_id]
-    );
-    expect(secrets_verify).toMatchSnapshot();
-  });
-
-  it('secrets_upsert', async () => {
-    const [{ secrets_upsert }] = await pg.any(
-      `SELECT encrypted_secrets.secrets_upsert(
-        $1::uuid,
-        'my-secret-name',
-        'my-secret-other-value'
-      )`,
-      [user_id]
-    );
-    expect(secrets_upsert).toMatchSnapshot();
-    
-    const [{ secrets_verify }] = await pg.any(
-      `SELECT encrypted_secrets.secrets_verify(
-        $1::uuid,
-        'my-secret-name',
-        'my-secret-other-value'
-      )`,
-      [user_id]
-    );
-    expect(secrets_verify).toMatchSnapshot();
-  });
-
-  it('secrets_delete single', async () => {
-    // First verify the secret exists
-    const [beforeDelete] = await pg.any(
-      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'my-secret-name')`,
-      [user_id]
-    );
-    expect(beforeDelete.secrets_getter).toBe('my-secret');
-
-    // Delete the secret
-    await pg.any(
-      `SELECT encrypted_secrets.secrets_delete($1::uuid, 'my-secret-name')`,
-      [user_id]
-    );
-
-    // Verify it's gone
-    const [afterDelete] = await pg.any(
-      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'my-secret-name', 'default-value')`,
-      [user_id]
-    );
-    expect(afterDelete.secrets_getter).toBe('default-value');
-  });
-
-  it('secrets_delete multiple', async () => {
-    // Add multiple secrets
-    await pg.any(
-      `SELECT encrypted_secrets.secrets_upsert($1::uuid, 'secret-1', 'value-1')`,
-      [user_id]
-    );
-    await pg.any(
-      `SELECT encrypted_secrets.secrets_upsert($1::uuid, 'secret-2', 'value-2')`,
-      [user_id]
-    );
-
-    // Delete multiple secrets
-    await pg.any(
-      `SELECT encrypted_secrets.secrets_delete($1::uuid, $2::text[])`,
-      [user_id, ['secret-1', 'secret-2']]
-    );
-
-    // Verify they're gone
-    const [result1] = await pg.any(
-      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'secret-1', 'not-found')`,
-      [user_id]
-    );
-    const [result2] = await pg.any(
-      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'secret-2', 'not-found')`,
-      [user_id]
-    );
-    
-    expect(result1.secrets_getter).toBe('not-found');
-    expect(result2.secrets_getter).toBe('not-found');
-  });
-
-  xit('encrypt_field_pgp_getter', async () => {
-    const [{ encrypt_field_pgp_getter }] = await pg.any(
-      `SELECT encrypted_secrets.encrypt_field_pgp_getter(
-        $1::uuid,
-        'secrets_value_field',
-        'secrets_enc_field'
-      )`,
-      [user_id]
-    );
-    expect(encrypt_field_pgp_getter).toMatchSnapshot();
-  });
-
-  xit('secrets_table_upsert', async () => {
-    const [{ secrets_table_upsert }] = await pg.any(
-      `SELECT encrypted_secrets.secrets_table_upsert(
-        $1::uuid,
-        $2::json
-      )`,
-      [
-        user_id,
-        JSON.stringify({
-          myOther: 'secret',
-          hiOther: 'here'
-        })
-      ]
-    );
-    expect(secrets_table_upsert).toMatchSnapshot();
-  });
-});