@pgpm/encrypted-secrets 0.4.0

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
+Copyright (c) 2025 Interweb, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/Makefile

@@ -0,0 +1,6 @@
+EXTENSION = launchql-encrypted-secrets
+DATA = sql/launchql-encrypted-secrets--0.1.0.sql
+
+PG_CONFIG = pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)

package/README.md

@@ -0,0 +1,5 @@
+# @pgpm/encrypted-secrets
+
+Encrypted secrets management for PostgreSQL.
+
+Provides secure storage and retrieval of encrypted secrets, API keys, and sensitive configuration data within PostgreSQL.

package/__tests__/__snapshots__/secrets.test.ts.snap

@@ -0,0 +1,28 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`encrypted secrets encrypt_field_bytea_to_text 1`] = `"value-there-and-back"`;
+
+exports[`encrypted secrets encrypt_field_pgp_get 1`] = `"my-secret"`;
+
+exports[`encrypted secrets encrypt_field_set 1`] = `
+{
+  "data": [
+    109,
+    121,
+    118,
+    97,
+    108,
+    117,
+    101,
+  ],
+  "type": "Buffer",
+}
+`;
+
+exports[`encrypted secrets secrets_getter 1`] = `"my-secret"`;
+
+exports[`encrypted secrets secrets_upsert 1`] = `true`;
+
+exports[`encrypted secrets secrets_upsert 2`] = `true`;
+
+exports[`encrypted secrets secrets_verify 1`] = `true`;

package/__tests__/secrets.test.ts

@@ -0,0 +1,193 @@
+import { getConnections, PgTestClient } from 'pgsql-test';
+
+let pg: PgTestClient;
+let teardown: () => Promise<void>;
+
+const user_id = 'dc474833-318a-41f5-9239-ee563ab657a6';
+
+describe('encrypted secrets', () => {
+  beforeAll(async () => {
+    ({ pg, teardown } = await getConnections());
+  });
+
+  afterAll(async () => {
+    await teardown();
+  });
+
+  beforeEach(async () => {
+    await pg.beforeEach();
+    
+    // Insert test data
+    await pg.any(`
+      INSERT INTO secrets_schema.secrets_table
+      ( secrets_owned_field,
+        name,
+        secrets_value_field,
+        secrets_enc_field
+      ) VALUES
+      (
+        $1::uuid,
+        'my-secret-name',
+        'my-secret'::bytea,
+        'pgp'
+      )
+    `, [user_id]);
+  });
+
+  afterEach(async () => {
+    await pg.afterEach();
+  });
+
+  it('encrypt_field_pgp_get', async () => {
+    const [{ encrypt_field_pgp_get }] = await pg.any(
+      `SELECT encrypted_secrets.encrypt_field_pgp_get(secrets_value_field, secrets_owned_field::text) 
+       FROM secrets_schema.secrets_table 
+       WHERE secrets_owned_field = $1`,
+      [user_id]
+    );
+    expect(encrypt_field_pgp_get).toMatchSnapshot();
+  });
+
+  it('encrypt_field_set', async () => {
+    const [{ encrypt_field_set }] = await pg.any(
+      `SELECT encrypted_secrets.encrypt_field_set('myvalue')`
+    );
+    expect(encrypt_field_set).toMatchSnapshot();
+  });
+
+  it('encrypt_field_bytea_to_text', async () => {
+    const [{ encrypt_field_bytea_to_text }] = await pg.any(
+      `SELECT encrypted_secrets.encrypt_field_bytea_to_text(
+        encrypted_secrets.encrypt_field_set('value-there-and-back')
+      )`
+    );
+    expect(encrypt_field_bytea_to_text).toMatchSnapshot();
+  });
+
+  it('secrets_getter', async () => {
+    const [{ secrets_getter }] = await pg.any(
+      `SELECT encrypted_secrets.secrets_getter(
+        $1::uuid,
+        'my-secret-name'
+      )`,
+      [user_id]
+    );
+    expect(secrets_getter).toMatchSnapshot();
+  });
+
+  it('secrets_verify', async () => {
+    const [{ secrets_verify }] = await pg.any(
+      `SELECT encrypted_secrets.secrets_verify(
+        $1::uuid,
+        'my-secret-name',
+        'my-secret'
+      )`,
+      [user_id]
+    );
+    expect(secrets_verify).toMatchSnapshot();
+  });
+
+  it('secrets_upsert', async () => {
+    const [{ secrets_upsert }] = await pg.any(
+      `SELECT encrypted_secrets.secrets_upsert(
+        $1::uuid,
+        'my-secret-name',
+        'my-secret-other-value'
+      )`,
+      [user_id]
+    );
+    expect(secrets_upsert).toMatchSnapshot();
+    
+    const [{ secrets_verify }] = await pg.any(
+      `SELECT encrypted_secrets.secrets_verify(
+        $1::uuid,
+        'my-secret-name',
+        'my-secret-other-value'
+      )`,
+      [user_id]
+    );
+    expect(secrets_verify).toMatchSnapshot();
+  });
+
+  it('secrets_delete single', async () => {
+    // First verify the secret exists
+    const [beforeDelete] = await pg.any(
+      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'my-secret-name')`,
+      [user_id]
+    );
+    expect(beforeDelete.secrets_getter).toBe('my-secret');
+
+    // Delete the secret
+    await pg.any(
+      `SELECT encrypted_secrets.secrets_delete($1::uuid, 'my-secret-name')`,
+      [user_id]
+    );
+
+    // Verify it's gone
+    const [afterDelete] = await pg.any(
+      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'my-secret-name', 'default-value')`,
+      [user_id]
+    );
+    expect(afterDelete.secrets_getter).toBe('default-value');
+  });
+
+  it('secrets_delete multiple', async () => {
+    // Add multiple secrets
+    await pg.any(
+      `SELECT encrypted_secrets.secrets_upsert($1::uuid, 'secret-1', 'value-1')`,
+      [user_id]
+    );
+    await pg.any(
+      `SELECT encrypted_secrets.secrets_upsert($1::uuid, 'secret-2', 'value-2')`,
+      [user_id]
+    );
+
+    // Delete multiple secrets
+    await pg.any(
+      `SELECT encrypted_secrets.secrets_delete($1::uuid, $2::text[])`,
+      [user_id, ['secret-1', 'secret-2']]
+    );
+
+    // Verify they're gone
+    const [result1] = await pg.any(
+      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'secret-1', 'not-found')`,
+      [user_id]
+    );
+    const [result2] = await pg.any(
+      `SELECT encrypted_secrets.secrets_getter($1::uuid, 'secret-2', 'not-found')`,
+      [user_id]
+    );
+    
+    expect(result1.secrets_getter).toBe('not-found');
+    expect(result2.secrets_getter).toBe('not-found');
+  });
+
+  xit('encrypt_field_pgp_getter', async () => {
+    const [{ encrypt_field_pgp_getter }] = await pg.any(
+      `SELECT encrypted_secrets.encrypt_field_pgp_getter(
+        $1::uuid,
+        'secrets_value_field',
+        'secrets_enc_field'
+      )`,
+      [user_id]
+    );
+    expect(encrypt_field_pgp_getter).toMatchSnapshot();
+  });
+
+  xit('secrets_table_upsert', async () => {
+    const [{ secrets_table_upsert }] = await pg.any(
+      `SELECT encrypted_secrets.secrets_table_upsert(
+        $1::uuid,
+        $2::json
+      )`,
+      [
+        user_id,
+        JSON.stringify({
+          myOther: 'secret',
+          hiOther: 'here'
+        })
+      ]
+    );
+    expect(secrets_table_upsert).toMatchSnapshot();
+  });
+});

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text.sql

@@ -0,0 +1,17 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_bytea_to_text(
+  secret_value bytea
+)
+  RETURNS text
+AS $$
+  SELECT
+    convert_from(encrypt_field_bytea_to_text.secret_value, 'SQL_ASCII');
+$$
+LANGUAGE 'sql' IMMUTABLE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_crypt.sql

@@ -0,0 +1,17 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_crypt to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_crypt()
+RETURNS TRIGGER
+AS $CODEZ$
+BEGIN
+    NEW.field_name = crypt(NEW.field_name::text, gen_salt('bf'));
+    RETURN NEW;
+END;
+$CODEZ$
+LANGUAGE plpgsql VOLATILE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify.sql

@@ -0,0 +1,37 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_crypt_verify(
+  secrets_owned_field uuid,
+  secret_value_field text,
+  secret_verify_value text
+)
+  RETURNS bool
+AS $$
+    DECLARE
+      result bool;
+      rec secrets_schema.secrets_table;
+      s_value text;
+    BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = encrypt_field_crypt_verify.secrets_owned_field
+    INTO rec;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_value_field)
+    USING rec
+    INTO  s_value;
+
+    SELECT
+      s_value = crypt(secret_verify_value, s_value)
+    INTO result;
+
+    RETURN result;
+END;
+$$
+LANGUAGE 'plpgsql' STABLE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_pgp.sql

@@ -0,0 +1,17 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_pgp to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp()
+RETURNS TRIGGER
+AS $CODEZ$
+BEGIN
+    NEW.field_name = pgp_sym_encrypt(encode(NEW.field_name::bytea, 'hex'), NEW.encode_field::text, 'compress-algo=1, cipher-algo=aes256');
+    RETURN NEW;
+END;
+$CODEZ$
+LANGUAGE plpgsql VOLATILE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_pgp_get.sql

@@ -0,0 +1,18 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_pgp_get to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp_get(
+  secret_value bytea,
+  secret_encode text
+)
+  RETURNS text
+AS $$
+  SELECT
+    convert_from(decode(pgp_sym_decrypt(encrypt_field_pgp_get.secret_value, encrypt_field_pgp_get.secret_encode), 'hex'), 'SQL_ASCII');
+$$
+LANGUAGE 'sql';
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter.sql

@@ -0,0 +1,42 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp_getter(
+  secrets_owned_field uuid,
+  secret_value_field text,
+  secret_encode_field text
+)
+  RETURNS text
+AS $$
+    DECLARE
+      result text;
+      rec secrets_schema.secrets_table;
+      s_value bytea;
+      s_enc text;
+    BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = encrypt_field_pgp_getter.secrets_owned_field
+    INTO rec;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_value_field)
+    USING rec
+    INTO  s_value;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_encode_field)
+    USING rec
+    INTO  s_enc;
+
+    SELECT
+    convert_from(decode(pgp_sym_decrypt(s_value, s_enc), 'hex'), 'SQL_ASCII')
+    INTO result;
+
+    RETURN result;
+END;
+$$
+LANGUAGE 'plpgsql' STABLE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/encrypt_field_set.sql

@@ -0,0 +1,16 @@
+-- Deploy schemas/encrypted_secrets/procedures/encrypt_field_set to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_set(
+  secret_value text
+)
+  RETURNS bytea
+AS $$
+  SELECT encrypt_field_set.secret_value::bytea;
+$$
+LANGUAGE 'sql';
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/secrets_delete.sql

@@ -0,0 +1,40 @@
+-- Deploy schemas/encrypted_secrets/procedures/secrets_delete to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.secrets_delete(
+  secrets_owned_field uuid,
+  secret_name text
+)
+  RETURNS void
+  AS $$
+BEGIN
+  DELETE FROM secrets_schema.secrets_table s
+  WHERE s.secrets_owned_field = secrets_delete.secrets_owned_field
+    AND s.name = secrets_delete.secret_name;
+END
+$$
+LANGUAGE 'plpgsql'
+VOLATILE;
+
+CREATE FUNCTION encrypted_secrets.secrets_delete(
+  secrets_owned_field uuid,
+  secret_names text[]
+)
+  RETURNS void
+  AS $$
+BEGIN
+  DELETE FROM secrets_schema.secrets_table s
+  WHERE s.secrets_owned_field = secrets_delete.secrets_owned_field
+    AND s.name = ANY(secrets_delete.secret_names);
+END
+$$
+LANGUAGE 'plpgsql'
+VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_delete(uuid,text) TO authenticated;
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_delete(uuid,text[]) TO authenticated;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/secrets_getter.sql

@@ -0,0 +1,43 @@
+-- Deploy schemas/encrypted_secrets/procedures/secrets_getter to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.secrets_getter(
+  secrets_owned_field uuid,
+  secret_name text,
+  default_value text default null
+)
+  RETURNS text
+  AS $$
+DECLARE
+  v_secret secrets_schema.secrets_table;
+BEGIN
+  SELECT
+    *
+  FROM
+    secrets_schema.secrets_table s
+  WHERE
+    s.name = secrets_getter.secret_name
+    AND s.secrets_owned_field = secrets_getter.secrets_owned_field
+  INTO v_secret;
+
+  IF (NOT FOUND OR v_secret IS NULL) THEN
+    RETURN secrets_getter.default_value;
+  END IF;
+  
+  IF (v_secret.secrets_enc_field = 'crypt') THEN
+    RETURN convert_from(v_secret.secrets_value_field, 'SQL_ASCII');
+  ELSIF (v_secret.secrets_enc_field = 'pgp') THEN
+    RETURN convert_from(decode(pgp_sym_decrypt(v_secret.secrets_value_field, v_secret.secrets_owned_field::text), 'hex'), 'SQL_ASCII');
+  END IF;
+
+  RETURN convert_from(v_secret.secrets_value_field, 'SQL_ASCII');
+
+END
+$$
+LANGUAGE 'plpgsql'
+STABLE;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/secrets_table_upsert.sql

@@ -0,0 +1,67 @@
+-- Deploy schemas/encrypted_secrets/procedures/secrets_table_upsert to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.secrets_table_upsert(
+  secrets_owned_field uuid,
+  data json
+)
+  RETURNS void
+AS $$
+DECLARE
+  rec secrets_schema.secrets_table;
+  _sql text;
+  key text;
+
+  fields text[] = ARRAY[]::text[];
+  values text[] = ARRAY[]::text[];
+  pairs text[] = ARRAY[]::text[];
+BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = secrets_table_upsert.secrets_owned_field
+    INTO rec;
+
+    IF (FOUND) THEN
+
+        FOR key IN SELECT json_object_keys(data)
+        LOOP
+            pairs = array_append(pairs, format('%s=%s', key, quote_literal(data->>key)));
+        END LOOP;
+
+        _sql = 'UPDATE secrets_schema.secrets_table SET '; -- it's already quoted! look at I above...
+        _sql = _sql || format('%s', array_to_string(pairs, ','));
+        _sql = _sql || ' WHERE secrets_owned_field=';
+        _sql = _sql || quote_literal(secrets_owned_field);
+        _sql = _sql || ';';
+
+    ELSE
+
+        values = array_append(values, quote_literal(secrets_owned_field));
+        fields = array_append(fields, 'secrets_owned_field');
+
+        FOR key IN SELECT json_object_keys(data)
+        LOOP
+            values = array_append(values, quote_literal(data->>key));
+            fields = array_append(fields, key);
+        END LOOP;
+
+        _sql = 'INSERT INTO secrets_schema.secrets_table ('; -- it's already quoted! look at I above...
+        _sql = _sql || format('%s)', array_to_string(fields, ','));
+        _sql = _sql || ' VALUES (';
+        _sql = _sql || format('%s)', array_to_string(values, ','));
+        _sql = _sql || ';';
+
+    END IF;
+
+    EXECUTE _sql;
+
+END;
+$$
+LANGUAGE 'plpgsql' VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_table_upsert TO authenticated;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/secrets_upsert.sql

@@ -0,0 +1,33 @@
+-- Deploy schemas/encrypted_secrets/procedures/secrets_upsert to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.secrets_upsert(
+  v_secrets_owned_field uuid,
+  secret_name text,
+  secret_value text,
+  field_encoding text = 'pgp'
+)
+  RETURNS boolean
+  AS $$
+BEGIN
+  INSERT INTO secrets_schema.secrets_table (secrets_owned_field, name, secrets_value_field, secrets_enc_field)
+    VALUES (v_secrets_owned_field, secrets_upsert.secret_name, secrets_upsert.secret_value::bytea, secrets_upsert.field_encoding)
+    ON CONFLICT (secrets_owned_field, name)
+    DO
+    UPDATE
+    SET
+      -- don't change this, cannot use EXCLUDED, don't know why, but you have to set to the ::bytea
+      secrets_value_field = secrets_upsert.secret_value::bytea,
+      secrets_enc_field = EXCLUDED.secrets_enc_field;
+  RETURN TRUE;
+END
+$$
+LANGUAGE 'plpgsql'
+VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_upsert TO authenticated;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/procedures/secrets_verify.sql

@@ -0,0 +1,46 @@
+-- Deploy schemas/encrypted_secrets/procedures/secrets_verify to pg
+
+-- requires: schemas/encrypted_secrets/schema
+
+BEGIN;
+
+CREATE FUNCTION encrypted_secrets.secrets_verify(
+  secrets_owned_field uuid,
+  secret_name text,
+  secret_value text
+)
+  RETURNS boolean
+  AS $$
+DECLARE
+  v_secret_text text;
+  v_secret secrets_schema.secrets_table;
+BEGIN
+  SELECT
+    *
+  FROM
+    encrypted_secrets.secrets_getter (secrets_verify.secrets_owned_field, secrets_verify.secret_name)
+  INTO v_secret_text;
+
+  SELECT
+    *
+  FROM
+    secrets_schema.secrets_table s
+  WHERE
+    s.name = secrets_verify.secret_name
+    AND s.secrets_owned_field = secrets_verify.secrets_owned_field INTO v_secret;
+
+  IF (v_secret.secrets_enc_field = 'crypt') THEN
+    RETURN v_secret_text = crypt(secrets_verify.secret_value::bytea::text, v_secret_text);
+  ELSIF (v_secret.secrets_enc_field = 'pgp') THEN
+    RETURN secrets_verify.secret_value = v_secret_text;
+  END IF;
+
+  RETURN secrets_verify.secret_value = v_secret_text;
+END
+$$
+LANGUAGE 'plpgsql'
+STABLE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_verify TO authenticated;
+
+COMMIT;

package/deploy/schemas/encrypted_secrets/schema.sql

@@ -0,0 +1,8 @@
+-- Deploy schemas/encrypted_secrets/schema to pg
+
+
+BEGIN;
+
+CREATE SCHEMA encrypted_secrets;
+
+COMMIT;

package/jest.config.js

@@ -0,0 +1,15 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+
+  // Match both __tests__ and colocated test files
+  testMatch: ['**/?(*.)+(test|spec).{ts,tsx,js,jsx}'],
+
+  // Ignore build artifacts and type declarations
+  testPathIgnorePatterns: ['/dist/', '\\.d\\.ts$'],
+  modulePathIgnorePatterns: ['<rootDir>/dist/'],
+  watchPathIgnorePatterns: ['/dist/'],
+
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
+};

package/launchql-encrypted-secrets.control

@@ -0,0 +1,8 @@
+# launchql-encrypted-secrets extension
+comment = 'launchql-encrypted-secrets extension'
+default_version = '0.1.0'
+module_pathname = '$libdir/launchql-encrypted-secrets'
+requires = 'pgcrypto,plpgsql,uuid-ossp,launchql-encrypted-secrets-table,launchql-default-roles,launchql-verify'
+relocatable = false
+superuser = false
+  

package/launchql.plan

@@ -0,0 +1,17 @@
+%syntax-version=1.0.0
+%project=launchql-encrypted-secrets
+%uri=launchql-encrypted-secrets
+  
+schemas/encrypted_secrets/schema 2020-11-01T21:22:30Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/schema
+schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text [schemas/encrypted_secrets/schema] 2020-11-01T21:22:54Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text
+schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify [schemas/encrypted_secrets/schema] 2020-11-01T21:23:11Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify
+schemas/encrypted_secrets/procedures/encrypt_field_crypt [schemas/encrypted_secrets/schema] 2020-11-01T21:23:19Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_crypt
+schemas/encrypted_secrets/procedures/encrypt_field_pgp_get [schemas/encrypted_secrets/schema] 2020-11-01T21:23:29Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_pgp_get
+schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter [schemas/encrypted_secrets/schema] 2020-11-01T21:23:36Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter
+schemas/encrypted_secrets/procedures/encrypt_field_pgp [schemas/encrypted_secrets/schema] 2020-11-01T21:23:45Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_pgp
+schemas/encrypted_secrets/procedures/encrypt_field_set [schemas/encrypted_secrets/schema] 2020-11-01T21:24:05Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/encrypt_field_set
+schemas/encrypted_secrets/procedures/secrets_getter [schemas/encrypted_secrets/schema] 2020-11-01T21:24:23Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/secrets_getter
+schemas/encrypted_secrets/procedures/secrets_upsert [schemas/encrypted_secrets/schema] 2020-11-01T21:24:35Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/secrets_upsert
+schemas/encrypted_secrets/procedures/secrets_verify [schemas/encrypted_secrets/schema] 2020-11-01T21:24:41Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/secrets_verify
+schemas/encrypted_secrets/procedures/secrets_table_upsert [schemas/encrypted_secrets/schema] 2020-11-01T21:25:00Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/secrets_table_upsert
+schemas/encrypted_secrets/procedures/secrets_delete [schemas/encrypted_secrets/schema] 2020-11-01T21:31:24Z Dan Lynch <dlynch@Dans-MBP-3> # add schemas/encrypted_secrets/procedures/secrets_delete

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@pgpm/encrypted-secrets",
+  "version": "0.4.0",
+  "description": "Encrypted secrets management for PostgreSQL",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "bundle": "lql package",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  },
+  "dependencies": {
+    "@pgpm/default-roles": "0.4.0",
+    "@pgpm/encrypted-secrets-table": "0.4.0",
+    "@pgpm/verify": "0.4.0"
+  },
+  "devDependencies": {
+    "@launchql/cli": "^4.9.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/launchql/extensions"
+  },
+  "homepage": "https://github.com/launchql/extensions",
+  "bugs": {
+    "url": "https://github.com/launchql/extensions/issues"
+  },
+  "gitHead": "cc9f52a335caa6e21ee7751b04b77c84ce6cb809"
+}

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_bytea_to_text;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_crypt.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_crypt from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_crypt;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_crypt_verify;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_pgp.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_pgp from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_pgp;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_pgp_get.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_pgp_get from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_pgp_get;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_pgp_getter;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/encrypt_field_set.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/encrypt_field_set from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.encrypt_field_set;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/secrets_delete.sql

@@ -0,0 +1,8 @@
+-- Revert schemas/encrypted_secrets/procedures/secrets_delete from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.secrets_delete(uuid, text);
+DROP FUNCTION encrypted_secrets.secrets_delete(uuid, text[]);
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/secrets_getter.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/secrets_getter from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.secrets_getter;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/secrets_table_upsert.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/secrets_table_upsert from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.secrets_table_upsert;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/secrets_upsert.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/secrets_upsert from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.secrets_upsert;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/procedures/secrets_verify.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/procedures/secrets_verify from pg
+
+BEGIN;
+
+DROP FUNCTION encrypted_secrets.secrets_verify;
+
+COMMIT;

package/revert/schemas/encrypted_secrets/schema.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/encrypted_secrets/schema from pg
+
+BEGIN;
+
+DROP SCHEMA encrypted_secrets;
+
+COMMIT;

package/sql/launchql-encrypted-secrets--0.1.0.sql

@@ -0,0 +1,231 @@
+\echo Use "CREATE EXTENSION launchql-encrypted-secrets" to load this file. \quit
+CREATE SCHEMA encrypted_secrets;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_bytea_to_text(secret_value bytea) RETURNS text AS $EOFCODE$
+  SELECT
+    convert_from(encrypt_field_bytea_to_text.secret_value, 'SQL_ASCII');
+$EOFCODE$ LANGUAGE sql IMMUTABLE;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_crypt_verify(secrets_owned_field uuid, secret_value_field text, secret_verify_value text) RETURNS bool AS $EOFCODE$
+    DECLARE
+      result bool;
+      rec secrets_schema.secrets_table;
+      s_value text;
+    BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = encrypt_field_crypt_verify.secrets_owned_field
+    INTO rec;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_value_field)
+    USING rec
+    INTO  s_value;
+
+    SELECT
+      s_value = crypt(secret_verify_value, s_value)
+    INTO result;
+
+    RETURN result;
+END;
+$EOFCODE$ LANGUAGE plpgsql STABLE;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_crypt() RETURNS trigger AS $EOFCODE$
+BEGIN
+    NEW.field_name = crypt(NEW.field_name::text, gen_salt('bf'));
+    RETURN NEW;
+END;
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp_get(secret_value bytea, secret_encode text) RETURNS text AS $EOFCODE$
+  SELECT
+    convert_from(decode(pgp_sym_decrypt(encrypt_field_pgp_get.secret_value, encrypt_field_pgp_get.secret_encode), 'hex'), 'SQL_ASCII');
+$EOFCODE$ LANGUAGE sql;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp_getter(secrets_owned_field uuid, secret_value_field text, secret_encode_field text) RETURNS text AS $EOFCODE$
+    DECLARE
+      result text;
+      rec secrets_schema.secrets_table;
+      s_value bytea;
+      s_enc text;
+    BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = encrypt_field_pgp_getter.secrets_owned_field
+    INTO rec;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_value_field)
+    USING rec
+    INTO  s_value;
+
+    EXECUTE format('SELECT ($1).%s::text', secret_encode_field)
+    USING rec
+    INTO  s_enc;
+
+    SELECT
+    convert_from(decode(pgp_sym_decrypt(s_value, s_enc), 'hex'), 'SQL_ASCII')
+    INTO result;
+
+    RETURN result;
+END;
+$EOFCODE$ LANGUAGE plpgsql STABLE;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_pgp() RETURNS trigger AS $EOFCODE$
+BEGIN
+    NEW.field_name = pgp_sym_encrypt(encode(NEW.field_name::bytea, 'hex'), NEW.encode_field::text, 'compress-algo=1, cipher-algo=aes256');
+    RETURN NEW;
+END;
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+CREATE FUNCTION encrypted_secrets.encrypt_field_set(secret_value text) RETURNS bytea AS $EOFCODE$
+  SELECT encrypt_field_set.secret_value::bytea;
+$EOFCODE$ LANGUAGE sql;
+
+CREATE FUNCTION encrypted_secrets.secrets_getter(secrets_owned_field uuid, secret_name text, default_value text DEFAULT NULL) RETURNS text AS $EOFCODE$
+DECLARE
+  v_secret secrets_schema.secrets_table;
+BEGIN
+  SELECT
+    *
+  FROM
+    secrets_schema.secrets_table s
+  WHERE
+    s.name = secrets_getter.secret_name
+    AND s.secrets_owned_field = secrets_getter.secrets_owned_field
+  INTO v_secret;
+
+  IF (NOT FOUND OR v_secret IS NULL) THEN
+    RETURN secrets_getter.default_value;
+  END IF;
+  
+  IF (v_secret.secrets_enc_field = 'crypt') THEN
+    RETURN convert_from(v_secret.secrets_value_field, 'SQL_ASCII');
+  ELSIF (v_secret.secrets_enc_field = 'pgp') THEN
+    RETURN convert_from(decode(pgp_sym_decrypt(v_secret.secrets_value_field, v_secret.secrets_owned_field::text), 'hex'), 'SQL_ASCII');
+  END IF;
+
+  RETURN convert_from(v_secret.secrets_value_field, 'SQL_ASCII');
+
+END
+$EOFCODE$ LANGUAGE plpgsql STABLE;
+
+CREATE FUNCTION encrypted_secrets.secrets_upsert(v_secrets_owned_field uuid, secret_name text, secret_value text, field_encoding text DEFAULT 'pgp') RETURNS boolean AS $EOFCODE$
+BEGIN
+  INSERT INTO secrets_schema.secrets_table (secrets_owned_field, name, secrets_value_field, secrets_enc_field)
+    VALUES (v_secrets_owned_field, secrets_upsert.secret_name, secrets_upsert.secret_value::bytea, secrets_upsert.field_encoding)
+    ON CONFLICT (secrets_owned_field, name)
+    DO
+    UPDATE
+    SET
+      -- don't change this, cannot use EXCLUDED, don't know why, but you have to set to the ::bytea
+      secrets_value_field = secrets_upsert.secret_value::bytea,
+      secrets_enc_field = EXCLUDED.secrets_enc_field;
+  RETURN TRUE;
+END
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_upsert TO authenticated;
+
+CREATE FUNCTION encrypted_secrets.secrets_verify(secrets_owned_field uuid, secret_name text, secret_value text) RETURNS boolean AS $EOFCODE$
+DECLARE
+  v_secret_text text;
+  v_secret secrets_schema.secrets_table;
+BEGIN
+  SELECT
+    *
+  FROM
+    encrypted_secrets.secrets_getter (secrets_verify.secrets_owned_field, secrets_verify.secret_name)
+  INTO v_secret_text;
+
+  SELECT
+    *
+  FROM
+    secrets_schema.secrets_table s
+  WHERE
+    s.name = secrets_verify.secret_name
+    AND s.secrets_owned_field = secrets_verify.secrets_owned_field INTO v_secret;
+
+  IF (v_secret.secrets_enc_field = 'crypt') THEN
+    RETURN v_secret_text = crypt(secrets_verify.secret_value::bytea::text, v_secret_text);
+  ELSIF (v_secret.secrets_enc_field = 'pgp') THEN
+    RETURN secrets_verify.secret_value = v_secret_text;
+  END IF;
+
+  RETURN secrets_verify.secret_value = v_secret_text;
+END
+$EOFCODE$ LANGUAGE plpgsql STABLE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_verify TO authenticated;
+
+CREATE FUNCTION encrypted_secrets.secrets_table_upsert(secrets_owned_field uuid, data pg_catalog.json) RETURNS void AS $EOFCODE$
+DECLARE
+  rec secrets_schema.secrets_table;
+  _sql text;
+  key text;
+
+  fields text[] = ARRAY[]::text[];
+  values text[] = ARRAY[]::text[];
+  pairs text[] = ARRAY[]::text[];
+BEGIN
+
+    SELECT * FROM secrets_schema.secrets_table s
+    WHERE s.secrets_owned_field = secrets_table_upsert.secrets_owned_field
+    INTO rec;
+
+    IF (FOUND) THEN
+
+        FOR key IN SELECT json_object_keys(data)
+        LOOP
+            pairs = array_append(pairs, format('%s=%s', key, quote_literal(data->>key)));
+        END LOOP;
+
+        _sql = 'UPDATE secrets_schema.secrets_table SET '; -- it's already quoted! look at I above...
+        _sql = _sql || format('%s', array_to_string(pairs, ','));
+        _sql = _sql || ' WHERE secrets_owned_field=';
+        _sql = _sql || quote_literal(secrets_owned_field);
+        _sql = _sql || ';';
+
+    ELSE
+
+        values = array_append(values, quote_literal(secrets_owned_field));
+        fields = array_append(fields, 'secrets_owned_field');
+
+        FOR key IN SELECT json_object_keys(data)
+        LOOP
+            values = array_append(values, quote_literal(data->>key));
+            fields = array_append(fields, key);
+        END LOOP;
+
+        _sql = 'INSERT INTO secrets_schema.secrets_table ('; -- it's already quoted! look at I above...
+        _sql = _sql || format('%s)', array_to_string(fields, ','));
+        _sql = _sql || ' VALUES (';
+        _sql = _sql || format('%s)', array_to_string(values, ','));
+        _sql = _sql || ';';
+
+    END IF;
+
+    EXECUTE _sql;
+
+END;
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_table_upsert TO authenticated;
+
+CREATE FUNCTION encrypted_secrets.secrets_delete(secrets_owned_field uuid, secret_name text) RETURNS void AS $EOFCODE$
+BEGIN
+  DELETE FROM secrets_schema.secrets_table s
+  WHERE s.secrets_owned_field = secrets_delete.secrets_owned_field
+    AND s.name = secrets_delete.secret_name;
+END
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+CREATE FUNCTION encrypted_secrets.secrets_delete(secrets_owned_field uuid, secret_names text[]) RETURNS void AS $EOFCODE$
+BEGIN
+  DELETE FROM secrets_schema.secrets_table s
+  WHERE s.secrets_owned_field = secrets_delete.secrets_owned_field
+    AND s.name = ANY(secrets_delete.secret_names);
+END
+$EOFCODE$ LANGUAGE plpgsql VOLATILE;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_delete(uuid, text) TO authenticated;
+
+GRANT EXECUTE ON FUNCTION encrypted_secrets.secrets_delete(uuid, text[]) TO authenticated;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_bytea_to_text  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_bytea_to_text');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_crypt.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_crypt  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_crypt');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_crypt_verify  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_crypt_verify');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_pgp.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_pgp  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_pgp');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_pgp_get.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_pgp_get  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_pgp_get');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_pgp_getter  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_pgp_getter');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/encrypt_field_set.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/encrypt_field_set  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.encrypt_field_set');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/secrets_delete.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/secrets_delete  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.secrets_delete');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/secrets_getter.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/secrets_getter  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.secrets_getter');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/secrets_table_upsert.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/secrets_table_upsert  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.secrets_table_upsert');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/secrets_upsert.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/secrets_upsert  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.secrets_upsert');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/procedures/secrets_verify.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/procedures/secrets_verify  on pg
+
+BEGIN;
+
+SELECT verify_function ('encrypted_secrets.secrets_verify');
+
+ROLLBACK;

package/verify/schemas/encrypted_secrets/schema.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/encrypted_secrets/schema  on pg
+
+BEGIN;
+
+SELECT verify_schema ('encrypted_secrets');
+
+ROLLBACK;