@pikku/azure-functions 0.12.4 → 0.12.5

package/CHANGELOG.md

@@ -1,3 +1,47 @@
+## 0.12.5
+
+### Patch Changes
+
+- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
+  vault secret cannot reach a sink by accident.
+
+  `SecretValue` is nominally typed, which means it is not assignable to `string`
+  (or to any other concretely-typed field). Every sink with a real type — a
+  database column, an email body, a session payload — rejects it with no lint
+  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
+  queue payloads, webhook and email inputs, and a function's own output — are
+  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
+  `T`, however deeply nested, to `never`.
+
+  Unwrap deliberately at the point the secret reaches the wire:
+
+  ```ts
+  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
+  betterAuth({ secret: secret.reveal() })
+  ```
+
+  Two behaviours cover what types cannot see. Structured serialization redacts —
+  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
+  write stays honest without crashing the request. String coercion throws
+  `SecretCoercionError`, because a template literal is always a leak.
+
+  `AuditLog.write` is guarded the same way as the logger, since an audit event
+  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
+  secret landing in one.
+
+  `.reveal()` is the deliberate escape hatch, and what it hands back is an
+  ordinary string as far as every sink signature is concerned. **PKU953** closes
+  that gap: under `pikku all --security` the inspector reports a revealed secret
+  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
+
+  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
+  `unknown` and wrote the result straight into an `Authorization` header.
+
+- Updated dependencies [62ea4cc]
+- Updated dependencies [9dddff8]
+- Updated dependencies [78b29f0]
+  - @pikku/core@0.12.76
+
 ## 0.12.4
 
 ### Patch Changes

package/dist/pikku-az-functions-logger.d.ts

@@ -1,12 +1,23 @@
 import type { InvocationContext } from '@azure/functions';
 import type { Logger, LogLevel } from '@pikku/core/services';
+import type { Safe } from '@pikku/core';
 export declare class AzInvocationLogger implements Logger {
     private context;
     constructor(context: InvocationContext);
-    info(messageOrObj: string | Record<string, any>): void;
-    warn(messageOrObj: string | Record<string, any>): void;
-    error(messageOrObj: string | Record<string, any> | Error): void;
-    debug(message: string): void;
-    trace(message: string): void;
+    info<M extends string | Record<string, any>, A extends unknown[]>(messageOrObj: Safe<M>, ...meta: {
+        [K in keyof A]: Safe<A[K]>;
+    }): void;
+    warn<M extends string | Record<string, any>, A extends unknown[]>(messageOrObj: Safe<M>, ...meta: {
+        [K in keyof A]: Safe<A[K]>;
+    }): void;
+    error<M extends string | Record<string, any> | Error, A extends unknown[]>(messageOrObj: Safe<M>, ...meta: {
+        [K in keyof A]: Safe<A[K]>;
+    }): void;
+    debug<A extends unknown[]>(message: string, ...meta: {
+        [K in keyof A]: Safe<A[K]>;
+    }): void;
+    trace<A extends unknown[]>(message: string, ...meta: {
+        [K in keyof A]: Safe<A[K]>;
+    }): void;
     setLevel(level: LogLevel): void;
 }

package/dist/pikku-az-functions-logger.js

@@ -3,20 +3,20 @@ export class AzInvocationLogger {
     constructor(context) {
         this.context = context;
     }
-    info(messageOrObj) {
-        this.context.info(messageOrObj);
+    info(messageOrObj, ...meta) {
+        this.context.info(messageOrObj, ...meta);
     }
-    warn(messageOrObj) {
-        this.context.warn(messageOrObj);
+    warn(messageOrObj, ...meta) {
+        this.context.warn(messageOrObj, ...meta);
     }
-    error(messageOrObj) {
-        this.context.error(messageOrObj);
+    error(messageOrObj, ...meta) {
+        this.context.error(messageOrObj, ...meta);
     }
-    debug(message) {
-        this.context.debug(message);
+    debug(message, ...meta) {
+        this.context.debug(message, ...meta);
     }
-    trace(message) {
-        this.context.trace(message);
+    trace(message, ...meta) {
+        this.context.trace(message, ...meta);
     }
     setLevel(level) {
     }

package/dist/pikku-az-functions-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-az-functions-logger.js","sourceRoot":"","sources":["../src/pikku-az-functions-logger.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,kBAAkB;IAGT;IAApB,YAAoB,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3C,IAAI,CAAC,YAA0C;QACpD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAEM,IAAI,CAAC,YAA0C;QACpD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAEM,KAAK,CAAC,YAAkD;QAC7D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAClC,CAAC;IAEM,KAAK,CAAC,OAAe;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAEM,KAAK,CAAC,OAAe;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAEM,QAAQ,CAAC,KAAe;IAE/B,CAAC;CACF"}
+{"version":3,"file":"pikku-az-functions-logger.js","sourceRoot":"","sources":["../src/pikku-az-functions-logger.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,kBAAkB;IAGT;IAApB,YAAoB,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3C,IAAI,CACT,YAAqB,EACrB,GAAG,IAAoC;QAEvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAmB,EAAE,GAAG,IAAI,CAAC,CAAA;IACjD,CAAC;IAEM,IAAI,CACT,YAAqB,EACrB,GAAG,IAAoC;QAEvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAmB,EAAE,GAAG,IAAI,CAAC,CAAA;IACjD,CAAC;IAEM,KAAK,CAGV,YAAqB,EAAE,GAAG,IAAoC;QAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAmB,EAAE,GAAG,IAAI,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CACV,OAAe,EACf,GAAG,IAAoC;QAEvC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IACtC,CAAC;IAEM,KAAK,CACV,OAAe,EACf,GAAG,IAAoC;QAEvC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IACtC,CAAC;IAEM,QAAQ,CAAC,KAAe;IAE/B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/azure-functions",
-  "version": "0.12.4",
+  "version": "0.12.5",
   "description": "Azure Functions runtime for Pikku — HTTP, timer and storage-queue handlers",
   "license": "MIT",
   "author": "yasser.fadl@gmail.com",
@@ -8,7 +8,7 @@
   "main": "dist/index.js",
   "type": "module",
   "scripts": {
-    "tsc": "tsc",
+    "tsc": "tsc && tsc -p tsconfig.type-tests.json",
     "ncu": "npx npm-check-updates",
     "build": "tsc -b",
     "release": "npm run build && npm test",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.74"
+    "@pikku/core": "^0.12.76"
   },
   "devDependencies": {
     "typescript": "^6.0.3"

package/src/pikku-az-functions-logger.ts

@@ -1,29 +1,45 @@
 import type { InvocationContext } from '@azure/functions'
 import type { Logger, LogLevel } from '@pikku/core/services'
+import type { Safe } from '@pikku/core'
 
 export class AzInvocationLogger implements Logger {
   // private logLevel: LogLevel = LogLevel.info
 
   constructor(private context: InvocationContext) {}
 
-  public info(messageOrObj: string | Record<string, any>): void {
-    this.context.info(messageOrObj)
+  public info<M extends string | Record<string, any>, A extends unknown[]>(
+    messageOrObj: Safe<M>,
+    ...meta: { [K in keyof A]: Safe<A[K]> }
+  ): void {
+    this.context.info(messageOrObj as any, ...meta)
   }
 
-  public warn(messageOrObj: string | Record<string, any>): void {
-    this.context.warn(messageOrObj)
+  public warn<M extends string | Record<string, any>, A extends unknown[]>(
+    messageOrObj: Safe<M>,
+    ...meta: { [K in keyof A]: Safe<A[K]> }
+  ): void {
+    this.context.warn(messageOrObj as any, ...meta)
   }
 
-  public error(messageOrObj: string | Record<string, any> | Error): void {
-    this.context.error(messageOrObj)
+  public error<
+    M extends string | Record<string, any> | Error,
+    A extends unknown[],
+  >(messageOrObj: Safe<M>, ...meta: { [K in keyof A]: Safe<A[K]> }): void {
+    this.context.error(messageOrObj as any, ...meta)
   }
 
-  public debug(message: string): void {
-    this.context.debug(message)
+  public debug<A extends unknown[]>(
+    message: string,
+    ...meta: { [K in keyof A]: Safe<A[K]> }
+  ): void {
+    this.context.debug(message, ...meta)
   }
 
-  public trace(message: string): void {
-    this.context.trace(message)
+  public trace<A extends unknown[]>(
+    message: string,
+    ...meta: { [K in keyof A]: Safe<A[K]> }
+  ): void {
+    this.context.trace(message, ...meta)
   }
 
   public setLevel(level: LogLevel): void {

package/src/pikku-az-functions-logger.type.test.ts

@@ -0,0 +1,18 @@
+import { createSecretValue } from '@pikku/core'
+import type { AzInvocationLogger } from './pikku-az-functions-logger.js'
+
+// A concrete logger must not be a way around the `Logger` guard.
+const _assertions = (logger: AzInvocationLogger) => {
+  const secret = createSecretValue('sk-live-DEADBEEF')
+
+  // @ts-expect-error a secret cannot be logged
+  logger.info(secret)
+  // @ts-expect-error nor nested in the message
+  logger.info({ token: secret })
+  // @ts-expect-error nor in the metadata
+  logger.warn('using', { token: secret })
+
+  logger.info('fine')
+  logger.info({ count: 1 })
+}
+void _assertions

package/tsconfig.type-tests.json

@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "composite": false,
+    "declaration": false,
+    "declarationMap": false
+  },
+  "files": [
+    "src/pikku-az-functions-logger.type.test.ts"
+  ]
+}