@pikku/core 0.12.107 → 0.12.111

package/src/wirings/addon/addon-runner.ts

@@ -1,236 +0,0 @@
-import { pikkuState } from '../../pikku-state.js'
-import type {
-  CoreConfig,
-  CoreSingletonServices,
-} from '../../types/core.types.js'
-import type { SecretService } from '../../services/secret-service.js'
-import { ScopedSecretService } from '../../services/scoped-secret-service.js'
-import { ScopedCredentialService } from '../../services/scoped-credential-service.js'
-import type { VariablesService } from '../../services/variables-service.js'
-
-export type AddonInstance = {
-  namespace: string
-  secretOverrides?: Record<string, string>
-  variableOverrides?: Record<string, string>
-  credentialOverrides?: Record<string, string>
-  /** Set by the consuming app: secrets it lends this instance, as the addon names them. */
-  secretGrants?: string[]
-  /** Set by the consuming app: credentials it lends this instance, as the addon names them. */
-  credentialGrants?: string[]
-  /** Set by the consuming app to opt this instance out of secret scoping. */
-  globalSecrets?: string
-  /** Set by the consuming app to opt this instance out of credential scoping. */
-  globalCredentials?: string
-}
-
-/**
- * What the addon declared, plus what the host lent it. Scoping runs outside the
- * aliaser, so every name here is the one the addon reads — which is why an
- * override's *key* grants, and its value does not.
- */
-const allowedNames = (
-  declared: string[] | null | undefined,
-  grants: string[] | undefined,
-  overrides: Record<string, string> | undefined
-): Set<string> =>
-  new Set([
-    ...(declared ?? []),
-    ...(grants ?? []),
-    ...Object.keys(overrides ?? {}),
-  ])
-
-const aliasSecretService = (
-  secrets: SecretService,
-  overrides: Record<string, string>
-): SecretService => {
-  const map = (key: string) => overrides[key] ?? key
-  return {
-    getSecret: <T = string>(key: string) => secrets.getSecret<T>(map(key)),
-    hasSecret: (key: string) => secrets.hasSecret(map(key)),
-    setSecret: (key: string, value: unknown) =>
-      secrets.setSecret(map(key), value),
-    deleteSecret: (key: string) => secrets.deleteSecret(map(key)),
-    getSecrets: async (keys) => {
-      const result = await secrets.getSecrets(keys.map(map))
-      const out: Record<string, unknown> = {}
-      for (const logical of keys) {
-        const real = map(logical)
-        if (real in result)
-          out[logical] = (result as Record<string, unknown>)[real]
-      }
-      return out as never
-    },
-  }
-}
-
-const aliasVariablesService = (
-  variables: VariablesService,
-  overrides: Record<string, string>
-): VariablesService => {
-  const map = (name: string) => overrides[name] ?? name
-  return {
-    get: <T = string>(name: string) => variables.get<T>(map(name)),
-    getVariables: (names) => {
-      const result = variables.getVariables(names.map(map) as never)
-      const remap = (r: Record<string, unknown>) => {
-        const out: Record<string, unknown> = {}
-        for (const logical of names) {
-          const real = map(logical)
-          if (real in r) out[logical] = r[real]
-        }
-        return out
-      }
-      return result instanceof Promise
-        ? (result.then(remap) as never)
-        : (remap(result as Record<string, unknown>) as never)
-    },
-    getAll: () => variables.getAll(),
-    set: (name: string, value: unknown) => variables.set(map(name), value),
-    has: (name: string) => variables.has(map(name)),
-    delete: (name: string) => variables.delete(map(name)),
-  }
-}
-
-const findAddonNamespaceForPackage = (packageName: string): string | null => {
-  const addons = pikkuState(null, 'addons', 'packages')
-  if (!addons) return null
-  for (const [namespace, cfg] of addons.entries()) {
-    if (cfg?.package === packageName) return namespace
-  }
-  return null
-}
-
-const wrapWorkflowServiceForPackage = <T extends object>(
-  service: T,
-  packageName: string,
-  namespace: string | null
-): T => {
-  return new Proxy(service, {
-    get(target, prop, receiver) {
-      if (prop === 'startWorkflow' || prop === 'runToCompletion') {
-        const original = Reflect.get(target, prop, receiver) as Function
-        return function (this: any, name: string, ...rest: any[]) {
-          if (typeof name === 'string' && !name.includes(':')) {
-            const ns = namespace ?? findAddonNamespaceForPackage(packageName)
-            if (ns) {
-              name = `${ns}:${name}`
-            }
-          }
-          return original.call(this, name, ...rest)
-        }
-      }
-      return Reflect.get(target, prop, receiver)
-    },
-  })
-}
-
-export const getOrCreatePackageSingletonServices = async (
-  packageName: string,
-  parentServices: CoreSingletonServices,
-  addonInstance?: AddonInstance
-): Promise<CoreSingletonServices> => {
-  const cacheKey = addonInstance?.namespace ?? packageName
-
-  const cachedServices = pikkuState(cacheKey, 'package', 'singletonServices')
-  if (cachedServices) {
-    return cachedServices
-  }
-
-  const factories = pikkuState(packageName, 'package', 'factories')
-
-  let existingServices = parentServices
-  if (addonInstance?.secretOverrides && parentServices.secrets) {
-    existingServices = {
-      ...existingServices,
-      secrets: aliasSecretService(
-        parentServices.secrets,
-        addonInstance.secretOverrides
-      ),
-    }
-  }
-  if (addonInstance?.variableOverrides && parentServices.variables) {
-    existingServices = {
-      ...existingServices,
-      variables: aliasVariablesService(
-        parentServices.variables,
-        addonInstance.variableOverrides
-      ),
-    }
-  }
-  if (!addonInstance?.globalSecrets && existingServices.secrets) {
-    existingServices = {
-      ...existingServices,
-      secrets: new ScopedSecretService(
-        existingServices.secrets,
-        allowedNames(
-          pikkuState(packageName, 'package', 'declaredSecrets'),
-          addonInstance?.secretGrants,
-          addonInstance?.secretOverrides
-        )
-      ),
-    }
-  }
-  if (!addonInstance?.globalCredentials && existingServices.credentialService) {
-    existingServices = {
-      ...existingServices,
-      credentialService: new ScopedCredentialService(
-        existingServices.credentialService,
-        allowedNames(
-          Object.keys(
-            pikkuState(packageName, 'package', 'credentialsMeta') ?? {}
-          ),
-          addonInstance?.credentialGrants,
-          addonInstance?.credentialOverrides
-        )
-      ),
-    }
-  }
-
-  if (!factories || !factories.createSingletonServices) {
-    return existingServices
-  }
-
-  let config: CoreConfig = existingServices.config
-  if (factories.createConfig) {
-    config = await factories.createConfig(existingServices.variables)
-  }
-
-  const packageServices = await factories.createSingletonServices(
-    config,
-    existingServices
-  )
-
-  if (
-    packageServices.workflowService &&
-    typeof packageServices.workflowService === 'object'
-  ) {
-    packageServices.workflowService = wrapWorkflowServiceForPackage(
-      packageServices.workflowService as object,
-      packageName,
-      addonInstance?.namespace ?? null
-    ) as typeof packageServices.workflowService
-  }
-
-  pikkuState(cacheKey, 'package', 'singletonServices', packageServices)
-
-  return packageServices
-}
-
-export const addonInstanceForNamespace = (
-  namespace: string | undefined,
-  expectedPackage: string
-): AddonInstance | undefined => {
-  if (!namespace) return undefined
-  const cfg = pikkuState(null, 'addons', 'packages').get(namespace)
-  if (!cfg || cfg.package !== expectedPackage) return undefined
-  return {
-    namespace,
-    secretOverrides: cfg.secretOverrides,
-    variableOverrides: cfg.variableOverrides,
-    credentialOverrides: cfg.credentialOverrides,
-    secretGrants: cfg.secretGrants,
-    credentialGrants: cfg.credentialGrants,
-    globalSecrets: cfg.globalSecrets,
-    globalCredentials: cfg.globalCredentials,
-  }
-}

package/src/wirings/addon/addon-scopes.test.ts

@@ -1,225 +0,0 @@
-import { beforeEach, describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { addFunction, runPikkuFunc } from '../../function/function-runner.js'
-import { pikkuState, resetPikkuState } from '../../pikku-state.js'
-import { MissingScopeError } from '../../errors/errors.js'
-import { ContextAwareRPCService } from '../rpc/rpc-runner.js'
-import { wireAddon } from './wire-addon.js'
-
-const ADDON_PACKAGE = '@addon/console'
-
-const createServices = () =>
-  ({
-    logger: {
-      debug: () => {},
-      info: () => {},
-      warn: () => {},
-      error: () => {},
-    },
-  }) as never
-
-const registerAddonFunction = (
-  funcName: string,
-  { scopes }: { scopes?: string[] } = {}
-) => {
-  addFunction(funcName, { func: async () => 'ok' } as never, ADDON_PACKAGE)
-  pikkuState(ADDON_PACKAGE, 'function', 'meta')[funcName] = {
-    name: funcName,
-    sessionless: true,
-    permissions: [],
-    scopes,
-  } as never
-}
-
-const session = (scopes?: string[]) => ({ userId: 'u1', scopes }) as never
-
-/** How an addon function is reached over RPC: `namespace:function`. */
-const callOverRPC = (namespacedFunction: string, sessionScopes?: string[]) => {
-  const service = new ContextAwareRPCService(
-    createServices(),
-    { session: session(sessionScopes) } as never,
-    { requiresAuth: false }
-  )
-  return service.rpc(namespacedFunction, {})
-}
-
-/**
- * How an addon function is reached over a directly-wired HTTP route: the
- * inspector records the addon package on the route meta and the HTTP runner
- * hands it to `runPikkuFunc`, never passing through namespace resolution.
- */
-const callOverDirectWiring = (
-  funcName: string,
-  sessionScopes?: string[],
-  wireType: string = 'http',
-  wireId: string = 'get:/console/thing'
-) =>
-  runPikkuFunc(wireType as never, wireId, funcName, {
-    singletonServices: createServices(),
-    data: () => ({}),
-    auth: false,
-    packageName: ADDON_PACKAGE,
-    wire: { session: session(sessionScopes) } as never,
-  })
-
-beforeEach(() => {
-  resetPikkuState()
-  pikkuState(null, 'package', 'singletonServices', createServices())
-})
-
-describe('wireAddon scopes', () => {
-  test('denies a session lacking the addon scope', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('credentialGet')
-
-    await assert.rejects(
-      () => callOverRPC('console:credentialGet', ['billing:read']),
-      MissingScopeError
-    )
-  })
-
-  test('allows a session holding the addon scope', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('credentialGet')
-
-    assert.equal(await callOverRPC('console:credentialGet', ['admin']), 'ok')
-  })
-
-  test('denies a session with no scopes at all', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('credentialGet')
-
-    await assert.rejects(
-      () => callOverRPC('console:credentialGet'),
-      MissingScopeError
-    )
-  })
-
-  test('unions addon scopes with the function’s own scopes', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('installAddon', { scopes: ['packages:install'] })
-
-    await assert.rejects(
-      () => callOverRPC('console:installAddon', ['admin']),
-      MissingScopeError
-    )
-    await assert.rejects(
-      () => callOverRPC('console:installAddon', ['packages:install']),
-      MissingScopeError
-    )
-    assert.equal(
-      await callOverRPC('console:installAddon', ['admin', 'packages:install']),
-      'ok'
-    )
-  })
-
-  test('satisfies an addon scope through the scope hierarchy', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('credentialGet')
-
-    assert.equal(await callOverRPC('console:credentialGet', ['admin:*']), 'ok')
-    assert.equal(await callOverRPC('console:credentialGet', ['*']), 'ok')
-  })
-
-  test('leaves an addon wired without scopes ungated', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE })
-    registerAddonFunction('credentialGet')
-
-    assert.equal(await callOverRPC('console:credentialGet', []), 'ok')
-  })
-
-  test('leaves the function’s own scopes intact on an unscoped addon', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE })
-    registerAddonFunction('installAddon', { scopes: ['packages:install'] })
-
-    await assert.rejects(
-      () => callOverRPC('console:installAddon', ['admin']),
-      MissingScopeError
-    )
-    assert.equal(
-      await callOverRPC('console:installAddon', ['packages:install']),
-      'ok'
-    )
-  })
-
-  test('gates a directly-wired route into the addon package', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('streamWorkflowRun')
-
-    await assert.rejects(
-      () => callOverDirectWiring('streamWorkflowRun', ['billing:read']),
-      MissingScopeError
-    )
-    assert.equal(
-      await callOverDirectWiring('streamWorkflowRun', ['admin']),
-      'ok'
-    )
-  })
-
-  test('gates a directly-wired route when the package is wired under several namespaces', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    wireAddon({ name: 'consoleReadonly', package: ADDON_PACKAGE })
-    registerAddonFunction('streamWorkflowRun')
-
-    await assert.rejects(
-      () => callOverDirectWiring('streamWorkflowRun', []),
-      MissingScopeError
-    )
-  })
-
-  test('leaves a directly-wired route into an unscoped addon package ungated', async () => {
-    wireAddon({ name: 'console', package: ADDON_PACKAGE })
-    registerAddonFunction('streamWorkflowRun')
-
-    assert.equal(await callOverDirectWiring('streamWorkflowRun', []), 'ok')
-  })
-
-  test('gates every wiring kind, not just http', async () => {
-    // The inspector writes the addon package onto all of these, and each
-    // runner calls runPikkuFunc without ever resolving a namespace.
-    const wireTypes = [
-      'http',
-      'channel',
-      'queue',
-      'scheduler',
-      'cli',
-      'mcp',
-      'trigger',
-      'gateway',
-    ]
-
-    wireAddon({ name: 'console', package: ADDON_PACKAGE, scopes: ['admin'] })
-    registerAddonFunction('streamWorkflowRun')
-
-    for (const wireType of wireTypes) {
-      await assert.rejects(
-        () =>
-          callOverDirectWiring(
-            'streamWorkflowRun',
-            ['billing:read'],
-            wireType,
-            `${wireType}:console`
-          ),
-        MissingScopeError,
-        `${wireType} did not gate on the addon scope`
-      )
-      assert.equal(
-        await callOverDirectWiring(
-          'streamWorkflowRun',
-          ['admin'],
-          wireType,
-          `${wireType}:console`
-        ),
-        'ok',
-        `${wireType} rejected a session holding the addon scope`
-      )
-    }
-  })
-
-  test('leaves a non-addon package untouched', async () => {
-    registerAddonFunction('streamWorkflowRun')
-
-    assert.equal(await callOverDirectWiring('streamWorkflowRun', []), 'ok')
-  })
-})