@pikku/core 0.12.107 → 0.12.112

package/src/wirings/queue/queue-identity.test.ts

@@ -1,454 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { wireQueueWorker, runQueueJob } from './queue-runner.js'
-import {
-  QUEUE_IDENTITY_INFO,
-  QUEUE_IDENTITY_SECRET_NAME,
-  resetQueueIdentityLogLatch,
-  signQueueIdentity,
-} from './queue-identity.js'
-import {
-  REMOTE_SESSION_INFO,
-  signWithKeyMaterial,
-  verifyWithKeyMaterial,
-} from '../../crypto-utils.js'
-import { WeakKeyMaterialError } from '../../errors/errors.js'
-import { SignedQueueService } from './signed-queue-service.js'
-import { resetPikkuState, pikkuState } from '../../pikku-state.js'
-import type {
-  CoreQueueWorker,
-  JobOptions,
-  QueueJob,
-  QueueService,
-} from './queue.types.js'
-import { createSecretValue } from '../../classification/secret-value.js'
-
-const QUEUE_NAME = 'identity-queue'
-const SECRET = 'a'.repeat(48)
-const JOB_DATA = { message: 'hello' }
-
-beforeEach(() => {
-  resetPikkuState()
-  resetQueueIdentityLogLatch()
-})
-
-const createMockLogger = () => {
-  const logs: Array<{ level: string; message: string }> = []
-  return {
-    info: (msg: any) => logs.push({ level: 'info', message: String(msg) }),
-    warn: (msg: any) => logs.push({ level: 'warn', message: String(msg) }),
-    error: (msg: any) => logs.push({ level: 'error', message: String(msg) }),
-    debug: (msg: any) => logs.push({ level: 'debug', message: String(msg) }),
-    getLogs: () => logs,
-  }
-}
-
-const createSecretService = (secrets: Record<string, string>) =>
-  ({
-    getSecret: async (key: string) => {
-      const value = secrets[key]
-      if (value === undefined) {
-        throw new Error(`Secret not found: ${key}`)
-      }
-      return createSecretValue(value)
-    },
-    hasSecret: async (key: string) => secrets[key] !== undefined,
-    setSecret: async () => {},
-    deleteSecret: async () => {},
-    getSecrets: async () => ({}),
-  }) as any
-
-type Capture = {
-  ran: boolean
-  pikkuUserId?: string
-  queuePikkuUserId?: string
-}
-
-const wireIdentityWorker = (capture: Capture, queueName = QUEUE_NAME) => {
-  const worker: CoreQueueWorker = {
-    name: queueName,
-    func: {
-      func: async (_services: any, _data: any, wire: any) => {
-        capture.ran = true
-        capture.pikkuUserId = wire.pikkuUserId
-        capture.queuePikkuUserId = wire.queue.pikkuUserId
-        return 'ok'
-      },
-      auth: false,
-    },
-  }
-  pikkuState(null, 'queue', 'meta')[queueName] = {
-    pikkuFuncId: `queue_${queueName}`,
-    name: queueName,
-  }
-  pikkuState(null, 'function', 'meta')[`queue_${queueName}`] = {
-    pikkuFuncId: `queue_${queueName}`,
-    inputSchemaName: null,
-    outputSchemaName: null,
-    sessionless: true,
-    middleware: undefined,
-    permissions: undefined,
-  }
-  wireQueueWorker(worker)
-}
-
-const useSingletonServices = (
-  logger: ReturnType<typeof createMockLogger>,
-  secrets?: Record<string, string>
-) => {
-  pikkuState(null, 'package', 'singletonServices', {
-    logger,
-    ...(secrets ? { secrets: createSecretService(secrets) } : {}),
-  } as any)
-}
-
-const createJob = (
-  overrides: Partial<QueueJob> & { pikkuUserId?: string } = {}
-): QueueJob => ({
-  id: 'job-1',
-  queueName: QUEUE_NAME,
-  status: async () => 'active' as const,
-  data: JOB_DATA,
-  ...overrides,
-})
-
-describe('queue job identity', () => {
-  test('a forged pikkuUserId is not honoured', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    await runQueueJob({ job: createJob({ pikkuUserId: 'victim-user' }) })
-
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-    assert.equal(capture.queuePikkuUserId, undefined)
-    assert.equal(
-      logger.getLogs().filter((l) => l.level === 'error').length,
-      1,
-      'the rejection is reported'
-    )
-  })
-
-  test('a tampered signed claim is not honoured', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      data: JOB_DATA,
-    })
-    const [version, claim, signature] = signed.split('.') as [
-      string,
-      string,
-      string,
-    ]
-    const forgedClaim = Buffer.from(
-      JSON.stringify({ u: 'victim-user', q: QUEUE_NAME })
-    ).toString('base64url')
-
-    await runQueueJob({
-      job: createJob({
-        pikkuUserId: `${version}.${forgedClaim}.${signature}`,
-      }),
-    })
-
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-    assert.equal(claim !== forgedClaim, true)
-  })
-
-  test('a correctly signed job resolves its identity', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      data: JOB_DATA,
-    })
-
-    await runQueueJob({ job: createJob({ pikkuUserId: signed }) })
-
-    assert.equal(capture.pikkuUserId, 'user-1')
-    assert.equal(capture.queuePikkuUserId, 'user-1')
-    assert.equal(logger.getLogs().filter((l) => l.level === 'error').length, 0)
-  })
-
-  test('a signature is rejected when lifted onto another queue', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture, 'other-queue')
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      data: JOB_DATA,
-    })
-
-    await runQueueJob({
-      job: createJob({ queueName: 'other-queue', pikkuUserId: signed }),
-    })
-
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-  })
-
-  test('a signature is rejected when lifted onto a different payload', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      data: JOB_DATA,
-    })
-
-    await runQueueJob({
-      job: createJob({
-        id: 'job-2',
-        data: { message: 'attacker payload' },
-        pikkuUserId: signed,
-      }),
-    })
-
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-  })
-
-  test('a signature bound to a jobId is rejected on a different jobId', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      jobId: 'job-1',
-      data: JOB_DATA,
-    })
-
-    await runQueueJob({ job: createJob({ pikkuUserId: signed }) })
-    assert.equal(capture.pikkuUserId, 'user-1')
-
-    capture.pikkuUserId = undefined
-    await runQueueJob({ job: createJob({ id: 'job-9', pikkuUserId: signed }) })
-    assert.equal(capture.pikkuUserId, undefined)
-  })
-
-  test('payload property order does not change the signature binding', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    const signed = await signQueueIdentity(SECRET, 'user-1', {
-      queueName: QUEUE_NAME,
-      data: { a: 1, b: { c: 2, d: [3, 'four'] } },
-    })
-
-    await runQueueJob({
-      job: createJob({
-        data: { b: { d: [3, 'four'], c: 2 }, a: 1 },
-        pikkuUserId: signed,
-      }),
-    })
-
-    assert.equal(capture.pikkuUserId, 'user-1')
-  })
-
-  test('a job with no identity claim is unaffected', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    await runQueueJob({ job: createJob() })
-
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-    assert.equal(
-      logger.getLogs().filter((l) => l.level === 'error').length,
-      0,
-      'nothing is rejected because nothing was claimed'
-    )
-  })
-
-  test('without a configured secret the identity is dropped, the job still runs, and the warning is logged once', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger)
-
-    await runQueueJob({ job: createJob({ pikkuUserId: 'victim-user' }) })
-    assert.equal(capture.ran, true)
-    assert.equal(capture.pikkuUserId, undefined)
-
-    capture.ran = false
-    await runQueueJob({
-      job: createJob({ id: 'job-2', pikkuUserId: 'victim-user' }),
-    })
-    assert.equal(capture.ran, true, 'the queue keeps processing')
-    assert.equal(capture.pikkuUserId, undefined)
-
-    const warnings = logger
-      .getLogs()
-      .filter((l) => l.level === 'warn' && l.message.includes('is configured'))
-    assert.equal(warnings.length, 1, 'warned once per process, not per job')
-  })
-})
-
-describe('queue identity key derivation', () => {
-  test('a signature does not verify under another info namespace', async () => {
-    const payload = 'pq1.claim.{}'
-    const signature = await signWithKeyMaterial(
-      QUEUE_IDENTITY_SECRET_NAME,
-      SECRET,
-      QUEUE_IDENTITY_INFO,
-      payload
-    )
-
-    assert.equal(
-      await verifyWithKeyMaterial(
-        QUEUE_IDENTITY_SECRET_NAME,
-        SECRET,
-        QUEUE_IDENTITY_INFO,
-        payload,
-        signature
-      ),
-      true
-    )
-    assert.equal(
-      await verifyWithKeyMaterial(
-        QUEUE_IDENTITY_SECRET_NAME,
-        SECRET,
-        REMOTE_SESSION_INFO,
-        payload,
-        signature
-      ),
-      false
-    )
-  })
-
-  test('a secret shorter than the minimum is rejected at signing time', async () => {
-    await assert.rejects(
-      () =>
-        signQueueIdentity('short-secret', 'user-1', {
-          queueName: QUEUE_NAME,
-          data: JOB_DATA,
-        }),
-      (error: any) => error instanceof WeakKeyMaterialError
-    )
-  })
-
-  test('a secret shorter than the minimum drops the identity at the worker', async () => {
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-
-    const logger = createMockLogger()
-    useSingletonServices(logger, {
-      [QUEUE_IDENTITY_SECRET_NAME]: 'short-secret',
-    })
-
-    await runQueueJob({ job: createJob({ pikkuUserId: 'victim-user' }) })
-
-    assert.equal(capture.ran, true, 'the queue keeps processing')
-    assert.equal(capture.pikkuUserId, undefined)
-    assert.equal(logger.getLogs().filter((l) => l.level === 'error').length, 1)
-  })
-})
-
-describe('SignedQueueService', () => {
-  const createRecordingQueue = () => {
-    const calls: Array<{
-      queueName: string
-      data: unknown
-      options?: JobOptions
-    }> = []
-    const queueService: QueueService = {
-      supportsResults: true,
-      add: async (queueName, data, options) => {
-        calls.push({ queueName, data, options })
-        return 'job-1'
-      },
-      getJob: async () => null,
-    }
-    return { calls, queueService }
-  }
-
-  test('signs the identity so the worker resolves it end to end', async () => {
-    const { calls, queueService } = createRecordingQueue()
-    const logger = createMockLogger()
-    const signing = new SignedQueueService(
-      queueService,
-      createSecretService({ [QUEUE_IDENTITY_SECRET_NAME]: SECRET }),
-      logger as any
-    )
-
-    await signing.add(QUEUE_NAME, JOB_DATA, { pikkuUserId: 'user-1' })
-
-    const enqueued = calls[0]!
-    assert.notEqual(enqueued.options?.pikkuUserId, 'user-1')
-    assert.equal(enqueued.options?.pikkuUserId?.startsWith('pq1.'), true)
-
-    const capture: Capture = { ran: false }
-    wireIdentityWorker(capture)
-    useSingletonServices(logger, { [QUEUE_IDENTITY_SECRET_NAME]: SECRET })
-
-    await runQueueJob({
-      job: createJob({ pikkuUserId: enqueued.options?.pikkuUserId }),
-    })
-
-    assert.equal(capture.pikkuUserId, 'user-1')
-  })
-
-  test('drops the identity and warns once when no secret is configured', async () => {
-    const { calls, queueService } = createRecordingQueue()
-    const logger = createMockLogger()
-    const signing = new SignedQueueService(
-      queueService,
-      createSecretService({}),
-      logger as any
-    )
-
-    await signing.add(QUEUE_NAME, JOB_DATA, { pikkuUserId: 'user-1' })
-    await signing.add(QUEUE_NAME, JOB_DATA, { pikkuUserId: 'user-2' })
-
-    assert.equal(calls[0]?.options?.pikkuUserId, undefined)
-    assert.equal(calls[1]?.options?.pikkuUserId, undefined)
-    assert.equal(
-      logger.getLogs().filter((l) => l.level === 'warn').length,
-      1,
-      'warned once per process, not per enqueue'
-    )
-  })
-
-  test('passes jobs without an identity straight through', async () => {
-    const { calls, queueService } = createRecordingQueue()
-    const logger = createMockLogger()
-    const signing = new SignedQueueService(
-      queueService,
-      createSecretService({ [QUEUE_IDENTITY_SECRET_NAME]: SECRET }),
-      logger as any
-    )
-
-    await signing.add(QUEUE_NAME, JOB_DATA, { attempts: 3 })
-
-    assert.deepEqual(calls[0]?.options, { attempts: 3 })
-    assert.equal(logger.getLogs().length, 0)
-  })
-})

package/src/wirings/queue/queue-identity.ts

@@ -1,176 +0,0 @@
-import {
-  decodeBase64UrlText,
-  encodeBase64UrlText,
-  signWithKeyMaterial,
-  verifyWithKeyMaterial,
-} from '../../crypto-utils.js'
-import type { Logger } from '../../services/logger.js'
-import type { SecretService } from '../../services/secret-service.js'
-
-export const QUEUE_IDENTITY_SECRET_NAME = 'PIKKU_QUEUE_IDENTITY_SECRET'
-
-/** Namespaces the queue signing key away from every other use of the same material. */
-export const QUEUE_IDENTITY_INFO = 'pikku:queue-identity'
-
-export const QUEUE_IDENTITY_CLAIM_VERSION = 'pq1'
-
-/**
- * What the signature is bound to. `jobId` is only enforced when the producer
- * knew it at signing time — most adapters mint their own id after `add`.
- */
-export interface QueueIdentityBinding {
-  queueName: string
-  jobId?: string
-  data: unknown
-}
-
-interface QueueIdentityClaim {
-  u: string
-  q: string
-  j?: string
-}
-
-const stableStringify = (value: unknown): string => {
-  if (value === null || typeof value !== 'object') {
-    return JSON.stringify(value) ?? 'null'
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(stableStringify).join(',')}]`
-  }
-  const record = value as Record<string, unknown>
-  const keys = Object.keys(record).sort()
-  return `{${keys
-    .map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`)
-    .join(',')}}`
-}
-
-/**
- * Round-trips through JSON first so the producer hashes exactly what the
- * transport will deliver, then sorts keys so property order cannot change the
- * digest.
- */
-const canonicalizePayload = (data: unknown): string =>
-  stableStringify(JSON.parse(JSON.stringify(data ?? null)))
-
-const signingPayload = (encodedClaim: string, data: unknown): string =>
-  `${QUEUE_IDENTITY_CLAIM_VERSION}.${encodedClaim}.${canonicalizePayload(data)}`
-
-export const getQueueIdentitySecret = async (
-  secrets?: SecretService
-): Promise<string | undefined> => {
-  try {
-    return (
-      (await secrets?.getSecret(QUEUE_IDENTITY_SECRET_NAME))?.reveal() ||
-      undefined
-    )
-  } catch {
-    return undefined
-  }
-}
-
-export const signQueueIdentity = async (
-  secret: string,
-  pikkuUserId: string,
-  binding: QueueIdentityBinding
-): Promise<string> => {
-  const claim: QueueIdentityClaim = {
-    u: pikkuUserId,
-    q: binding.queueName,
-    ...(binding.jobId ? { j: binding.jobId } : {}),
-  }
-  const encodedClaim = encodeBase64UrlText(JSON.stringify(claim))
-  const signature = await signWithKeyMaterial(
-    QUEUE_IDENTITY_SECRET_NAME,
-    secret,
-    QUEUE_IDENTITY_INFO,
-    signingPayload(encodedClaim, binding.data)
-  )
-  return `${QUEUE_IDENTITY_CLAIM_VERSION}.${encodedClaim}.${signature}`
-}
-
-/** The claimed user id, or undefined for anything that does not verify. */
-export const verifyQueueIdentity = async (
-  secret: string,
-  token: string,
-  binding: QueueIdentityBinding
-): Promise<string | undefined> => {
-  const parts = token.split('.')
-  if (parts.length !== 3) return undefined
-  const [version, encodedClaim, signature] = parts as [string, string, string]
-  if (version !== QUEUE_IDENTITY_CLAIM_VERSION) return undefined
-
-  const verified = await verifyWithKeyMaterial(
-    QUEUE_IDENTITY_SECRET_NAME,
-    secret,
-    QUEUE_IDENTITY_INFO,
-    signingPayload(encodedClaim, binding.data),
-    signature
-  )
-  if (!verified) return undefined
-
-  let claim: QueueIdentityClaim
-  try {
-    claim = JSON.parse(decodeBase64UrlText(encodedClaim)) as QueueIdentityClaim
-  } catch {
-    return undefined
-  }
-  if (typeof claim?.u !== 'string' || claim.u.length === 0) return undefined
-  if (claim.q !== binding.queueName) return undefined
-  if (claim.j !== undefined && claim.j !== binding.jobId) return undefined
-  return claim.u
-}
-
-let missingSecretLogged = false
-
-/** Test seam: the latch is process-wide so the warning is emitted once. */
-export const resetQueueIdentityLogLatch = () => {
-  missingSecretLogged = false
-}
-
-export const warnQueueIdentitySecretMissing = (logger: Logger) => {
-  if (missingSecretLogged) return
-  missingSecretLogged = true
-  logger.warn(
-    `No '${QUEUE_IDENTITY_SECRET_NAME}' secret is configured — queue job identities cannot be signed or verified, so pikkuUserId is dropped and queue workers run without one.`
-  )
-}
-
-export const resolveQueueJobIdentity = async ({
-  claimedIdentity,
-  binding,
-  secrets,
-  logger,
-}: {
-  claimedIdentity: string | undefined
-  binding: QueueIdentityBinding
-  secrets: SecretService | undefined
-  logger: Logger
-}): Promise<string | undefined> => {
-  if (!claimedIdentity) return undefined
-
-  const secret = await getQueueIdentitySecret(secrets)
-  if (!secret) {
-    warnQueueIdentitySecretMissing(logger)
-    return undefined
-  }
-
-  let pikkuUserId: string | undefined
-  try {
-    pikkuUserId = await verifyQueueIdentity(secret, claimedIdentity, binding)
-  } catch (error) {
-    logger.error(
-      `Could not verify the identity claim on job ${binding.jobId} in queue ${binding.queueName} — the job runs without a pikkuUserId.`,
-      error
-    )
-    return undefined
-  }
-
-  if (!pikkuUserId) {
-    logger.error(
-      `Rejected an unsigned or invalid identity claim on job ${binding.jobId} in queue ${binding.queueName} — the job runs without a pikkuUserId.`
-    )
-    return undefined
-  }
-
-  return pikkuUserId
-}