@pikku/core 0.12.13 → 0.12.15

package/src/function/function-runner.ts

@@ -28,8 +28,10 @@ import { parseVersionedId } from '../version.js'
 import type { SessionService } from '../services/user-session-service.js'
 import { createFunctionSessionWireProps } from '../services/user-session-service.js'
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js'
-import type { PikkuCredentialWireService } from '../services/credential-wire-service.js'
-import { createWireServicesCredentialWireProps } from '../services/credential-wire-service.js'
+import {
+  PikkuCredentialWireService,
+  createWireServicesCredentialWireProps,
+} from '../services/credential-wire-service.js'
 import { rpcService } from '../wirings/rpc/rpc-runner.js'
 import { closeWireServices } from '../utils.js'
 
@@ -226,6 +228,21 @@ export const runPikkuFunc = async <In = any, Out = any>(
         )
       : wire
 
+  // Set up credential wire service early so middleware can use setCredential.
+  // Skip if already set up (e.g. addon functions reuse the parent wire).
+  if (!resolvedWire.getCredentials) {
+    const resolvedCredentialWireService =
+      credentialWireService ??
+      new PikkuCredentialWireService(
+        resolvedSingletonServices.credentialService,
+        resolvedWire
+      )
+    Object.assign(
+      resolvedWire,
+      createWireServicesCredentialWireProps(resolvedCredentialWireService)
+    )
+  }
+
   // Convert tags to PermissionMetadata and merge with inheritedPermissions
   let mergedInheritedPermissions: PermissionMetadata[]
   if (tags && tags.length > 0) {
@@ -316,18 +333,12 @@ export const runPikkuFunc = async <In = any, Out = any>(
       })
     }
 
-    if (credentialWireService) {
-      Object.assign(
-        resolvedWire,
-        createWireServicesCredentialWireProps(credentialWireService)
-      )
-    }
-
-    const wireServices = await resolvedCreateWireServices?.(
-      resolvedSingletonServices,
-      resolvedWire
-    )
+    let wireServices: Record<string, unknown> | undefined
     try {
+      wireServices = (await resolvedCreateWireServices?.(
+        resolvedSingletonServices,
+        resolvedWire
+      )) as Record<string, unknown> | undefined
       const services =
         wireServices && Object.keys(wireServices).length > 0
           ? { ...resolvedSingletonServices, ...wireServices }

package/src/function/functions.types.ts

@@ -257,6 +257,7 @@ export const pikkuAuth = <
     if (!session) return false
     return fn(services, session as Session)
   }
+  ;(wrapper as any).__pikkuAuth = true
   return wrapper as any
 }
 

package/src/function/index.ts

@@ -1,5 +1,15 @@
 export { addFunction, getAllFunctionNames } from './function-runner.js'
+export {
+  pikkuAuth,
+  pikkuPermission,
+  pikkuPermissionFactory,
+  pikkuApprovalDescription,
+} from './functions.types.js'
 export type {
   CorePikkuFunction,
   CorePikkuFunctionSessionless,
+  CorePikkuFunctionConfig,
+  CorePikkuAuth,
+  CorePikkuAuthConfig,
+  CorePikkuPermission,
 } from './functions.types.js'

package/src/handle-error.test.ts

@@ -91,7 +91,7 @@ describe('handleHTTPError', () => {
     assert.deepStrictEqual(http._state.jsonBody, {
       message: 'The server cannot find the requested resource.',
       payload: undefined,
-      traceId: 'tracker-1',
+      errorId: 'tracker-1',
     })
   })
 
@@ -112,7 +112,7 @@ describe('handleHTTPError', () => {
 
     assert.strictEqual(http._state.statusCode, 400)
     assert.ok(http._state.jsonBody.message.includes('client error'))
-    assert.strictEqual(http._state.jsonBody.traceId, 'tracker-2')
+    assert.strictEqual(http._state.jsonBody.errorId, 'tracker-2')
   })
 
   test('should set status 403 for ForbiddenError', () => {

package/src/handle-error.ts

@@ -9,7 +9,7 @@ import type { PikkuHTTP } from './wirings/http/http.types.js'
  *
  * @param {any} e - The error that occurred
  * @param {PikkuHTTP | undefined} http - HTTP wire object
- * @param {string} trackerId - Unique ID for tracking this error
+ * @param {string} traceId - Unique ID for tracking this error
  * @param {Logger} logger - Logger service
  * @param {number[]} logWarningsForStatusCodes - HTTP status codes to log as warnings
  * @param {boolean} respondWith404 - Whether to respond with 404 for NotFoundError
@@ -18,7 +18,7 @@ import type { PikkuHTTP } from './wirings/http/http.types.js'
 export const handleHTTPError = (
   e: any,
   http: PikkuHTTP | undefined,
-  trackerId: string | undefined,
+  traceId: string | undefined,
   logger: Logger,
   logWarningsForStatusCodes: number[],
   respondWith404: boolean,
@@ -38,13 +38,13 @@ export const handleHTTPError = (
     http?.response?.json({
       message: errorResponse.message,
       payload: (e as any).payload,
-      traceId: trackerId,
+      errorId: traceId,
     })
 
     // Log certain status codes as warnings
     if (logWarningsForStatusCodes.includes(errorResponse.status)) {
-      if (trackerId) {
-        logger.warn(`Warning id: ${trackerId}`)
+      if (traceId) {
+        logger.warn(`Warning id: ${traceId}`)
       }
       logger.warn(e instanceof Error ? e.message : e)
     }
@@ -53,9 +53,9 @@ export const handleHTTPError = (
     logger.error(e instanceof Error ? e.message : e)
     http?.response?.status(500)
 
-    if (trackerId) {
-      logger.warn(`Error id: ${trackerId}`)
-      const errorBody: Record<string, unknown> = { errorId: trackerId }
+    if (traceId) {
+      logger.warn(`Error id: ${traceId}`)
+      const errorBody: Record<string, unknown> = { errorId: traceId }
       if (exposeErrors && !isProduction() && e instanceof Error) {
         errorBody.message = e.message
         errorBody.stack = e.stack

package/src/index.ts

@@ -103,12 +103,11 @@ export type { AIStorageService } from './services/ai-storage-service.js'
 export type { HTTPMethod } from './wirings/http/http.types.js'
 export type { GraphNodeConfig } from './wirings/workflow/graph/workflow-graph.types.js'
 export { createGraph } from './wirings/workflow/graph/graph-node.js'
-export { workflow as wireWorkflow } from './wirings/workflow/workflow-helpers.js'
 export { wireAddon } from './wirings/rpc/wire-addon.js'
 export type { WireAddonConfig } from './wirings/rpc/wire-addon.js'
 export type { PikkuPackageState } from './types/state.types.js'
 export { runMiddleware, addMiddleware } from './middleware-runner.js'
-export { addPermission } from './permissions.js'
+export { addPermission, checkAuthPermissions } from './permissions.js'
 export { isSerializable, stopSingletonServices } from './utils.js'
 export { getSingletonServices, getCreateWireServices } from './pikku-state.js'
 export {

package/src/middleware/index.ts

@@ -3,3 +3,5 @@ export { authCookie } from './auth-cookie.js'
 export { authBearer } from './auth-bearer.js'
 export { pikkuRemoteAuthMiddleware } from './remote-auth.js'
 export { cors } from './cors.js'
+export { addMiddleware, runMiddleware } from '../middleware-runner.js'
+export { addPermission } from '../permissions.js'

package/src/middleware/remote-auth.test.ts

@@ -252,7 +252,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
               http: {
                 request: createMockRequest(
                   { authorization: 'Bearer valid-token' },
-                  '/rpc/otherFunc'
+                  '/remote/rpc/otherFunc'
                 ),
               },
             } as any,
@@ -273,7 +273,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/myFunc'
+              '/remote/rpc/myFunc'
             ),
           },
         } as any,
@@ -295,7 +295,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/anyFunc'
+              '/remote/rpc/anyFunc'
             ),
           },
         } as any,
@@ -339,7 +339,7 @@ describe('pikkuRemoteAuthMiddleware', () => {
           http: {
             request: createMockRequest(
               { authorization: 'Bearer valid-token' },
-              '/rpc/my%20func'
+              '/remote/rpc/my%20func'
             ),
           },
         } as any,

package/src/middleware/remote-auth.ts

@@ -12,6 +12,9 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
     try {
       secret = await secrets.getSecret('PIKKU_REMOTE_SECRET')
     } catch {
+      if (http.request.path().startsWith('/remote/rpc/')) {
+        throw new UnauthorizedError()
+      }
       return next()
     }
     if (!jwt) {
@@ -42,8 +45,10 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
       throw new UnauthorizedError()
     }
 
-    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
-      const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length))
+    if (payload?.fn && http.request.path().startsWith('/remote/rpc/')) {
+      const fn = decodeURIComponent(
+        http.request.path().slice('/remote/rpc/'.length)
+      )
       if (fn && payload.fn !== fn) {
         throw new UnauthorizedError()
       }

package/src/permissions.ts

@@ -1,5 +1,6 @@
 import type {
   CoreServices,
+  CoreUserSession,
   PikkuWiringTypes,
   PermissionMetadata,
   PikkuWire,
@@ -325,3 +326,72 @@ export const runPermissions = async (
     throw new ForbiddenError('Permission denied')
   }
 }
+
+/**
+ * Checks whether a session passes the auth checks (pikkuAuth only) for a
+ * given function/agent. Skips pikkuPermission checks since those require
+ * request data which isn't available at filter time.
+ *
+ * @param funcPermissions - The PermissionMetadata[] from function or agent metadata
+ * @param session - The user's session
+ * @param services - Singleton services
+ * @param packageName - Optional package namespace
+ * @returns true if the session passes all auth checks (or no auth checks exist)
+ */
+export const checkAuthPermissions = async (
+  funcPermissions: PermissionMetadata[] | undefined,
+  session: CoreUserSession,
+  services: CoreServices,
+  packageName: string | null = null
+): Promise<boolean> => {
+  if (!funcPermissions?.length) return true
+
+  const allPermissions = combinePermissions(
+    'agent',
+    `authcheck:${Math.random()}`,
+    {
+      funcInheritedPermissions: funcPermissions,
+      packageName,
+    }
+  )
+
+  if (allPermissions.length === 0) return true
+
+  const wire = { session } as unknown as PikkuWire<
+    any,
+    never,
+    any,
+    never,
+    never,
+    never
+  >
+
+  // Extract only pikkuAuth permissions (marked with __pikkuAuth)
+  const authPerms: CorePikkuPermission[] = []
+  for (const permission of allPermissions) {
+    if (typeof permission === 'function') {
+      if ((permission as any).__pikkuAuth) {
+        authPerms.push(permission)
+      }
+    } else if (permission && typeof permission === 'object') {
+      for (const funcs of Object.values(permission)) {
+        const arr = Array.isArray(funcs) ? funcs : [funcs]
+        for (const fn of arr) {
+          if (typeof fn === 'function' && (fn as any).__pikkuAuth) {
+            authPerms.push(fn)
+          }
+        }
+      }
+    }
+  }
+
+  // No auth permissions = allowed (only data-dependent permissions exist)
+  if (authPerms.length === 0) return true
+
+  // All auth permissions must pass
+  for (const perm of authPerms) {
+    const result = await perm(services, null, wire)
+    if (result) return true
+  }
+  return false
+}

package/src/pikku-state.test.ts

@@ -7,7 +7,6 @@ import {
   getAllPackageStates,
   getSingletonServices,
   getCreateWireServices,
-  getPikkuMetaDir,
   addPackageServiceFactories,
 } from './pikku-state.js'
 
@@ -176,31 +175,6 @@ describe('getCreateWireServices', () => {
   })
 })
 
-describe('getPikkuMetaDir', () => {
-  test('should return null by default', () => {
-    const result = getPikkuMetaDir()
-    assert.strictEqual(result, null)
-  })
-
-  test('should return metaDir when set', () => {
-    pikkuState(null, 'package', 'metaDir', '/some/path' as any)
-    const result = getPikkuMetaDir()
-    assert.strictEqual(result, '/some/path')
-  })
-
-  test('should return metaDir for specific package', () => {
-    pikkuState('@test/pkg', 'package', 'metaDir', '/addon/path' as any)
-    const result = getPikkuMetaDir('@test/pkg')
-    assert.strictEqual(result, '/addon/path')
-  })
-
-  test('should treat null packageName as main', () => {
-    pikkuState(null, 'package', 'metaDir', '/main/path' as any)
-    const result = getPikkuMetaDir(null)
-    assert.strictEqual(result, '/main/path')
-  })
-})
-
 describe('addPackageServiceFactories', () => {
   test('should register factories for addon package', () => {
     const mockFactories = {

package/src/pikku-state.ts

@@ -156,7 +156,8 @@ const createEmptyPackageState = (): PikkuPackageState => ({
   package: {
     factories: null,
     singletonServices: null,
-    metaDir: null,
+    credentialsMeta: null,
+    requiredParentServices: null,
   },
 })
 
@@ -187,10 +188,6 @@ if (!getAllPackageStates().has('__main__')) {
   resetPikkuState()
 }
 
-export const getPikkuMetaDir = (packageName?: string | null): string | null => {
-  return pikkuState(packageName ?? null, 'package', 'metaDir')
-}
-
 export const getSingletonServices = (): CoreSingletonServices => {
   const services = pikkuState(null, 'package', 'singletonServices')
   if (!services) throw new Error('Singleton services not initialized')

package/src/remote.ts

@@ -0,0 +1,46 @@
+import type { JWTService } from './services/jwt-service.js'
+import type { SecretService } from './services/secret-service.js'
+import { encryptJSON } from './crypto-utils.js'
+
+/**
+ * Build Authorization headers with JWT-signed session and traceId for
+ * pikkuRemoteAuthMiddleware on the receiving end.
+ *
+ * Used by all deployment services (Kysely, Redis, MongoDB, Lambda, CF, Azure)
+ * regardless of transport (HTTP, Lambda Invoke, service bindings).
+ */
+export async function buildRemoteHeaders(
+  jwt: JWTService | undefined,
+  secrets: SecretService | undefined,
+  funcName: string,
+  session?: unknown,
+  traceId?: string
+): Promise<Record<string, string>> {
+  const headers: Record<string, string> = {
+    'content-type': 'application/json',
+    ...(traceId && { 'x-request-id': traceId }),
+  }
+
+  let secret: string | undefined
+  try {
+    secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET')
+  } catch {}
+
+  if (secret && jwt) {
+    const sessionEnc = session
+      ? await encryptJSON(secret, { session })
+      : undefined
+    const token = await jwt.encode(
+      { value: 5, unit: 'minute' },
+      {
+        aud: 'pikku-remote',
+        fn: funcName,
+        iat: Math.floor(Date.now() / 1000),
+        session: sessionEnc,
+      }
+    )
+    headers.authorization = `Bearer ${token}`
+  }
+
+  return headers
+}

package/src/schema.ts

@@ -100,6 +100,7 @@ export const coerceTopLevelDataFromSchema = (
   packageName: string | null = null
 ) => {
   const schema = pikkuState(packageName, 'misc', 'schemas').get(schemaName)
+  if (!schema?.properties) return
   for (const key in schema.properties) {
     const property = schema.properties[key]
     if (typeof property === 'boolean') {

package/src/services/credential-service.ts

@@ -41,4 +41,17 @@ export interface CredentialService {
    * @returns A record of credential name to value.
    */
   getAll(userId: string): Promise<Record<string, unknown>>
+
+  /**
+   * Lists all user IDs that have a specific credential configured.
+   * @param name - The credential name.
+   * @returns Array of user IDs.
+   */
+  getUsersWithCredential(name: string): Promise<string[]>
+
+  /**
+   * Lists all unique user IDs that have any credential configured.
+   * @returns Array of user IDs.
+   */
+  getAllUsers(): Promise<string[]>
 }

package/src/services/credential-wire-service.test.ts

@@ -0,0 +1,174 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert'
+import {
+  PikkuCredentialWireService,
+  createMiddlewareCredentialWireProps,
+  createWireServicesCredentialWireProps,
+} from './credential-wire-service.js'
+import type { CredentialService } from './credential-service.js'
+import type { PikkuWire } from '../types/core.types.js'
+
+const mockCredentialService = (
+  creds: Record<string, unknown>
+): CredentialService => ({
+  get: async (name: string) => creds[name] ?? null,
+  set: async () => {},
+  delete: async () => {},
+  has: async (name: string) => name in creds,
+  getAll: async () => creds,
+})
+
+describe('PikkuCredentialWireService', () => {
+  test('should set and get credentials manually', async () => {
+    const service = new PikkuCredentialWireService()
+    service.set('stripe', { apiKey: 'sk_test' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'sk_test' } })
+  })
+
+  test('should return sync after first load (no credential service)', async () => {
+    const service = new PikkuCredentialWireService()
+    service.set('foo', 'bar')
+    // First call triggers lazy load (no-op without credentialService)
+    await service.getAll()
+    // Second call should be sync
+    const result = service.getAll()
+    assert.ok(!(result instanceof Promise), 'expected sync return')
+    assert.deepStrictEqual(result, { foo: 'bar' })
+  })
+
+  test('should lazy-load from credential service on first getAll', async () => {
+    const credService = mockCredentialService({
+      stripe: { apiKey: 'sk_live' },
+      github: { token: 'ghp_abc' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, {
+      stripe: { apiKey: 'sk_live' },
+      github: { token: 'ghp_abc' },
+    })
+  })
+
+  test('should set pikkuUserId on wire after lazy load', async () => {
+    const credService = mockCredentialService({})
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    await service.getAll()
+    assert.strictEqual(wire.pikkuUserId, 'user-1')
+  })
+
+  test('should not overwrite manually set credentials during lazy load', async () => {
+    const credService = mockCredentialService({
+      stripe: { apiKey: 'from-db' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    service.set('stripe', { apiKey: 'from-middleware' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result.stripe, { apiKey: 'from-middleware' })
+  })
+
+  test('should return sync on subsequent calls after lazy load', async () => {
+    const credService = mockCredentialService({ stripe: { key: '123' } })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    await service.getAll()
+    const result = service.getAll()
+    assert.ok(!(result instanceof Promise), 'expected sync return')
+    assert.deepStrictEqual(result, { stripe: { key: '123' } })
+  })
+
+  test('should not load when no userId resolvable', async () => {
+    let called = false
+    const credService: CredentialService = {
+      get: async () => null,
+      set: async () => {},
+      delete: async () => {},
+      has: async () => false,
+      getAll: async () => {
+        called = true
+        return {}
+      },
+    }
+    const wire: PikkuWire = {}
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, {})
+    assert.strictEqual(called, false)
+  })
+
+  test('should deduplicate concurrent lazy load calls', async () => {
+    let callCount = 0
+    const credService: CredentialService = {
+      get: async () => null,
+      set: async () => {},
+      delete: async () => {},
+      has: async () => false,
+      getAll: async () => {
+        callCount++
+        return { stripe: { key: 'test' } }
+      },
+    }
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const [r1, r2] = await Promise.all([service.getAll(), service.getAll()])
+    assert.strictEqual(callCount, 1)
+    assert.deepStrictEqual(r1, r2)
+  })
+
+  test('getScoped should only return allowed names', async () => {
+    const credService = mockCredentialService({
+      stripe: { key: '1' },
+      github: { token: '2' },
+      slack: { webhook: '3' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getScoped(['stripe', 'slack'])
+    assert.deepStrictEqual(result, {
+      stripe: { key: '1' },
+      slack: { webhook: '3' },
+    })
+  })
+})
+
+describe('createMiddlewareCredentialWireProps', () => {
+  test('should provide setCredential that writes to service', async () => {
+    const service = new PikkuCredentialWireService()
+    const props = createMiddlewareCredentialWireProps(service)
+    props.setCredential('stripe', { apiKey: 'test' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'test' } })
+  })
+})
+
+describe('createWireServicesCredentialWireProps', () => {
+  test('should provide both setCredential and getCredentials', async () => {
+    const service = new PikkuCredentialWireService()
+    const props = createWireServicesCredentialWireProps(service)
+    props.setCredential('stripe', { apiKey: 'test' })
+    const result = await props.getCredentials()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'test' } })
+  })
+
+  test('should scope getCredentials when allowedNames provided', async () => {
+    const credService = mockCredentialService({
+      stripe: { key: '1' },
+      github: { token: '2' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+    const props = createWireServicesCredentialWireProps(service, ['stripe'])
+    const result = await props.getCredentials()
+    assert.deepStrictEqual(result, { stripe: { key: '1' } })
+  })
+})