@pikku/core 0.12.63 → 0.12.64

package/src/services/queue-webhook-service.test.ts

@@ -0,0 +1,408 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { createHmac } from 'node:crypto'
+
+import {
+  QueueWebhookService,
+  pikkuWebhookWorkerFunc,
+} from './queue-webhook-service.js'
+import {
+  PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
+  type WebhookJobData,
+} from './webhook-service.js'
+import { InMemoryQueueService } from './in-memory-queue-service.js'
+import { wireQueueWorker } from '../wirings/queue/queue-runner.js'
+import { resetPikkuState, pikkuState } from '../pikku-state.js'
+import type { JobOptions } from '../wirings/queue/queue.types.js'
+
+const noopLogger = { error() {}, info() {}, warn() {}, debug() {} }
+
+interface CapturedAdd {
+  queueName: string
+  data: WebhookJobData
+  options?: JobOptions
+}
+
+const setupServices = (overrides: Record<string, unknown> = {}) => {
+  const added: CapturedAdd[] = []
+  const queueService = {
+    supportsResults: false,
+    add: async (
+      queueName: string,
+      data: WebhookJobData,
+      options?: JobOptions
+    ) => {
+      added.push({ queueName, data, options })
+      return 'job-1'
+    },
+    getJob: async () => null,
+  }
+  pikkuState(null, 'package', 'singletonServices', {
+    logger: noopLogger,
+    config: {},
+    secrets: {
+      getSecret: async (key: string) => {
+        throw new Error(`Secret not found: ${key}`)
+      },
+    },
+    queueService,
+    ...overrides,
+  } as any)
+  return { added, queueService }
+}
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+describe('QueueWebhookService.send', () => {
+  test('enqueues with defaults: pikku-outgoing-webhooks queue, 3 retries, exponential backoff', async () => {
+    const { added, queueService } = setupServices()
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    const result = await webhookService.send({
+      url: 'https://example.com/hook',
+      event: 'user.created',
+      data: { id: 'u1' },
+    })
+
+    assert.equal(result.jobId, 'job-1')
+    assert.equal(added.length, 1)
+    const { queueName, data, options } = added[0]!
+    assert.equal(queueName, PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME)
+    assert.equal(queueName, 'pikku-outgoing-webhooks')
+    assert.equal(data.url, 'https://example.com/hook')
+    assert.equal(data.body, JSON.stringify({ id: 'u1' }))
+    assert.equal(data.headers['Content-Type'], 'application/json')
+    assert.equal(data.headers['X-Pikku-Event'], 'user.created')
+    assert.equal(options?.attempts, 4)
+    assert.equal(options?.backoff, 'exponential')
+  })
+
+  test('applies config defaults for retries and fixed retryDelay', async () => {
+    const { added, queueService } = setupServices({
+      config: { webhook: { retries: 1, retryDelay: '30s' } },
+    })
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({ url: 'https://example.com/hook', data: {} })
+
+    const { options } = added[0]!
+    assert.equal(options?.attempts, 2)
+    assert.deepEqual(options?.backoff, { type: 'fixed', delay: 30000 })
+  })
+
+  test('per-call retries override config defaults', async () => {
+    const { added, queueService } = setupServices({
+      config: { webhook: { retries: 5 } },
+    })
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({
+      url: 'https://example.com/hook',
+      data: {},
+      retries: 0,
+    })
+
+    const { options } = added[0]!
+    assert.equal(options?.attempts, 1)
+    assert.equal(options?.backoff, undefined)
+  })
+
+  test('per-call secret signs the body and never enters the job data', async () => {
+    const { added, queueService } = setupServices()
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({
+      url: 'https://example.com/hook',
+      data: { id: 'u1' },
+      secret: 'shhh',
+    })
+
+    const { data } = added[0]!
+    const expected =
+      'sha256=' + createHmac('sha256', 'shhh').update(data.body).digest('hex')
+    assert.equal(data.headers['X-Pikku-Signature'], expected)
+    assert.ok(!JSON.stringify(data).includes('shhh'))
+  })
+
+  test('config secret is a secret NAME resolved through the secrets service', async () => {
+    const { added, queueService } = setupServices({
+      config: { webhook: { secret: 'WEBHOOK_SIGNING_KEY' } },
+      secrets: {
+        getSecret: async (key: string) => {
+          assert.equal(key, 'WEBHOOK_SIGNING_KEY')
+          return 'resolved-key'
+        },
+      },
+    })
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({ url: 'https://example.com/hook', data: {} })
+
+    const { data } = added[0]!
+    assert.ok(
+      webhookService.verify(
+        'resolved-key',
+        data.headers['X-Pikku-Signature']!,
+        data.body
+      )
+    )
+  })
+
+  test('config.webhook.signatureHeader overrides the default header', async () => {
+    const { added, queueService } = setupServices({
+      config: { webhook: { signatureHeader: 'X-Acme-Signature' } },
+    })
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({
+      url: 'https://example.com/hook',
+      data: {},
+      secret: 'shhh',
+    })
+
+    const { data } = added[0]!
+    assert.ok(
+      webhookService.verify(
+        'shhh',
+        data.headers['X-Acme-Signature']!,
+        data.body
+      )
+    )
+    assert.equal(data.headers['X-Pikku-Signature'], undefined)
+  })
+
+  test('no secret anywhere means no signature header', async () => {
+    const { added, queueService } = setupServices()
+    const webhookService = new QueueWebhookService(queueService as any)
+
+    await webhookService.send({ url: 'https://example.com/hook', data: {} })
+
+    assert.equal(added[0]!.data.headers['X-Pikku-Signature'], undefined)
+  })
+})
+
+describe('WebhookService signing', () => {
+  test('sign/verify round-trips and rejects tampering', () => {
+    const { queueService } = setupServices()
+    // sign() is protected — reach it the way a subclass would.
+    const webhookService = new (class extends QueueWebhookService {
+      public signBody = (secret: string, body: string) =>
+        this.sign(secret, body)
+    })(queueService as any)
+
+    const signature = webhookService.signBody('key', '{"a":1}')
+
+    assert.ok(signature.startsWith('sha256='))
+    assert.equal(webhookService.verify('key', signature, '{"a":1}'), true)
+    assert.equal(webhookService.verify('key', signature, '{"a":2}'), false)
+    assert.equal(webhookService.verify('other', signature, '{"a":1}'), false)
+    assert.equal(webhookService.verify('key', 'sha256=nope', '{"a":1}'), false)
+  })
+})
+
+describe('pikkuWebhookWorkerFunc', () => {
+  const originalFetch = globalThis.fetch
+
+  const stubFetch = (
+    handler: (url: string, init: RequestInit) => { status: number }
+  ) => {
+    const requests: { url: string; init: RequestInit }[] = []
+    globalThis.fetch = (async (url: any, init: any) => {
+      requests.push({ url: String(url), init })
+      const { status } = handler(String(url), init)
+      return new Response(null, { status })
+    }) as typeof fetch
+    return requests
+  }
+
+  const restoreFetch = () => {
+    globalThis.fetch = originalFetch
+  }
+
+  test('POSTs the stored body and headers, resolves on 2xx', async (t) => {
+    t.after(restoreFetch)
+    const requests = stubFetch(() => ({ status: 204 }))
+
+    await pikkuWebhookWorkerFunc({} as any, {
+      url: 'https://example.com/hook',
+      body: '{"id":"u1"}',
+      headers: { 'Content-Type': 'application/json', 'X-Pikku-Event': 'e' },
+    })
+
+    assert.equal(requests.length, 1)
+    assert.equal(requests[0]!.url, 'https://example.com/hook')
+    assert.equal(requests[0]!.init.method, 'POST')
+    assert.equal(requests[0]!.init.body, '{"id":"u1"}')
+    assert.equal(
+      (requests[0]!.init.headers as Record<string, string>)['X-Pikku-Event'],
+      'e'
+    )
+  })
+
+  test('refuses to deliver to a private/internal host without fetching it (SSRF)', async (t) => {
+    t.after(restoreFetch)
+    const requests = stubFetch(() => ({ status: 200 }))
+
+    await assert.rejects(
+      pikkuWebhookWorkerFunc({} as any, {
+        url: 'http://169.254.169.254/latest/meta-data/',
+        body: '{}',
+        headers: {},
+      }),
+      /private\/internal host/
+    )
+    assert.equal(requests.length, 0, 'must never issue the request')
+  })
+
+  test('records a delivered attempt via the store when a deliveryId is present', async (t) => {
+    t.after(restoreFetch)
+    stubFetch(() => ({ status: 200 }))
+    const recorded: any[] = []
+    const services = {
+      logger: noopLogger,
+      webhookService: {
+        recordAttempt: async (id: string, result: any) =>
+          recorded.push({ id, result }),
+      },
+    }
+
+    await pikkuWebhookWorkerFunc(services as any, {
+      url: 'https://example.com/hook',
+      body: '{}',
+      headers: {},
+      deliveryId: 'del-1',
+    })
+
+    assert.equal(recorded.length, 1)
+    assert.equal(recorded[0].id, 'del-1')
+    assert.equal(recorded[0].result.delivered, true)
+    assert.equal(recorded[0].result.statusCode, 200)
+  })
+
+  test('records a failed attempt (with status) before throwing', async (t) => {
+    t.after(restoreFetch)
+    stubFetch(() => ({ status: 500 }))
+    const recorded: any[] = []
+    const services = {
+      logger: noopLogger,
+      webhookService: {
+        recordAttempt: async (id: string, result: any) =>
+          recorded.push({ id, result }),
+      },
+    }
+
+    await assert.rejects(
+      pikkuWebhookWorkerFunc(services as any, {
+        url: 'https://example.com/hook',
+        body: '{}',
+        headers: {},
+        deliveryId: 'del-2',
+      }),
+      /500/
+    )
+
+    assert.equal(recorded.length, 1)
+    assert.equal(recorded[0].result.delivered, false)
+    assert.equal(recorded[0].result.statusCode, 500)
+  })
+
+  test('skips the store when no deliveryId is present', async (t) => {
+    t.after(restoreFetch)
+    stubFetch(() => ({ status: 200 }))
+    let called = false
+    const services = {
+      logger: noopLogger,
+      webhookService: {
+        recordAttempt: async () => {
+          called = true
+        },
+      },
+    }
+
+    await pikkuWebhookWorkerFunc(services as any, {
+      url: 'https://example.com/hook',
+      body: '{}',
+      headers: {},
+    })
+
+    assert.equal(called, false)
+  })
+
+  test('throws on non-2xx statuses so the queue retries', async (t) => {
+    t.after(restoreFetch)
+
+    stubFetch(() => ({ status: 500 }))
+    await assert.rejects(
+      pikkuWebhookWorkerFunc({} as any, {
+        url: 'https://example.com/hook',
+        body: '{}',
+        headers: {},
+      }),
+      /500/
+    )
+
+    stubFetch(() => ({ status: 302 }))
+    await assert.rejects(
+      pikkuWebhookWorkerFunc({} as any, {
+        url: 'https://example.com/hook',
+        body: '{}',
+        headers: {},
+      }),
+      /302/
+    )
+  })
+
+  test('delivers through the in-memory queue with retries until success', async (t) => {
+    t.after(restoreFetch)
+    resetPikkuState()
+
+    let attempts = 0
+    stubFetch(() => {
+      attempts++
+      return { status: attempts <= 2 ? 500 : 200 }
+    })
+
+    const queueService = new InMemoryQueueService()
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: noopLogger,
+      config: {},
+      queueService,
+    } as any)
+    pikkuState(null, 'package', 'factories', {
+      createWireServices: async () => ({}),
+    } as any)
+
+    const funcId = `queue_${PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME}`
+    pikkuState(null, 'queue', 'meta')[PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME] = {
+      pikkuFuncId: funcId,
+      name: PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
+    }
+    pikkuState(null, 'function', 'meta')[funcId] = {
+      pikkuFuncId: funcId,
+      inputSchemaName: null,
+      outputSchemaName: null,
+      sessionless: true,
+    } as any
+    wireQueueWorker({
+      name: PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
+      func: { auth: false, func: pikkuWebhookWorkerFunc },
+    } as any)
+
+    const webhookService = new QueueWebhookService(queueService)
+    await webhookService.send({
+      url: 'https://example.com/hook',
+      data: { id: 'u1' },
+      retries: 3,
+      retryDelay: 1,
+    })
+
+    const deadline = Date.now() + 2000
+    while (attempts < 3 && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 10))
+    }
+    await new Promise((resolve) => setTimeout(resolve, 150))
+    assert.equal(attempts, 3, 'should retry twice then stop after success')
+  })
+})

package/src/services/queue-webhook-service.ts

@@ -0,0 +1,182 @@
+import { getSingletonServices } from '../pikku-state.js'
+import { getDurationInMilliseconds } from '../time-utils.js'
+import { safeFetch } from '../utils/safe-fetch.js'
+import type { JobOptions, QueueService } from '../wirings/queue/queue.types.js'
+import type { Logger } from './logger.js'
+import {
+  DEFAULT_WEBHOOK_RETRIES,
+  DEFAULT_WEBHOOK_SIGNATURE_HEADER,
+  PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
+  type SendWebhookInput,
+  type SendWebhookResult,
+  type WebhookJobData,
+  WebhookService,
+} from './webhook-service.js'
+
+/** Cap on the response body captured on a failed attempt. */
+const MAX_CAPTURED_RESPONSE_BODY = 2_000
+
+/**
+ * Default {@link WebhookService} implementation: serializes and signs the
+ * payload, then enqueues a delivery job onto the `pikku-outgoing-webhooks`
+ * queue. The signature is computed at enqueue time so the signing key never
+ * enters the queue payload; the actual HTTP POST happens in
+ * {@link pikkuWebhookWorkerFunc}, and the queue's `attempts`/`backoff`
+ * options drive retries.
+ */
+export class QueueWebhookService extends WebhookService {
+  /**
+   * The queue is a constructor dependency rather than a `getSingletonServices()`
+   * lookup so that a project wiring up outgoing webhooks without a queue fails
+   * to compile, instead of throwing on the first `send()`.
+   */
+  constructor(protected queueService: QueueService) {
+    super()
+  }
+
+  public async send(input: SendWebhookInput): Promise<SendWebhookResult> {
+    const { jobData, options } = await this.prepareDelivery(input)
+    const jobId = await this.queueService.add(
+      PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME,
+      jobData,
+      options
+    )
+    return { jobId }
+  }
+
+  /**
+   * Build the signed job payload and its retry options — the shared work a
+   * `send()` does before enqueueing. Factored out (and `protected`) so a
+   * store-backed subclass can persist a delivery row and attach its
+   * `deliveryId` without re-implementing signing or the retry policy.
+   */
+  protected async prepareDelivery(
+    input: SendWebhookInput
+  ): Promise<{ jobData: WebhookJobData; options: JobOptions }> {
+    const services = getSingletonServices()
+    const webhookConfig = services.config?.webhook
+
+    const body = JSON.stringify(input.data)
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+      ...(input.event ? { 'X-Pikku-Event': input.event } : {}),
+      ...input.headers,
+    }
+
+    let secret = input.secret
+    if (secret === undefined && webhookConfig?.secret) {
+      // Naive read — any caching is the secret service's concern, not ours.
+      secret = await services.secrets.getSecret(webhookConfig.secret)
+      if (!secret) {
+        services.logger.error(
+          `Webhook signing secret '${webhookConfig.secret}' (config.webhook.secret) resolved to nothing — outgoing webhooks will be sent UNSIGNED.`
+        )
+      }
+    }
+    if (secret) {
+      const signatureHeader =
+        webhookConfig?.signatureHeader ?? DEFAULT_WEBHOOK_SIGNATURE_HEADER
+      headers[signatureHeader] = this.sign(secret, body)
+    }
+
+    const jobData: WebhookJobData = {
+      url: input.url,
+      ...(input.event ? { event: input.event } : {}),
+      body,
+      headers,
+    }
+
+    return { jobData, options: this.resolveJobOptions(input) }
+  }
+
+  /**
+   * Resolve a delivery's retry policy into queue job options, mirroring the
+   * workflow service: per-call values win over `config.webhook` defaults, an
+   * explicitly-set `retries` (including 0) is always honored, and `attempts`
+   * is ALWAYS passed so the queue can never fall back to its own default.
+   * Backoff is exponential unless a concrete `retryDelay` selects a fixed one.
+   */
+  private resolveJobOptions(input: SendWebhookInput): JobOptions {
+    const webhookConfig = getSingletonServices().config?.webhook
+    const retries =
+      input.retries ?? webhookConfig?.retries ?? DEFAULT_WEBHOOK_RETRIES
+    const retryDelay = input.retryDelay ?? webhookConfig?.retryDelay
+    const backoff =
+      retryDelay !== undefined && retryDelay !== 'exponential'
+        ? { type: 'fixed', delay: getDurationInMilliseconds(retryDelay) }
+        : retries > 0 || retryDelay === 'exponential'
+          ? 'exponential'
+          : undefined
+    return { attempts: retries + 1, ...(backoff ? { backoff } : {}) }
+  }
+}
+
+/**
+ * Queue worker for the `pikku-outgoing-webhooks` queue: POSTs the delivery to its
+ * target URL. Any non-2xx response (or network error) throws so the queue
+ * retries the job according to the `attempts`/`backoff` set at enqueue time;
+ * the queue runner logs each failed attempt.
+ *
+ * A `deliveryId` is only present when a store-backed `webhookService` (e.g.
+ * `KyselyWebhookService`) enqueued the job, so each attempt (success or failure)
+ * is persisted via `webhookService.recordAttempt` before the throw — the console
+ * delivery history reflects every try, not just the outcome. The queue-only
+ * default never sets a `deliveryId`, so its base `recordAttempt` is never hit.
+ */
+export async function pikkuWebhookWorkerFunc(
+  services: { logger: Logger; webhookService?: WebhookService },
+  { url, body, headers, deliveryId }: WebhookJobData
+): Promise<void> {
+  let statusCode: number | undefined
+  let responseBody: string | undefined
+  let error: string | undefined
+  let delivered = false
+
+  let allowedHosts: string[] | undefined
+  try {
+    allowedHosts = getSingletonServices().config?.webhook?.allowedHosts
+  } catch {
+    // Singleton services not initialised (e.g. a bare worker invocation) — fall
+    // back to the default private-host block with no allowlist.
+  }
+
+  try {
+    const response = await safeFetch(
+      url,
+      {
+        method: 'POST',
+        headers,
+        body,
+        signal: AbortSignal.timeout(30_000),
+      },
+      { allowedHosts }
+    )
+    statusCode = response.status
+    delivered = response.status >= 200 && response.status < 300
+    if (!delivered) {
+      responseBody = (await response.text().catch(() => ''))?.slice(
+        0,
+        MAX_CAPTURED_RESPONSE_BODY
+      )
+      error = `Webhook delivery to ${url} failed with status ${response.status}`
+    }
+  } catch (e) {
+    error = e instanceof Error ? e.message : String(e)
+  }
+
+  if (deliveryId && services.webhookService) {
+    // Best-effort history: a store failure must not mask the delivery result.
+    await services.webhookService
+      .recordAttempt(deliveryId, { statusCode, responseBody, error, delivered })
+      .catch((storeError) =>
+        services.logger.error(
+          `Failed to record webhook delivery attempt for ${deliveryId}`,
+          storeError
+        )
+      )
+  }
+
+  if (!delivered) {
+    throw new Error(error ?? `Webhook delivery to ${url} failed`)
+  }
+}

package/src/services/scope-service.ts

@@ -0,0 +1,75 @@
+import type { FlatScope } from '../wirings/scope/scope.types.js'
+
+/** A role: a named, admin-composed bag of scopes. */
+export interface Role {
+  name: string
+  description?: string
+  scopes: string[]
+}
+
+/**
+ * Resolves and administers the scopes granted to a user.
+ *
+ * Implementations are called at the **session boundary** — e.g. better-auth's
+ * `mapSession` — never by the function runner. The runner reads
+ * `session.scopes` and never performs I/O, which keeps it viable on Workers
+ * and Lambda. Because the session is rebuilt per request, a scope change takes
+ * effect on the next call with nothing cached and nothing to invalidate.
+ *
+ * `syncScopes` is deliberately additive: scopes are declared in code, so a
+ * removed declaration leaves an inert row rather than silently revoking a
+ * grant mid-deploy. Removal is an explicit operation (`pikku scopes prune`).
+ */
+export interface ScopeService {
+  /**
+   * Registers the declared scope set. Additive — never deletes.
+   * Called once during startup with the generated scope list.
+   */
+  syncScopes(scopes: FlatScope[]): Promise<void>
+
+  /**
+   * Every scope a user holds: the union of their role-derived scopes and any
+   * scopes granted to them directly.
+   */
+  resolveScopes(userId: string): Promise<string[]>
+
+  /**
+   * The scope vocabulary in the store: everything a role can be composed from.
+   *
+   * `declared: false` marks a scope that is still present but no longer
+   * declared in code — inert (no function can require it) and awaiting
+   * `pikku scopes prune`.
+   */
+  listScopes(): Promise<Array<FlatScope & { declared: boolean }>>
+
+  createRole(role: Role): Promise<void>
+  deleteRole(name: string): Promise<void>
+  setRoleScopes(name: string, scopes: string[]): Promise<void>
+  listRoles(): Promise<Role[]>
+
+  addUserToRole(userId: string, role: string, grantedBy?: string): Promise<void>
+  removeUserFromRole(userId: string, role: string): Promise<void>
+  listUserRoles(userId: string): Promise<string[]>
+
+  /**
+   * Grants a scope directly to a user, outside of any role. Additive: the
+   * resolved set is the union of role-derived and directly-granted scopes.
+   */
+  addScopeToUser(
+    userId: string,
+    scope: string,
+    grantedBy?: string
+  ): Promise<void>
+  removeScopeFromUser(userId: string, scope: string): Promise<void>
+  /** Only the scopes granted directly, not those inherited from roles. */
+  listUserScopes(userId: string): Promise<string[]>
+
+  /**
+   * Scopes present in the store that are no longer declared in code, with the
+   * roles that would lose them. Powers `pikku scopes audit`.
+   */
+  findStaleScopes(): Promise<Array<{ scope: string; roles: string[] }>>
+
+  /** Removes undeclared scopes, cascading them out of roles. */
+  pruneScopes(): Promise<string[]>
+}

package/src/services/typed-secret-service.test.ts

@@ -78,6 +78,41 @@ describe('TypedSecretService', () => {
     assert.deepStrictEqual(ghStatus.oauth2, { tokenSecretId: 'GH_TOKEN' })
   })
 
+  test('should cache getSecret and not re-hit the underlying service', async () => {
+    let calls = 0
+    const inner = {
+      getSecret: async <T = string>(key: string): Promise<T> => {
+        calls++
+        return `v-${key}` as unknown as T
+      },
+      hasSecret: async () => true,
+      setSecret: async () => {},
+      deleteSecret: async () => {},
+    }
+    const service = new TypedSecretService(inner, {})
+    assert.strictEqual(await service.getSecret('K'), 'v-K')
+    assert.strictEqual(await service.getSecret('K'), 'v-K')
+    assert.strictEqual(calls, 1)
+  })
+
+  test('should invalidate the cache on setSecret and deleteSecret', async () => {
+    const store = new Map([['K', '"a"']])
+    const service = new TypedSecretService(createMockSecrets(store), {})
+    assert.strictEqual(await service.getSecret('K'), 'a')
+    await service.setSecret('K', 'b')
+    assert.strictEqual(await service.getSecret('K'), 'b')
+    await service.deleteSecret('K')
+    await assert.rejects(() => service.getSecret('K'))
+  })
+
+  test('should not cache a getSecret miss', async () => {
+    const store = new Map<string, string>()
+    const service = new TypedSecretService(createMockSecrets(store), {})
+    await assert.rejects(() => service.getSecret('K'))
+    store.set('K', '"now-here"')
+    assert.strictEqual(await service.getSecret('K'), 'now-here')
+  })
+
   test('should get missing credentials', async () => {
     const store = new Map([['STRIPE_KEY', '"sk-123"']])
     const meta = {