@pikku/core 0.12.79 → 0.12.82

package/src/wirings/persona/persona-environments.test.ts

@@ -44,7 +44,11 @@ describe('resolvePersonaEnvironments', () => {
 describe('personaEnvironmentErrors', () => {
   test('a persona that declares nothing cannot be wrong', () => {
     assert.deepEqual(
-      personaEnvironmentErrors('shopper', { disposition: 'careless' }, ENVIRONMENTS),
+      personaEnvironmentErrors(
+        'shopper',
+        { disposition: 'careless' },
+        ENVIRONMENTS
+      ),
       []
     )
   })
@@ -106,8 +110,15 @@ describe('personaEnvironmentErrors', () => {
   })
 
   test('with nothing configured it says where environments go', () => {
-    const [error] = personaEnvironmentErrors('shopper', { environments: ['x'] }, {})
-    assert.match(error!, /Declare it under 'environments' in pikku\.config\.json/)
+    const [error] = personaEnvironmentErrors(
+      'shopper',
+      { environments: ['x'] },
+      {}
+    )
+    assert.match(
+      error!,
+      /Declare it under 'environments' in pikku\.config\.json/
+    )
   })
 })
 

package/src/wirings/persona/persona.test.ts

@@ -23,7 +23,10 @@ describe('computed addresses', () => {
   })
 
   test('without a run id the address is the stable, seedable form', () => {
-    assert.equal(personaEmail('susan', 'mail.example.com'), 'susan@mail.example.com')
+    assert.equal(
+      personaEmail('susan', 'mail.example.com'),
+      'susan@mail.example.com'
+    )
   })
 
   test('an id that is not address-shaped is reduced to one', () => {
@@ -34,7 +37,10 @@ describe('computed addresses', () => {
   })
 
   test('an id with nothing usable in it is refused rather than guessed at', () => {
-    assert.throws(() => personaEmail('...', 'example.com'), /no usable email label/)
+    assert.throws(
+      () => personaEmail('...', 'example.com'),
+      /no usable email label/
+    )
   })
 
   // A synthetic domain was rejected precisely because it makes every
@@ -97,7 +103,11 @@ describe('verifying roles at sign-in', () => {
   })
 
   test('order and duplication are not drift', () => {
-    const v = verifyPersonaRoles('yasser', ['admin', 'buyer'], ['buyer', 'admin', 'buyer'])
+    const v = verifyPersonaRoles(
+      'yasser',
+      ['admin', 'buyer'],
+      ['buyer', 'admin', 'buyer']
+    )
     assert.equal(v.ok, true)
   })
 

package/src/wirings/persona/validate-personas.ts

@@ -1,4 +1,8 @@
-import type { PersonaDefinitions, PersonaMeta, PersonasMeta } from './persona.types.js'
+import type {
+  PersonaDefinitions,
+  PersonaMeta,
+  PersonasMeta,
+} from './persona.types.js'
 
 /**
  * Whether a persona can actually be driven by a virtual user.

package/src/wirings/queue/index.ts

@@ -17,26 +17,12 @@ export type {
 export {
   wireQueueWorker,
   runQueueJob,
-  getQueueWorkers,
-  removeQueueWorker,
   QueueJobDiscardedError,
   QueueJobFailedError,
 } from './queue-runner.js'
-
-export {
-  QUEUE_IDENTITY_CLAIM_VERSION,
-  QUEUE_IDENTITY_INFO,
-  QUEUE_IDENTITY_SECRET_NAME,
-  getQueueIdentitySecret,
-  resolveQueueJobIdentity,
-  signQueueIdentity,
-  verifyQueueIdentity,
-} from './queue-identity.js'
 export type { QueueIdentityBinding } from './queue-identity.js'
 
 export { SignedQueueService } from './signed-queue-service.js'
-
-export { validateWorkerConfig } from './validate-worker-config.js'
 export type { QueueConfigMapping } from './validate-worker-config.js'
 
 export { registerQueueWorkers } from './register-queue-helper.js'

package/src/wirings/queue/queue-runner.ts

@@ -58,7 +58,7 @@ export const wireQueueWorker = <
     func: queueWorker.func.func,
     auth: queueWorker.func.auth,
     permissions: queueWorker.func.permissions,
-    middleware: queueWorker.func.middleware as any,
+    middleware: queueWorker.func.middleware,
     tags: queueWorker.func.tags,
   })
 

package/src/wirings/rpc/addon-auth-tags.test.ts

@@ -8,11 +8,7 @@ import {
   clearMiddlewareCache,
 } from '../../middleware-runner.js'
 import { ForbiddenError } from '../../errors/errors.js'
-import {
-  resolveAddonAuth,
-  resolveAddonTags,
-  wireAddon,
-} from './wire-addon.js'
+import { resolveAddonAuth, resolveAddonTags, wireAddon } from './wire-addon.js'
 
 const ADDON_PACKAGE = '@addon/console'
 

package/src/wirings/rpc/addon-runner.ts

@@ -4,6 +4,8 @@ import type {
   CoreSingletonServices,
 } from '../../types/core.types.js'
 import type { SecretService } from '../../services/secret-service.js'
+import { ScopedSecretService } from '../../services/scoped-secret-service.js'
+import { ScopedCredentialService } from '../../services/scoped-credential-service.js'
 import type { VariablesService } from '../../services/variables-service.js'
 
 export type AddonInstance = {
@@ -11,6 +13,10 @@ export type AddonInstance = {
   secretOverrides?: Record<string, string>
   variableOverrides?: Record<string, string>
   credentialOverrides?: Record<string, string>
+  /** Set by the consuming app to opt this instance out of secret scoping. */
+  globalSecrets?: string
+  /** Set by the consuming app to opt this instance out of credential scoping. */
+  globalCredentials?: string
 }
 
 const aliasSecretService = (
@@ -111,9 +117,6 @@ export const getOrCreatePackageSingletonServices = async (
   }
 
   const factories = pikkuState(packageName, 'package', 'factories')
-  if (!factories || !factories.createSingletonServices) {
-    return parentServices
-  }
 
   let existingServices = parentServices
   if (addonInstance?.secretOverrides && parentServices.secrets) {
@@ -134,6 +137,32 @@ export const getOrCreatePackageSingletonServices = async (
       ),
     }
   }
+  if (!addonInstance?.globalSecrets && existingServices.secrets) {
+    existingServices = {
+      ...existingServices,
+      secrets: new ScopedSecretService(
+        existingServices.secrets,
+        new Set(pikkuState(packageName, 'package', 'declaredSecrets') ?? [])
+      ),
+    }
+  }
+  if (!addonInstance?.globalCredentials && existingServices.credentialService) {
+    existingServices = {
+      ...existingServices,
+      credentialService: new ScopedCredentialService(
+        existingServices.credentialService,
+        new Set(
+          Object.keys(
+            pikkuState(packageName, 'package', 'credentialsMeta') ?? {}
+          )
+        )
+      ),
+    }
+  }
+
+  if (!factories || !factories.createSingletonServices) {
+    return existingServices
+  }
 
   let config: CoreConfig = existingServices.config
   if (factories.createConfig) {
@@ -173,5 +202,7 @@ export const addonInstanceForNamespace = (
     secretOverrides: cfg.secretOverrides,
     variableOverrides: cfg.variableOverrides,
     credentialOverrides: cfg.credentialOverrides,
+    globalSecrets: cfg.globalSecrets,
+    globalCredentials: cfg.globalCredentials,
   }
 }

package/src/wirings/rpc/addon-secrets.test.ts

@@ -0,0 +1,261 @@
+import { beforeEach, describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { pikkuState, resetPikkuState } from '../../pikku-state.js'
+import { getOrCreatePackageSingletonServices } from './addon-runner.js'
+import { wireAddon } from './wire-addon.js'
+import type { SecretService } from '../../services/secret-service.js'
+import type { CredentialService } from '../../services/credential-service.js'
+import type { CoreSingletonServices } from '../../types/core.types.js'
+
+const ADDON_PACKAGE = '@addon/example'
+
+const createSecretService = (): SecretService =>
+  ({
+    getSecret: async (key: string) => `value-of-${key}` as never,
+    hasSecret: async () => true,
+    setSecret: async () => {},
+    deleteSecret: async () => {},
+    getSecrets: async (keys: string[]) =>
+      Object.fromEntries(keys.map((k) => [k, `value-of-${k}`])) as never,
+  }) as SecretService
+
+const createCredentialService = (): CredentialService =>
+  ({
+    get: async (name: string) => `credential-of-${name}`,
+    set: async () => {},
+    delete: async () => {},
+    has: async () => true,
+    getAll: async () => ({ slack: 'a', stripe: 'b' }),
+    getUsersWithCredential: async () => ['user-1'],
+    getAllUsers: async () => ['user-1'],
+  }) as unknown as CredentialService
+
+const createParentServices = () =>
+  ({
+    config: {},
+    logger: {
+      debug: () => {},
+      info: () => {},
+      warn: () => {},
+      error: () => {},
+    },
+    secrets: createSecretService(),
+    credentialService: createCredentialService(),
+  }) as unknown as CoreSingletonServices
+
+/**
+ * Registers an addon package whose singleton factory hands back whatever
+ * secrets service the host decided it should see.
+ */
+const registerAddon = (
+  declaredSecrets: string[] | null,
+  declaredCredentials?: string[]
+) => {
+  pikkuState(ADDON_PACKAGE, 'package', 'factories', {
+    createSingletonServices: (async (_config: unknown, parent: any) => ({
+      ...parent,
+      secretsSeenByAddon: parent.secrets,
+      credentialsSeenByAddon: parent.credentialService,
+    })) as never,
+  })
+  if (declaredSecrets) {
+    pikkuState(ADDON_PACKAGE, 'package', 'declaredSecrets', declaredSecrets)
+  }
+  if (declaredCredentials) {
+    pikkuState(
+      ADDON_PACKAGE,
+      'package',
+      'credentialsMeta',
+      Object.fromEntries(
+        declaredCredentials.map((name) => [
+          name,
+          { name, displayName: name, type: 'singleton' },
+        ])
+      )
+    )
+  }
+}
+
+const servicesHandedToAddon = async (namespace: string) =>
+  (await getOrCreatePackageSingletonServices(
+    ADDON_PACKAGE,
+    createParentServices(),
+    pikkuState(null, 'addons', 'packages').get(namespace) as never
+  )) as any
+
+const secretsHandedToAddon = async (namespace: string) =>
+  (await servicesHandedToAddon(namespace)).secretsSeenByAddon as SecretService
+
+const credentialsHandedToAddon = async (namespace: string) =>
+  (await servicesHandedToAddon(namespace))
+    .credentialsSeenByAddon as CredentialService
+
+describe('addon secrets are scoped to what the addon declared', () => {
+  beforeEach(() => {
+    resetPikkuState()
+  })
+
+  test('a declared secret is readable', async () => {
+    registerAddon(['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    assert.equal(await secrets.getSecret('ADDON_KEY'), 'value-of-ADDON_KEY')
+  })
+
+  test('an undeclared secret is denied', async () => {
+    registerAddon(['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    await assert.rejects(
+      () => secrets.getSecret('SOMEONE_ELSES_KEY'),
+      /denied/i
+    )
+  })
+
+  test('a scoped addon cannot write secrets', async () => {
+    registerAddon(['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    await assert.rejects(() => secrets.setSecret('ADDON_KEY', 'x'))
+  })
+
+  test('an addon that declares nothing is scoped to nothing', async () => {
+    registerAddon([])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    await assert.rejects(() => secrets.getSecret('ADDON_KEY'), /denied/i)
+  })
+
+  test('globalSecrets, set by the host, hands over the whole service', async () => {
+    registerAddon(['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+      globalSecrets: 'administers secrets named by the operator at runtime',
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    assert.equal(
+      await secrets.getSecret('SOMEONE_ELSES_KEY'),
+      'value-of-SOMEONE_ELSES_KEY'
+    )
+    await assert.doesNotReject(() => secrets.setSecret('ADDON_KEY', 'x'))
+  })
+
+  test('an addon with no singleton factory is still scoped', async () => {
+    pikkuState(ADDON_PACKAGE, 'package', 'declaredSecrets', ['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+    })
+
+    const services = await getOrCreatePackageSingletonServices(
+      ADDON_PACKAGE,
+      createParentServices(),
+      pikkuState(null, 'addons', 'packages').get('example') as never
+    )
+
+    assert.equal(
+      await services.secrets.getSecret('ADDON_KEY'),
+      'value-of-ADDON_KEY'
+    )
+    await assert.rejects(
+      () => services.secrets.getSecret('SOMEONE_ELSES_KEY'),
+      /denied/i
+    )
+  })
+
+  test('scoping applies to the key the addon asks for, not the aliased one', async () => {
+    registerAddon(['ADDON_KEY'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+      secretOverrides: { ADDON_KEY: 'PROD_ADDON_KEY' },
+    })
+
+    const secrets = await secretsHandedToAddon('example')
+    assert.equal(
+      await secrets.getSecret('ADDON_KEY'),
+      'value-of-PROD_ADDON_KEY'
+    )
+    await assert.rejects(() => secrets.getSecret('PROD_ADDON_KEY'), /denied/i)
+  })
+})
+
+describe('addon credentials are scoped to what the addon declared', () => {
+  beforeEach(() => {
+    resetPikkuState()
+  })
+
+  test('a declared credential is reachable', async () => {
+    registerAddon(['ADDON_KEY'], ['slack'])
+    wireAddon({ name: 'example', package: ADDON_PACKAGE })
+
+    const credentials = await credentialsHandedToAddon('example')
+    assert.equal(await credentials.get('slack'), 'credential-of-slack')
+  })
+
+  test('an undeclared credential is denied', async () => {
+    registerAddon(['ADDON_KEY'], ['slack'])
+    wireAddon({ name: 'example', package: ADDON_PACKAGE })
+
+    const credentials = await credentialsHandedToAddon('example')
+    await assert.rejects(() => credentials.get('stripe'), /denied/i)
+  })
+
+  test('a scoped addon cannot enumerate the app users', async () => {
+    registerAddon(['ADDON_KEY'], ['slack'])
+    wireAddon({ name: 'example', package: ADDON_PACKAGE })
+
+    const credentials = await credentialsHandedToAddon('example')
+    await assert.rejects(() => credentials.getAllUsers(), /denied/i)
+  })
+
+  test('an addon with no singleton factory is still scoped', async () => {
+    pikkuState(ADDON_PACKAGE, 'package', 'credentialsMeta', {
+      slack: { name: 'slack', displayName: 'slack', type: 'singleton' },
+    } as never)
+    wireAddon({ name: 'example', package: ADDON_PACKAGE })
+
+    const services = await getOrCreatePackageSingletonServices(
+      ADDON_PACKAGE,
+      createParentServices(),
+      pikkuState(null, 'addons', 'packages').get('example') as never
+    )
+    const credentials = services.credentialService as CredentialService
+
+    assert.equal(await credentials.get('slack'), 'credential-of-slack')
+    await assert.rejects(() => credentials.get('stripe'), /denied/i)
+    await assert.rejects(() => credentials.getAllUsers(), /denied/i)
+  })
+
+  test('globalCredentials, set by the host, hands over the whole service', async () => {
+    registerAddon(['ADDON_KEY'], ['slack'])
+    wireAddon({
+      name: 'example',
+      package: ADDON_PACKAGE,
+      globalCredentials: 'links credentials an operator names at runtime',
+    })
+
+    const credentials = await credentialsHandedToAddon('example')
+    assert.equal(await credentials.get('stripe'), 'credential-of-stripe')
+    assert.deepEqual(await credentials.getAllUsers(), ['user-1'])
+  })
+})

package/src/wirings/rpc/rpc-runner.test.ts

@@ -708,6 +708,7 @@ describe('multi-instance addons', () => {
         return svc
       },
     } as never)
+    pikkuState('@addon/slack', 'package', 'declaredSecrets', ['slackToken'])
     registerFunction(
       'send',
       async (services: any) => ({ token: services.token }),
@@ -753,6 +754,7 @@ describe('multi-instance addons', () => {
         }
       },
     } as never)
+    pikkuState('@addon/slack', 'package', 'declaredSecrets', ['slackToken'])
 
     registerFunction(
       'leaf',