@pikku/core 0.12.8 → 0.12.10

package/src/services/local-content.ts

@@ -1,6 +1,7 @@
 import { createReadStream, createWriteStream, promises } from 'fs'
 import { mkdir, readFile } from 'fs/promises'
-import type { ContentService, Logger } from '@pikku/core/services'
+import { resolve, normalize } from 'path'
+import type { ContentService, JWTService, Logger } from '@pikku/core/services'
 import { pipeline } from 'stream/promises'
 import type { Readable } from 'stream'
 
@@ -15,19 +16,66 @@ export interface LocalContentConfig {
 export class LocalContent implements ContentService {
   constructor(
     private config: LocalContentConfig,
-    private logger: Logger
+    private logger: Logger,
+    private jwt?: JWTService
   ) {}
 
+  private safePath(assetKey: string): string {
+    const base = resolve(this.config.localFileUploadPath)
+    const target = resolve(base, normalize(assetKey))
+    if (!target.startsWith(base + '/') && target !== base) {
+      throw new Error('Invalid asset key')
+    }
+    return target
+  }
+
   public async init() {}
 
-  public async signURL(url: string): Promise<string> {
-    return `${url}?signed=true`
+  private async signParams(
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const signedAt = Date.now()
+    const expiresAt = dateLessThan.getTime()
+    const params = new URLSearchParams({
+      signedAt: String(signedAt),
+      expiresAt: String(expiresAt),
+    })
+    if (dateGreaterThan) {
+      params.set('notBefore', String(dateGreaterThan.getTime()))
+    }
+    if (this.jwt) {
+      const expiresInSeconds = Math.max(
+        1,
+        Math.floor((expiresAt - signedAt) / 1000)
+      )
+      const signature = await this.jwt.encode(
+        { value: expiresInSeconds, unit: 'second' },
+        { signedAt, expiresAt }
+      )
+      params.set('signature', signature)
+    }
+    return params.toString()
+  }
+
+  public async signURL(
+    url: string,
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const params = await this.signParams(dateLessThan, dateGreaterThan)
+    return `${url}?${params}`
   }
 
-  public async signContentKey(assetKey: string): Promise<string> {
-    return this.config.server
-      ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}?signed=true`
-      : `${this.config.assetUrlPrefix}/${assetKey}?signed=true`
+  public async signContentKey(
+    assetKey: string,
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const base = this.config.server
+      ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}`
+      : `${this.config.assetUrlPrefix}/${assetKey}`
+    return this.signURL(base, dateLessThan, dateGreaterThan)
   }
 
   public async getUploadURL(assetKey: string) {
@@ -44,7 +92,7 @@ export class LocalContent implements ContentService {
   ): Promise<boolean> {
     this.logger.debug(`Writing file: ${assetKey}`)
 
-    const path = `${this.config.localFileUploadPath}/${assetKey}`
+    const path = this.safePath(assetKey)
 
     try {
       await this.createDirectoryForFile(path)
@@ -65,7 +113,7 @@ export class LocalContent implements ContentService {
   ): Promise<boolean> {
     this.logger.debug(`Writing file: ${assetKey}`)
     try {
-      const path = `${this.config.localFileUploadPath}/${assetKey}`
+      const path = this.safePath(assetKey)
       await this.createDirectoryForFile(path)
       await promises.copyFile(fromAbsolutePath, path)
     } catch (e) {
@@ -80,7 +128,7 @@ export class LocalContent implements ContentService {
   ): Promise<ReadableStream | NodeJS.ReadableStream> {
     this.logger.debug(`Getting key: ${assetKey}`)
 
-    const filePath = `${this.config.localFileUploadPath}/${assetKey}`
+    const filePath = this.safePath(assetKey)
 
     try {
       const stream = createReadStream(filePath)
@@ -97,7 +145,7 @@ export class LocalContent implements ContentService {
   }
 
   public async readFileAsBuffer(assetKey: string): Promise<Buffer> {
-    const filePath = `${this.config.localFileUploadPath}/${assetKey}`
+    const filePath = this.safePath(assetKey)
     this.logger.debug(`Reading file as buffer: ${assetKey}`)
     return readFile(filePath)
   }
@@ -105,7 +153,7 @@ export class LocalContent implements ContentService {
   public async deleteFile(assetKey: string): Promise<boolean> {
     this.logger.debug(`deleting key: ${assetKey}`)
     try {
-      await promises.unlink(`${this.config.localFileUploadPath}/${assetKey}`)
+      await promises.unlink(this.safePath(assetKey))
       return true
     } catch (e: any) {
       this.logger.error(`Error deleting content ${assetKey}`, e)

package/src/services/local-credential-service.ts

@@ -0,0 +1,41 @@
+import type { CredentialService } from './credential-service.js'
+
+export class LocalCredentialService implements CredentialService {
+  private store: Map<string, unknown> = new Map()
+
+  private makeKey(name: string, userId?: string): string {
+    return userId ? `${userId}:${name}` : name
+  }
+
+  async get<T = unknown>(name: string, userId?: string): Promise<T | null> {
+    const key = this.makeKey(name, userId)
+    const value = this.store.get(key)
+    return (value as T) ?? null
+  }
+
+  async set(name: string, value: unknown, userId?: string): Promise<void> {
+    const key = this.makeKey(name, userId)
+    this.store.set(key, value)
+  }
+
+  async delete(name: string, userId?: string): Promise<void> {
+    const key = this.makeKey(name, userId)
+    this.store.delete(key)
+  }
+
+  async has(name: string, userId?: string): Promise<boolean> {
+    const key = this.makeKey(name, userId)
+    return this.store.has(key)
+  }
+
+  async getAll(userId: string): Promise<Record<string, unknown>> {
+    const prefix = `${userId}:`
+    const result: Record<string, unknown> = {}
+    for (const [key, value] of this.store) {
+      if (key.startsWith(prefix)) {
+        result[key.slice(prefix.length)] = value
+      }
+    }
+    return result
+  }
+}

package/src/services/local-secrets.test.ts

@@ -22,7 +22,7 @@ describe('LocalSecretService', () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
     await assert.rejects(() => service.getSecret('MISSING'), {
-      message: 'Secret Not Found: MISSING',
+      message: 'Requested secret not found',
     })
   })
 
@@ -44,7 +44,7 @@ describe('LocalSecretService', () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
     await assert.rejects(() => service.getSecretJSON('MISSING'), {
-      message: 'Secret Not Found: MISSING',
+      message: 'Requested secret not found',
     })
   })
 

package/src/services/local-secrets.ts

@@ -35,7 +35,7 @@ export class LocalSecretService implements SecretService {
     if (value) {
       return JSON.parse(value)
     }
-    throw new Error(`Secret Not Found: ${key}`)
+    throw new Error('Requested secret not found')
   }
 
   /**
@@ -57,7 +57,7 @@ export class LocalSecretService implements SecretService {
     if (value) {
       return value
     }
-    throw new Error(`Secret Not Found: ${key}`)
+    throw new Error('Requested secret not found')
   }
 
   /**

package/src/services/typed-credential-service.ts

@@ -0,0 +1,75 @@
+import type { CredentialService } from './credential-service.js'
+
+export interface CredentialStatusInfo {
+  name: string
+  displayName: string
+  isConfigured: boolean
+  type: 'singleton' | 'wire'
+  oauth2?: boolean
+}
+
+export type CredentialMetaInfo = {
+  name: string
+  displayName: string
+  type: 'singleton' | 'wire'
+  oauth2?: boolean
+}
+
+export class TypedCredentialService<TMap = Record<string, unknown>>
+  implements CredentialService
+{
+  constructor(
+    private credentials: CredentialService,
+    private credentialsMeta: Record<string, CredentialMetaInfo>
+  ) {}
+
+  async get<K extends keyof TMap & string>(
+    name: K,
+    userId?: string
+  ): Promise<TMap[K] | null>
+  async get<T = unknown>(name: string, userId?: string): Promise<T | null>
+  async get(name: string, userId?: string): Promise<unknown> {
+    return this.credentials.get(name, userId)
+  }
+
+  async set<K extends string>(
+    name: K,
+    value: K extends keyof TMap ? TMap[K] : unknown,
+    userId?: string
+  ): Promise<void> {
+    return this.credentials.set(name, value, userId)
+  }
+
+  async delete(name: string, userId?: string): Promise<void> {
+    return this.credentials.delete(name, userId)
+  }
+
+  async has(name: string, userId?: string): Promise<boolean> {
+    return this.credentials.has(name, userId)
+  }
+
+  async getAll(userId: string): Promise<Record<string, unknown>> {
+    return this.credentials.getAll(userId)
+  }
+
+  async getAllStatus(userId?: string): Promise<CredentialStatusInfo[]> {
+    const results: CredentialStatusInfo[] = []
+
+    for (const [name, meta] of Object.entries(this.credentialsMeta)) {
+      results.push({
+        name,
+        displayName: meta.displayName,
+        isConfigured: await this.credentials.has(name, userId),
+        type: meta.type,
+        oauth2: meta.oauth2,
+      })
+    }
+
+    return results
+  }
+
+  async getMissing(userId?: string): Promise<CredentialStatusInfo[]> {
+    const all = await this.getAllStatus(userId)
+    return all.filter((c) => !c.isConfigured)
+  }
+}

package/src/testing/service-tests.ts

@@ -9,6 +9,7 @@ import type { DeploymentService } from '../services/deployment-service.js'
 import type { AIStorageService } from '../services/ai-storage-service.js'
 import type { AIRunStateService } from '../services/ai-run-state-service.js'
 import type { SecretService } from '../services/secret-service.js'
+import type { CredentialService } from '../services/credential-service.js'
 import type { AgentRunService } from '../wirings/ai-agent/ai-agent.types.js'
 
 export interface ServiceTestConfig {
@@ -28,6 +29,11 @@ export interface ServiceTestConfig {
       keyVersion?: number
       previousKey?: string
     }) => Promise<SecretService & { rotateKEK?(): Promise<number> }>
+    credentialService?: (config: {
+      key: string
+      keyVersion?: number
+      previousKey?: string
+    }) => Promise<CredentialService & { rotateKEK?(): Promise<number> }>
   }
 }
 
@@ -780,7 +786,7 @@ export function defineServiceTests(config: ServiceTestConfig): void {
       test('getSecret throws for missing key', async () => {
         const service = await factory({ key: kek })
         await assert.rejects(() => service.getSecret('nonexistent'), {
-          message: 'Secret not found: nonexistent',
+          message: 'Requested secret not found',
         })
       })
 
@@ -840,6 +846,139 @@ export function defineServiceTests(config: ServiceTestConfig): void {
     })
   }
 
+  if (services.credentialService) {
+    const factory = services.credentialService
+    const kek = 'test-key-encryption-key-32chars!'
+
+    describe(`CredentialService [${name}]`, () => {
+      test('set and get (global)', async () => {
+        const service = await factory({ key: kek })
+        await service.set('stripe', { apiKey: 'sk-123' })
+        const result = await service.get<{ apiKey: string }>('stripe')
+        assert.deepEqual(result, { apiKey: 'sk-123' })
+      })
+
+      test('get returns null for missing', async () => {
+        const service = await factory({ key: kek })
+        const result = await service.get('nonexistent')
+        assert.equal(result, null)
+      })
+
+      test('has returns true/false', async () => {
+        const service = await factory({ key: kek })
+        await service.set('exists', { key: 'val' })
+        assert.strictEqual(await service.has('exists'), true)
+        assert.strictEqual(await service.has('nope'), false)
+      })
+
+      test('set upserts existing credential', async () => {
+        const service = await factory({ key: kek })
+        await service.set('upsert', { v: 1 })
+        await service.set('upsert', { v: 2 })
+        const result = await service.get<{ v: number }>('upsert')
+        assert.deepEqual(result, { v: 2 })
+      })
+
+      test('delete removes credential', async () => {
+        const service = await factory({ key: kek })
+        await service.set('to-delete', { bye: true })
+        assert.strictEqual(await service.has('to-delete'), true)
+        await service.delete('to-delete')
+        assert.strictEqual(await service.has('to-delete'), false)
+      })
+
+      test('per-user isolation', async () => {
+        const service = await factory({ key: kek })
+        await service.set('token', { access: 'user1' }, 'user-1')
+        await service.set('token', { access: 'user2' }, 'user-2')
+
+        const u1 = await service.get<{ access: string }>('token', 'user-1')
+        const u2 = await service.get<{ access: string }>('token', 'user-2')
+        assert.deepEqual(u1, { access: 'user1' })
+        assert.deepEqual(u2, { access: 'user2' })
+      })
+
+      test('per-user delete does not affect other users', async () => {
+        const service = await factory({ key: kek })
+        await service.set('cred', { val: 'a' }, 'user-a')
+        await service.set('cred', { val: 'b' }, 'user-b')
+
+        await service.delete('cred', 'user-a')
+        assert.strictEqual(await service.has('cred', 'user-a'), false)
+        assert.strictEqual(await service.has('cred', 'user-b'), true)
+      })
+
+      test('global and per-user are separate', async () => {
+        const service = await factory({ key: kek })
+        await service.set('shared', { scope: 'global' })
+        await service.set('shared', { scope: 'user' }, 'user-1')
+
+        const global = await service.get<{ scope: string }>('shared')
+        const perUser = await service.get<{ scope: string }>('shared', 'user-1')
+        assert.deepEqual(global, { scope: 'global' })
+        assert.deepEqual(perUser, { scope: 'user' })
+      })
+
+      test('getAll returns all credentials for a user', async () => {
+        const service = await factory({ key: kek })
+        await service.set('cred-a', { a: 1 }, 'user-x')
+        await service.set('cred-b', { b: 2 }, 'user-x')
+        await service.set('cred-c', { c: 3 }, 'user-y')
+
+        const all = await service.getAll('user-x')
+        assert.deepEqual(all['cred-a'], { a: 1 })
+        assert.deepEqual(all['cred-b'], { b: 2 })
+        assert.strictEqual(all['cred-c'], undefined)
+      })
+
+      test('getAll returns empty for unknown user', async () => {
+        const service = await factory({ key: kek })
+        const all = await service.getAll('nobody')
+        assert.deepEqual(all, {})
+      })
+
+      test('rotateKEK re-wraps all credentials', async () => {
+        const newKEK = 'new-key-encryption-key-rotated!'
+        const oldService = await factory({ key: kek })
+        await oldService.set('rotate-cred', { important: 'data' }, 'user-r')
+
+        const rotatedService = await factory({
+          key: newKEK,
+          keyVersion: 2,
+          previousKey: kek,
+        })
+
+        const before = await rotatedService.get<{ important: string }>(
+          'rotate-cred',
+          'user-r'
+        )
+        assert.deepEqual(before, { important: 'data' })
+
+        assert.ok(rotatedService.rotateKEK)
+        const count = await rotatedService.rotateKEK!()
+        assert.ok(count > 0)
+
+        const newOnlyService = await factory({
+          key: newKEK,
+          keyVersion: 2,
+        })
+        const after = await newOnlyService.get<{ important: string }>(
+          'rotate-cred',
+          'user-r'
+        )
+        assert.deepEqual(after, { important: 'data' })
+      })
+
+      test('rotateKEK throws without previousKey', async () => {
+        const service = await factory({ key: kek })
+        assert.ok(service.rotateKEK)
+        await assert.rejects(() => service.rotateKEK!(), {
+          message: 'No previousKey configured — nothing to rotate from',
+        })
+      })
+    })
+  }
+
   if (services.agentRunService) {
     const factory = services.agentRunService
     describe(`AgentRunService [${name}]`, () => {

package/src/types/core.types.ts

@@ -33,6 +33,7 @@ import type { AIRunStateService } from '../services/ai-run-state-service.js'
 import type { AgentRunService } from '../wirings/ai-agent/ai-agent.types.js'
 import type { PikkuAIMiddlewareHooks } from '../wirings/ai-agent/ai-agent.types.js'
 import type { WorkflowRunService } from '../wirings/workflow/workflow.types.js'
+import type { CredentialService } from '../services/credential-service.js'
 
 export type PikkuWiringTypes =
   | 'http'
@@ -227,6 +228,8 @@ export interface CoreSingletonServices<Config extends CoreConfig = CoreConfig> {
   agentRunService?: AgentRunService
   /** Workflow run service (listing workflow runs) */
   workflowRunService?: WorkflowRunService
+  /** Credential service for dynamic/managed credentials (OAuth tokens, per-user API keys) */
+  credentialService?: CredentialService
 }
 
 /**
@@ -270,6 +273,10 @@ export type PikkuWire<
   getSession: () => Promise<UserSession> | UserSession | undefined
   /** Whether the session was modified during this run */
   hasSessionChanged: () => boolean
+  /** Set a credential value (available in middleware) */
+  setCredential: (name: string, value: unknown) => void
+  /** Get all resolved credentials (only available in pikkuWireServices) */
+  getCredentials: () => Record<string, unknown>
 }>
 
 /**