@pikku/kysely 0.12.12 → 0.12.13

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.12.13
+
+### Patch Changes
+
+- 909eb25: Add audit logging support for function invocations and database queries.
+
+  Introduces `AuditService` and `createAuditedKysely` — configurable audit capture with best-effort and transactional durability modes. Audit logs capture session metadata (user, org), RPC call details, and Kysely query operations (type, tables, changes). Audit context is scoped per-invocation so nested RPC calls are correctly attributed.
+
+- Updated dependencies [909eb25]
+  - @pikku/core@0.12.26
+
 ## 0.12.12
 
 ### Patch Changes

package/dist/src/kysely-secret-service.d.ts

@@ -20,10 +20,9 @@ export declare class KyselySecretService implements SecretService {
     init(): Promise<void>;
     private logAudit;
     private getKEK;
-    getSecret(key: string): Promise<string>;
-    getSecretJSON<R = {}>(key: string): Promise<R>;
+    getSecret<T = string>(key: string): Promise<T>;
     hasSecret(key: string): Promise<boolean>;
-    setSecretJSON(key: string, value: unknown): Promise<void>;
+    setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/kysely-secret-service.js

@@ -76,10 +76,6 @@ export class KyselySecretService {
         await this.logAudit(key, 'read');
         return result;
     }
-    async getSecretJSON(key) {
-        const raw = await this.getSecret(key);
-        return JSON.parse(raw);
-    }
     async hasSecret(key) {
         const row = await this.db
             .selectFrom('secrets')
@@ -88,9 +84,8 @@ export class KyselySecretService {
             .executeTakeFirst();
         return !!row;
     }
-    async setSecretJSON(key, value) {
-        const plaintext = JSON.stringify(value);
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, plaintext);
+    async setSecret(key, value) {
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value);
         const now = new Date().toISOString();
         await this.db
             .insertInto('secrets')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.12.12",
+  "version": "0.12.13",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.24"
+    "@pikku/core": "^0.12.26"
   },
   "dependencies": {
     "kysely": "^0.28.12"

package/src/kysely-secret-service.ts

@@ -93,7 +93,7 @@ export class KyselySecretService implements SecretService {
     throw new Error(`No KEK available for key_version ${version}`)
   }
 
-  async getSecret(key: string): Promise<string> {
+  async getSecret<T = string>(key: string): Promise<T> {
     const row = await this.db
       .selectFrom('secrets')
       .select(['ciphertext', 'wrappedDek', 'keyVersion'])
@@ -103,20 +103,11 @@ export class KyselySecretService implements SecretService {
     if (!row) throw new Error('Requested secret not found')
 
     const kek = this.getKEK(row.keyVersion)
-    const result = await envelopeDecrypt<string>(
-      kek,
-      row.ciphertext,
-      row.wrappedDek
-    )
+    const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
     await this.logAudit(key, 'read')
     return result
   }
 
-  async getSecretJSON<R = {}>(key: string): Promise<R> {
-    const raw = await this.getSecret(key)
-    return JSON.parse(raw) as R
-  }
-
   async hasSecret(key: string): Promise<boolean> {
     const row = await this.db
       .selectFrom('secrets')
@@ -126,12 +117,8 @@ export class KyselySecretService implements SecretService {
     return !!row
   }
 
-  async setSecretJSON(key: string, value: unknown): Promise<void> {
-    const plaintext = JSON.stringify(value)
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      this.key,
-      plaintext
-    )
+  async setSecret(key: string, value: unknown): Promise<void> {
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value)
     const now = new Date().toISOString()
 
     await this.db

package/src/kysely-services.test.ts

@@ -128,7 +128,7 @@ function registerTests(
         auditReads: true,
       })
       await service.init()
-      await service.setSecretJSON('audit-test', 'value')
+      await service.setSecret('audit-test', 'value')
       await service.getSecret('audit-test')
       await service.deleteSecret('audit-test')
 
@@ -152,7 +152,7 @@ function registerTests(
         auditReads: false,
       })
       await service.init()
-      await service.setSecretJSON('no-read-audit', 'value')
+      await service.setSecret('no-read-audit', 'value')
       await service.getSecret('no-read-audit')
 
       const logs = await getDb()