@pikku/kysely 0.12.12 → 0.12.14

package/CHANGELOG.md

@@ -1,3 +1,28 @@
+## 0.12.14
+
+### Patch Changes
+
+- 4b5c75b: feat(auth-js): wire OIDC config (issuer/tenantId) as variables, expand provider registry
+  - Move `issuer` and `tenantId` out of the secret blob for OIDC providers (auth0, okta, azure-ad, keycloak, cognito, microsoft-entra-id) — they are public config URLs, not secrets. Now registered via `wireVariable` and loaded at runtime via `services.variables.get()`.
+  - Expand provider registry from 13 to 31 providers: reddit, notion, instagram, zoom, figma, tiktok, threads, patreon, dropbox, bitbucket, hubspot, salesforce, atlassian, strava, keycloak, cognito, microsoft-entra-id added.
+  - `serialize-auth-gen` emits `wireVariable({...})` declarations and `services.variables.get()` calls in the generated factory for OIDC providers.
+  - Integration verifier exercises real `/auth/providers` endpoint with `LocalSecretService` + `LocalVariablesService`, including a spy test proving `services.variables.get('AUTH0_ISSUER')` is called at request time.
+
+- Updated dependencies [4b5c75b]
+- Updated dependencies [4b5c75b]
+  - @pikku/core@0.12.27
+
+## 0.12.13
+
+### Patch Changes
+
+- 909eb25: Add audit logging support for function invocations and database queries.
+
+  Introduces `AuditService` and `createAuditedKysely` — configurable audit capture with best-effort and transactional durability modes. Audit logs capture session metadata (user, org), RPC call details, and Kysely query operations (type, tables, changes). Audit context is scoped per-invocation so nested RPC calls are correctly attributed.
+
+- Updated dependencies [909eb25]
+  - @pikku/core@0.12.26
+
 ## 0.12.12
 
 ### Patch Changes

package/dist/src/kysely-secret-service.d.ts

@@ -20,10 +20,10 @@ export declare class KyselySecretService implements SecretService {
     init(): Promise<void>;
     private logAudit;
     private getKEK;
-    getSecret(key: string): Promise<string>;
-    getSecretJSON<R = {}>(key: string): Promise<R>;
+    getSecret<T = string>(key: string): Promise<T>;
     hasSecret(key: string): Promise<boolean>;
-    setSecretJSON(key: string, value: unknown): Promise<void>;
+    setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/kysely-secret-service.js

@@ -76,10 +76,6 @@ export class KyselySecretService {
         await this.logAudit(key, 'read');
         return result;
     }
-    async getSecretJSON(key) {
-        const raw = await this.getSecret(key);
-        return JSON.parse(raw);
-    }
     async hasSecret(key) {
         const row = await this.db
             .selectFrom('secrets')
@@ -88,9 +84,8 @@ export class KyselySecretService {
             .executeTakeFirst();
         return !!row;
     }
-    async setSecretJSON(key, value) {
-        const plaintext = JSON.stringify(value);
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, plaintext);
+    async setSecret(key, value) {
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value);
         const now = new Date().toISOString();
         await this.db
             .insertInto('secrets')
@@ -115,6 +110,24 @@ export class KyselySecretService {
         await this.db.deleteFrom('secrets').where('key', '=', key).execute();
         await this.logAudit(key, 'delete');
     }
+    async getSecrets(keys) {
+        const rows = await this.db
+            .selectFrom('secrets')
+            .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+            .where('key', 'in', keys)
+            .execute();
+        const out = {};
+        for (const row of rows) {
+            try {
+                const kek = this.getKEK(row.keyVersion);
+                out[row.key] = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
+            }
+            catch {
+                // skip secrets that fail to decrypt
+            }
+        }
+        return out;
+    }
     async rotateKEK() {
         if (!this.previousKey) {
             throw new Error('No previousKey configured — nothing to rotate from');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.12.12",
+  "version": "0.12.14",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.24"
+    "@pikku/core": "^0.12.27"
   },
   "dependencies": {
     "kysely": "^0.28.12"
@@ -33,5 +33,8 @@
     "kysely-postgres-js": "^3.0.0",
     "postgres": "^3.4.8",
     "typescript": "^5.9"
+  },
+  "exports": {
+    ".": "./dist/src/index.js"
   }
 }

package/src/kysely-secret-service.ts

@@ -93,7 +93,7 @@ export class KyselySecretService implements SecretService {
     throw new Error(`No KEK available for key_version ${version}`)
   }
 
-  async getSecret(key: string): Promise<string> {
+  async getSecret<T = string>(key: string): Promise<T> {
     const row = await this.db
       .selectFrom('secrets')
       .select(['ciphertext', 'wrappedDek', 'keyVersion'])
@@ -103,20 +103,11 @@ export class KyselySecretService implements SecretService {
     if (!row) throw new Error('Requested secret not found')
 
     const kek = this.getKEK(row.keyVersion)
-    const result = await envelopeDecrypt<string>(
-      kek,
-      row.ciphertext,
-      row.wrappedDek
-    )
+    const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
     await this.logAudit(key, 'read')
     return result
   }
 
-  async getSecretJSON<R = {}>(key: string): Promise<R> {
-    const raw = await this.getSecret(key)
-    return JSON.parse(raw) as R
-  }
-
   async hasSecret(key: string): Promise<boolean> {
     const row = await this.db
       .selectFrom('secrets')
@@ -126,12 +117,8 @@ export class KyselySecretService implements SecretService {
     return !!row
   }
 
-  async setSecretJSON(key: string, value: unknown): Promise<void> {
-    const plaintext = JSON.stringify(value)
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      this.key,
-      plaintext
-    )
+  async setSecret(key: string, value: unknown): Promise<void> {
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(this.key, value)
     const now = new Date().toISOString()
 
     await this.db
@@ -162,6 +149,29 @@ export class KyselySecretService implements SecretService {
     await this.logAudit(key, 'delete')
   }
 
+  async getSecrets(keys: string[]): Promise<Record<string, unknown>> {
+    const rows = await this.db
+      .selectFrom('secrets')
+      .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+      .where('key', 'in', keys)
+      .execute()
+
+    const out: Record<string, unknown> = {}
+    for (const row of rows) {
+      try {
+        const kek = this.getKEK(row.keyVersion)
+        out[row.key] = await envelopeDecrypt(
+          kek,
+          row.ciphertext,
+          row.wrappedDek
+        )
+      } catch {
+        // skip secrets that fail to decrypt
+      }
+    }
+    return out
+  }
+
   async rotateKEK(): Promise<number> {
     if (!this.previousKey) {
       throw new Error('No previousKey configured — nothing to rotate from')

package/src/kysely-services.test.ts

@@ -128,7 +128,7 @@ function registerTests(
         auditReads: true,
       })
       await service.init()
-      await service.setSecretJSON('audit-test', 'value')
+      await service.setSecret('audit-test', 'value')
       await service.getSecret('audit-test')
       await service.deleteSecret('audit-test')
 
@@ -152,7 +152,7 @@ function registerTests(
         auditReads: false,
       })
       await service.init()
-      await service.setSecretJSON('no-read-audit', 'value')
+      await service.setSecret('no-read-audit', 'value')
       await service.getSecret('no-read-audit')
 
       const logs = await getDb()