@pikku/kysely 0.12.13 → 0.12.14

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.12.14
+
+### Patch Changes
+
+- 4b5c75b: feat(auth-js): wire OIDC config (issuer/tenantId) as variables, expand provider registry
+  - Move `issuer` and `tenantId` out of the secret blob for OIDC providers (auth0, okta, azure-ad, keycloak, cognito, microsoft-entra-id) — they are public config URLs, not secrets. Now registered via `wireVariable` and loaded at runtime via `services.variables.get()`.
+  - Expand provider registry from 13 to 31 providers: reddit, notion, instagram, zoom, figma, tiktok, threads, patreon, dropbox, bitbucket, hubspot, salesforce, atlassian, strava, keycloak, cognito, microsoft-entra-id added.
+  - `serialize-auth-gen` emits `wireVariable({...})` declarations and `services.variables.get()` calls in the generated factory for OIDC providers.
+  - Integration verifier exercises real `/auth/providers` endpoint with `LocalSecretService` + `LocalVariablesService`, including a spy test proving `services.variables.get('AUTH0_ISSUER')` is called at request time.
+
+- Updated dependencies [4b5c75b]
+- Updated dependencies [4b5c75b]
+  - @pikku/core@0.12.27
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/src/kysely-secret-service.d.ts

@@ -24,5 +24,6 @@ export declare class KyselySecretService implements SecretService {
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
+    getSecrets(keys: string[]): Promise<Record<string, unknown>>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/kysely-secret-service.js

@@ -110,6 +110,24 @@ export class KyselySecretService {
         await this.db.deleteFrom('secrets').where('key', '=', key).execute();
         await this.logAudit(key, 'delete');
     }
+    async getSecrets(keys) {
+        const rows = await this.db
+            .selectFrom('secrets')
+            .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+            .where('key', 'in', keys)
+            .execute();
+        const out = {};
+        for (const row of rows) {
+            try {
+                const kek = this.getKEK(row.keyVersion);
+                out[row.key] = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
+            }
+            catch {
+                // skip secrets that fail to decrypt
+            }
+        }
+        return out;
+    }
     async rotateKEK() {
         if (!this.previousKey) {
             throw new Error('No previousKey configured — nothing to rotate from');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.26"
+    "@pikku/core": "^0.12.27"
   },
   "dependencies": {
     "kysely": "^0.28.12"
@@ -33,5 +33,8 @@
     "kysely-postgres-js": "^3.0.0",
     "postgres": "^3.4.8",
     "typescript": "^5.9"
+  },
+  "exports": {
+    ".": "./dist/src/index.js"
   }
 }

package/src/kysely-secret-service.ts

@@ -149,6 +149,29 @@ export class KyselySecretService implements SecretService {
     await this.logAudit(key, 'delete')
   }
 
+  async getSecrets(keys: string[]): Promise<Record<string, unknown>> {
+    const rows = await this.db
+      .selectFrom('secrets')
+      .select(['key', 'ciphertext', 'wrappedDek', 'keyVersion'])
+      .where('key', 'in', keys)
+      .execute()
+
+    const out: Record<string, unknown> = {}
+    for (const row of rows) {
+      try {
+        const kek = this.getKEK(row.keyVersion)
+        out[row.key] = await envelopeDecrypt(
+          kek,
+          row.ciphertext,
+          row.wrappedDek
+        )
+      } catch {
+        // skip secrets that fail to decrypt
+      }
+    }
+    return out
+  }
+
   async rotateKEK(): Promise<number> {
     if (!this.previousKey) {
       throw new Error('No previousKey configured — nothing to rotate from')