@pikku/mongodb 0.12.1

package/src/mongodb-deployment-service.ts

@@ -0,0 +1,114 @@
+import type {
+  DeploymentService,
+  DeploymentServiceConfig,
+  DeploymentConfig,
+  DeploymentInfo,
+} from '@pikku/core/services'
+import { getAllFunctionNames } from '@pikku/core/function'
+import type { Db, Collection } from 'mongodb'
+
+interface DeploymentDoc {
+  _id: string
+  endpoint: string
+  lastHeartbeat: Date
+  createdAt: Date
+  functions: string[]
+}
+
+export class MongoDBDeploymentService implements DeploymentService {
+  private initialized = false
+  private heartbeatTimer?: ReturnType<typeof setInterval>
+  private deploymentConfig?: DeploymentConfig
+  private heartbeatInterval: number
+  private heartbeatTtl: number
+  private deployments!: Collection<DeploymentDoc>
+
+  constructor(
+    config: DeploymentServiceConfig,
+    private db: Db
+  ) {
+    this.heartbeatInterval = config.heartbeatInterval ?? 10000
+    this.heartbeatTtl = config.heartbeatTtl ?? 30000
+  }
+
+  public async init(): Promise<void> {
+    if (this.initialized) return
+
+    this.deployments = this.db.collection<DeploymentDoc>('pikku_deployments')
+
+    await this.deployments.createIndex({ lastHeartbeat: 1 })
+    await this.deployments.createIndex({ functions: 1 })
+
+    this.initialized = true
+  }
+
+  async start(config: DeploymentConfig): Promise<void> {
+    const functions = config.functions ?? getAllFunctionNames()
+    this.deploymentConfig = { ...config, functions }
+    const now = new Date()
+
+    await this.deployments.updateOne(
+      { _id: config.deploymentId },
+      {
+        $set: {
+          endpoint: config.endpoint,
+          lastHeartbeat: now,
+          functions,
+        },
+        $setOnInsert: {
+          _id: config.deploymentId,
+          createdAt: now,
+        },
+      },
+      { upsert: true }
+    )
+
+    this.heartbeatTimer = setInterval(
+      () => this.sendHeartbeat(),
+      this.heartbeatInterval
+    )
+  }
+
+  async stop(): Promise<void> {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer)
+      this.heartbeatTimer = undefined
+    }
+
+    if (this.deploymentConfig) {
+      await this.deployments.deleteOne({
+        _id: this.deploymentConfig.deploymentId,
+      })
+    }
+  }
+
+  async findFunction(name: string): Promise<DeploymentInfo[]> {
+    const cutoff = new Date(Date.now() - this.heartbeatTtl)
+
+    const result = await this.deployments
+      .find({
+        functions: name,
+        lastHeartbeat: { $gt: cutoff },
+      })
+      .sort({ lastHeartbeat: -1 })
+      .toArray()
+
+    return result.map((row) => ({
+      deploymentId: row._id,
+      endpoint: row.endpoint,
+    }))
+  }
+
+  private async sendHeartbeat(): Promise<void> {
+    if (!this.deploymentConfig) return
+
+    try {
+      await this.deployments.updateOne(
+        { _id: this.deploymentConfig.deploymentId },
+        { $set: { lastHeartbeat: new Date() } }
+      )
+    } catch {
+      // Heartbeat failed, will retry on next interval
+    }
+  }
+}

package/src/mongodb-eventhub-store.ts

@@ -0,0 +1,52 @@
+import { EventHubStore } from '@pikku/core/channel'
+import type { Db, Collection } from 'mongodb'
+
+interface ChannelSubscriptionDoc {
+  channelId: string
+  topic: string
+}
+
+export class MongoDBEventHubStore extends EventHubStore {
+  private initialized = false
+  private subscriptions!: Collection<ChannelSubscriptionDoc>
+
+  constructor(private db: Db) {
+    super()
+  }
+
+  public async init(): Promise<void> {
+    if (this.initialized) return
+    this.subscriptions = this.db.collection<ChannelSubscriptionDoc>(
+      'channel_subscriptions'
+    )
+    this.initialized = true
+  }
+
+  public async getChannelIdsForTopic(topic: string): Promise<string[]> {
+    const result = await this.subscriptions
+      .find({ topic })
+      .project({ channelId: 1 })
+      .toArray()
+    return result.map((row) => row.channelId)
+  }
+
+  public async subscribe(topic: string, channelId: string): Promise<boolean> {
+    try {
+      await this.subscriptions.updateOne(
+        { channelId, topic },
+        { $setOnInsert: { channelId, topic } },
+        { upsert: true }
+      )
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  public async unsubscribe(topic: string, channelId: string): Promise<boolean> {
+    const result = await this.subscriptions.deleteOne({ channelId, topic })
+    return result.deletedCount > 0
+  }
+
+  public async close(): Promise<void> {}
+}

package/src/mongodb-secret-service.ts

@@ -0,0 +1,178 @@
+import type { SecretService } from '@pikku/core/services'
+import type { Db, Collection } from 'mongodb'
+import {
+  envelopeEncrypt,
+  envelopeDecrypt,
+  envelopeRewrap,
+} from '@pikku/core/crypto-utils'
+
+export interface MongoDBSecretServiceConfig {
+  key: string
+  keyVersion?: number
+  previousKey?: string
+  audit?: boolean
+  auditReads?: boolean
+}
+
+interface SecretDoc {
+  _id: string
+  ciphertext: string
+  wrappedDek: string
+  keyVersion: number
+  createdAt: Date
+  updatedAt: Date
+}
+
+interface SecretAuditDoc {
+  _id: string
+  secretKey: string
+  action: string
+  performedAt: Date
+}
+
+export class MongoDBSecretService implements SecretService {
+  private initialized = false
+  private key: string
+  private keyVersion: number
+  private previousKey?: string
+  private audit: boolean
+  private auditReads: boolean
+  private secrets!: Collection<SecretDoc>
+  private secretsAudit!: Collection<SecretAuditDoc>
+
+  constructor(
+    private db: Db,
+    config: MongoDBSecretServiceConfig
+  ) {
+    this.key = config.key
+    this.keyVersion = config.keyVersion ?? 1
+    this.previousKey = config.previousKey
+    this.audit = config.audit ?? false
+    this.auditReads = config.auditReads ?? false
+  }
+
+  public async init(): Promise<void> {
+    if (this.initialized) return
+
+    this.secrets = this.db.collection<SecretDoc>('secrets')
+    this.secretsAudit = this.db.collection<SecretAuditDoc>('secrets_audit')
+
+    await this.secrets.createIndex({ _id: 1 })
+
+    if (this.audit) {
+      await this.secretsAudit.createIndex({ secretKey: 1 })
+    }
+
+    this.initialized = true
+  }
+
+  private async logAudit(
+    secretKey: string,
+    action: 'read' | 'write' | 'delete' | 'rotate'
+  ): Promise<void> {
+    if (!this.audit) return
+    if (action === 'read' && !this.auditReads) return
+
+    await this.secretsAudit.insertOne({
+      _id: crypto.randomUUID(),
+      secretKey,
+      action,
+      performedAt: new Date(),
+    })
+  }
+
+  private getKEK(version: number): string {
+    if (version === this.keyVersion) return this.key
+    if (this.previousKey) return this.previousKey
+    throw new Error(`No KEK available for key_version ${version}`)
+  }
+
+  async getSecret(key: string): Promise<string> {
+    const row = await this.secrets.findOne({ _id: key })
+    if (!row) throw new Error(`Secret not found: ${key}`)
+
+    const kek = this.getKEK(row.keyVersion)
+    const result = await envelopeDecrypt<string>(
+      kek,
+      row.ciphertext,
+      row.wrappedDek
+    )
+    await this.logAudit(key, 'read')
+    return result
+  }
+
+  async getSecretJSON<R = {}>(key: string): Promise<R> {
+    const raw = await this.getSecret(key)
+    return JSON.parse(raw) as R
+  }
+
+  async hasSecret(key: string): Promise<boolean> {
+    const count = await this.secrets.countDocuments({ _id: key }, { limit: 1 })
+    return count > 0
+  }
+
+  async setSecretJSON(key: string, value: unknown): Promise<void> {
+    const plaintext = JSON.stringify(value)
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
+      this.key,
+      plaintext
+    )
+    const now = new Date()
+
+    await this.secrets.updateOne(
+      { _id: key },
+      {
+        $set: {
+          ciphertext,
+          wrappedDek: wrappedDEK,
+          keyVersion: this.keyVersion,
+          updatedAt: now,
+        },
+        $setOnInsert: {
+          _id: key,
+          createdAt: now,
+        },
+      },
+      { upsert: true }
+    )
+
+    await this.logAudit(key, 'write')
+  }
+
+  async deleteSecret(key: string): Promise<void> {
+    await this.secrets.deleteOne({ _id: key })
+    await this.logAudit(key, 'delete')
+  }
+
+  async rotateKEK(): Promise<number> {
+    if (!this.previousKey) {
+      throw new Error('No previousKey configured — nothing to rotate from')
+    }
+
+    const rows = await this.secrets
+      .find({ keyVersion: { $lt: this.keyVersion } })
+      .project({ _id: 1, wrappedDek: 1 })
+      .toArray()
+
+    for (const row of rows) {
+      const newWrappedDEK = await envelopeRewrap(
+        this.previousKey,
+        this.key,
+        row.wrappedDek
+      )
+      await this.secrets.updateOne(
+        { _id: row._id },
+        {
+          $set: {
+            wrappedDek: newWrappedDEK,
+            keyVersion: this.keyVersion,
+            updatedAt: new Date(),
+          },
+        }
+      )
+      await this.logAudit(row._id as string, 'rotate')
+    }
+
+    return rows.length
+  }
+}

package/src/mongodb-services.test.ts

@@ -0,0 +1,149 @@
+import { describe, test, before, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { MongoClient, type Db } from 'mongodb'
+import { MongoMemoryServer } from 'mongodb-memory-server'
+import { defineServiceTests } from '@pikku/core/testing'
+
+import { MongoDBChannelStore } from './mongodb-channel-store.js'
+import { MongoDBEventHubStore } from './mongodb-eventhub-store.js'
+import { MongoDBWorkflowService } from './mongodb-workflow-service.js'
+import { MongoDBWorkflowRunService } from './mongodb-workflow-run-service.js'
+import { MongoDBDeploymentService } from './mongodb-deployment-service.js'
+import { MongoDBAIStorageService } from './mongodb-ai-storage-service.js'
+import { MongoDBAgentRunService } from './mongodb-agent-run-service.js'
+import { MongoDBSecretService } from './mongodb-secret-service.js'
+
+function registerTests(name: string, getDb: () => Db) {
+  defineServiceTests({
+    name,
+    services: {
+      channelStore: async () => {
+        const s = new MongoDBChannelStore(getDb())
+        await s.init()
+        return s
+      },
+      eventHubStore: async () => {
+        const s = new MongoDBEventHubStore(getDb())
+        await s.init()
+        return s
+      },
+      workflowService: async () => {
+        const s = new MongoDBWorkflowService(getDb())
+        await s.init()
+        return s
+      },
+      workflowRunService: async () => new MongoDBWorkflowRunService(getDb()),
+      deploymentService: async () => {
+        const s = new MongoDBDeploymentService(
+          { heartbeatInterval: 60000, heartbeatTtl: 120000 },
+          getDb()
+        )
+        await s.init()
+        return s
+      },
+      aiStorageService: async () => {
+        const s = new MongoDBAIStorageService(getDb())
+        await s.init()
+        return s
+      },
+      agentRunService: async () => new MongoDBAgentRunService(getDb()),
+      secretService: async (config) => {
+        const s = new MongoDBSecretService(getDb(), config)
+        await s.init()
+        return s
+      },
+    },
+  })
+
+  describe(`MongoDBSecretService audit [${name}]`, () => {
+    const kek = 'test-key-encryption-key-32chars!'
+
+    test('audit logs writes, reads, and deletes', async () => {
+      const service = new MongoDBSecretService(getDb(), {
+        key: kek,
+        audit: true,
+        auditReads: true,
+      })
+      await service.init()
+      await service.setSecretJSON('audit-test', 'value')
+      await service.getSecret('audit-test')
+      await service.deleteSecret('audit-test')
+
+      const logs = await getDb()
+        .collection('secrets_audit')
+        .find({ secretKey: 'audit-test' })
+        .sort({ performedAt: 1 })
+        .toArray()
+
+      assert.equal(logs.length, 3)
+      assert.equal(logs[0]!.action, 'write')
+      assert.equal(logs[1]!.action, 'read')
+      assert.equal(logs[2]!.action, 'delete')
+    })
+
+    test('audit skips reads when auditReads is false', async () => {
+      const service = new MongoDBSecretService(getDb(), {
+        key: kek,
+        audit: true,
+        auditReads: false,
+      })
+      await service.init()
+      await service.setSecretJSON('no-read-audit', 'value')
+      await service.getSecret('no-read-audit')
+
+      const logs = await getDb()
+        .collection('secrets_audit')
+        .find({ secretKey: 'no-read-audit' })
+        .toArray()
+
+      assert.equal(logs.length, 1)
+      assert.equal(logs[0]!.action, 'write')
+    })
+  })
+}
+
+describe('MongoDB Services - In-Memory', () => {
+  let mongod: MongoMemoryServer
+  let client: MongoClient
+  let db: Db
+
+  before(async () => {
+    mongod = await MongoMemoryServer.create()
+    const uri = mongod.getUri()
+    client = new MongoClient(uri)
+    await client.connect()
+    db = client.db('pikku_test')
+  })
+
+  after(async () => {
+    await client.close()
+    await mongod.stop()
+  })
+
+  registerTests('MongoMemory', () => db)
+})
+
+describe(
+  'MongoDB Services - Real',
+  {
+    skip: !process.env.MONGODB_URL ? 'MONGODB_URL not set' : undefined,
+  },
+  () => {
+    let client: MongoClient
+    let db: Db
+
+    before(async () => {
+      client = new MongoClient(process.env.MONGODB_URL!)
+      await client.connect()
+      db = client.db('pikku_test')
+      await db.dropDatabase()
+    })
+
+    after(async () => {
+      if (db) await db.dropDatabase()
+      if (client) await client.close()
+    })
+
+    registerTests('Real MongoDB', () => db)
+  }
+)