@pikku/mongodb 0.12.13 → 0.12.14

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @pikku/mongodb
 
+## 0.12.14
+
+### Patch Changes
+
+- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
+  vault secret cannot reach a sink by accident.
+
+  `SecretValue` is nominally typed, which means it is not assignable to `string`
+  (or to any other concretely-typed field). Every sink with a real type — a
+  database column, an email body, a session payload — rejects it with no lint
+  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
+  queue payloads, webhook and email inputs, and a function's own output — are
+  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
+  `T`, however deeply nested, to `never`.
+
+  Unwrap deliberately at the point the secret reaches the wire:
+
+  ```ts
+  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
+  betterAuth({ secret: secret.reveal() })
+  ```
+
+  Two behaviours cover what types cannot see. Structured serialization redacts —
+  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
+  write stays honest without crashing the request. String coercion throws
+  `SecretCoercionError`, because a template literal is always a leak.
+
+  `AuditLog.write` is guarded the same way as the logger, since an audit event
+  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
+  secret landing in one.
+
+  `.reveal()` is the deliberate escape hatch, and what it hands back is an
+  ordinary string as far as every sink signature is concerned. **PKU953** closes
+  that gap: under `pikku all --security` the inspector reports a revealed secret
+  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
+
+  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
+  `unknown` and wrote the result straight into an `Authorization` header.
+
+- Updated dependencies [62ea4cc]
+- Updated dependencies [9dddff8]
+- Updated dependencies [78b29f0]
+  - @pikku/core@0.12.76
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/src/mongodb-secret-service.d.ts

@@ -1,4 +1,5 @@
-import type { SecretService } from '@pikku/core/services';
+import { type SecretValue } from '@pikku/core';
+import type { SecretService, SecretValues } from '@pikku/core/services';
 import type { Db } from 'mongodb';
 export interface MongoDBSecretServiceConfig {
     key: string;
@@ -25,10 +26,10 @@ export declare class MongoDBSecretService implements SecretService {
     private logAudit;
     private getKEKSalt;
     private getKEK;
-    getSecret<T = string>(key: string): Promise<T>;
+    getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<T>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/mongodb-secret-service.js

@@ -1,3 +1,4 @@
+import { createSecretValue, isSecretValue } from '@pikku/core';
 import { deriveKEK, generateKEKSalt, envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
 export class MongoDBSecretService {
     db;
@@ -74,14 +75,16 @@ export class MongoDBSecretService {
         const kek = await this.getKEK(row.keyVersion);
         const result = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
         await this.logAudit(key, 'read');
-        return result;
+        return createSecretValue(result);
     }
     async hasSecret(key) {
         const count = await this.secrets.countDocuments({ _id: key }, { limit: 1 });
         return count > 0;
     }
     async setSecret(key, value) {
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), value);
+        // Encrypting the wrapper would store its redaction, not the secret —
+        // writing a secret back to the vault is exactly what this method is for.
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), isSecretValue(value) ? value.reveal() : value);
         const now = new Date();
         await this.secrets.updateOne({ _id: key }, {
             $set: {
@@ -109,7 +112,7 @@ export class MongoDBSecretService {
         for (const row of rows) {
             try {
                 const kek = await this.getKEK(row.keyVersion);
-                out[row._id] = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
+                out[row._id] = createSecretValue(await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek));
             }
             catch (cause) {
                 throw new Error(`Failed to decrypt secret "${row._id}" (key_version ${row.keyVersion}): ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "description": "MongoDB services for Pikku — workflow state, agent runs, secrets and channel stores",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.74"
+    "@pikku/core": "^0.12.76"
   },
   "dependencies": {
     "mongodb": "^6.12.0"

package/src/mongodb-secret-service.ts

@@ -1,4 +1,5 @@
-import type { SecretService } from '@pikku/core/services'
+import { createSecretValue, isSecretValue, type SecretValue } from '@pikku/core'
+import type { SecretService, SecretValues } from '@pikku/core/services'
 import type { Db, Collection } from 'mongodb'
 import {
   deriveKEK,
@@ -124,14 +125,14 @@ export class MongoDBSecretService implements SecretService {
     return kek
   }
 
-  async getSecret<T = string>(key: string): Promise<T> {
+  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
     const row = await this.secrets.findOne({ _id: key })
     if (!row) throw new Error('Requested secret not found')
 
     const kek = await this.getKEK(row.keyVersion)
     const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
     await this.logAudit(key, 'read')
-    return result
+    return createSecretValue(result)
   }
 
   async hasSecret(key: string): Promise<boolean> {
@@ -140,9 +141,11 @@ export class MongoDBSecretService implements SecretService {
   }
 
   async setSecret(key: string, value: unknown): Promise<void> {
+    // Encrypting the wrapper would store its redaction, not the secret —
+    // writing a secret back to the vault is exactly what this method is for.
     const { ciphertext, wrappedDEK } = await envelopeEncrypt(
       await this.getKEK(this.keyVersion),
-      value
+      isSecretValue(value) ? value.reveal() : value
     )
     const now = new Date()
 
@@ -173,7 +176,7 @@ export class MongoDBSecretService implements SecretService {
 
   async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
     keys: (keyof T & string)[]
-  ): Promise<T> {
+  ): Promise<Partial<SecretValues<T>>> {
     const rows = await this.secrets
       .find({ _id: { $in: keys } } as any)
       .toArray()
@@ -181,10 +184,8 @@ export class MongoDBSecretService implements SecretService {
     for (const row of rows) {
       try {
         const kek = await this.getKEK(row.keyVersion)
-        out[row._id] = await envelopeDecrypt(
-          kek,
-          row.ciphertext,
-          row.wrappedDek
+        out[row._id] = createSecretValue(
+          await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek)
         )
       } catch (cause) {
         throw new Error(
@@ -194,7 +195,7 @@ export class MongoDBSecretService implements SecretService {
         )
       }
     }
-    return out as T
+    return out as Partial<SecretValues<T>>
   }
 
   async rotateKEK(): Promise<number> {

package/src/mongodb-services.test.ts

@@ -171,7 +171,8 @@ function registerTests(name: string, getDb: () => Db) {
         'batch-b': string
       }>(['batch-a', 'batch-b'])
 
-      assert.deepEqual(out, { 'batch-a': { v: 1 }, 'batch-b': 'two' })
+      assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
+      assert.equal(out['batch-b']!.reveal(), 'two')
     })
 
     test('getSecrets omits keys that were never stored', async () => {
@@ -181,7 +182,8 @@ function registerTests(name: string, getDb: () => Db) {
 
       const out = await service.getSecrets(['present', 'never-stored'])
 
-      assert.deepEqual(out, { present: 'here' })
+      assert.deepEqual(Object.keys(out), ['present'])
+      assert.equal(out.present!.reveal(), 'here')
     })
   })
 }