@pikku/mongodb 0.12.21 → 0.12.23

package/src/mongodb-channel-store.ts

@@ -1,109 +0,0 @@
-import { ChannelStore } from '@pikku/core/channel'
-import type { Channel } from '@pikku/core/channel'
-import type { Db, Collection } from 'mongodb'
-
-interface ChannelDoc {
-  _id: string
-  channelName: string
-  createdAt: Date
-  openingData: any
-  pikkuUserId: string | null
-  state?: unknown
-  lastWire: Date
-}
-
-interface ChannelSubscriptionDoc {
-  channelId: string
-  topic: string
-}
-
-export class MongoDBChannelStore extends ChannelStore {
-  private initialized = false
-  private channels!: Collection<ChannelDoc>
-  private subscriptions!: Collection<ChannelSubscriptionDoc>
-
-  constructor(private db: Db) {
-    super()
-  }
-
-  public async init(): Promise<void> {
-    if (this.initialized) return
-
-    this.channels = this.db.collection<ChannelDoc>('channels')
-    this.subscriptions = this.db.collection<ChannelSubscriptionDoc>(
-      'channel_subscriptions'
-    )
-
-    await this.subscriptions.createIndex(
-      { channelId: 1, topic: 1 },
-      { unique: true }
-    )
-    await this.subscriptions.createIndex({ topic: 1 })
-
-    this.initialized = true
-  }
-
-  public async addChannel({
-    channelId,
-    channelName,
-    openingData,
-  }: Channel): Promise<void> {
-    await this.channels.insertOne({
-      _id: channelId,
-      channelName,
-      openingData: openingData || {},
-      pikkuUserId: null,
-      createdAt: new Date(),
-      lastWire: new Date(),
-    })
-  }
-
-  public async removeChannels(channelIds: string[]): Promise<void> {
-    if (channelIds.length === 0) return
-
-    await this.channels.deleteMany({ _id: { $in: channelIds } })
-    await this.subscriptions.deleteMany({ channelId: { $in: channelIds } })
-  }
-
-  public async setPikkuUserId(
-    channelId: string,
-    pikkuUserId: string | null
-  ): Promise<void> {
-    await this.channels.updateOne({ _id: channelId }, { $set: { pikkuUserId } })
-  }
-
-  public async getChannel(
-    channelId: string
-  ): Promise<Channel & { pikkuUserId?: string }> {
-    const row = await this.channels.findOne({ _id: channelId })
-
-    if (!row) {
-      throw new Error(`Channel not found: ${channelId}`)
-    }
-
-    return {
-      channelId: row._id,
-      channelName: row.channelName,
-      openingData: row.openingData ?? {},
-      pikkuUserId: row.pikkuUserId ?? undefined,
-    }
-  }
-
-  public async setState(channelId: string, state: unknown): Promise<void> {
-    await this.channels.updateOne({ _id: channelId }, { $set: { state } })
-  }
-
-  public async getState(channelId: string): Promise<unknown | undefined> {
-    const row = await this.channels.findOne(
-      { _id: channelId },
-      { projection: { state: 1 } }
-    )
-    return row?.state ?? undefined
-  }
-
-  public async clearState(channelId: string): Promise<void> {
-    await this.channels.updateOne({ _id: channelId }, { $unset: { state: '' } })
-  }
-
-  public async close(): Promise<void> {}
-}

package/src/mongodb-deployment-service.ts

@@ -1,136 +0,0 @@
-import { buildRemoteHeaders } from '@pikku/core/remote'
-import type {
-  DeploymentService,
-  DeploymentServiceConfig,
-  DeploymentConfig,
-} from '@pikku/core/services'
-import type { JWTService } from '@pikku/core/services'
-import type { SecretService } from '@pikku/core/services'
-import { getAllFunctionNames } from '@pikku/core/function'
-import type { Db, Collection } from 'mongodb'
-
-interface DeploymentDoc {
-  _id: string
-  endpoint: string
-  lastHeartbeat: Date
-  createdAt: Date
-  functions: string[]
-}
-
-export class MongoDBDeploymentService implements DeploymentService {
-  private initialized = false
-  private heartbeatTimer?: ReturnType<typeof setInterval>
-  private deploymentConfig?: DeploymentConfig
-  private heartbeatInterval: number
-  private heartbeatTtl: number
-  private deployments!: Collection<DeploymentDoc>
-
-  constructor(
-    config: DeploymentServiceConfig,
-    private db: Db,
-    private jwt?: JWTService,
-    private secrets?: SecretService
-  ) {
-    this.heartbeatInterval = config.heartbeatInterval ?? 10000
-    this.heartbeatTtl = config.heartbeatTtl ?? 30000
-  }
-
-  public async init(): Promise<void> {
-    if (this.initialized) return
-
-    this.deployments = this.db.collection<DeploymentDoc>('pikku_deployments')
-
-    await this.deployments.createIndex({ lastHeartbeat: 1 })
-    await this.deployments.createIndex({ functions: 1 })
-
-    this.initialized = true
-  }
-
-  async start(config: DeploymentConfig): Promise<void> {
-    const functions = config.functions ?? getAllFunctionNames()
-    this.deploymentConfig = { ...config, functions }
-    const now = new Date()
-
-    await this.deployments.updateOne(
-      { _id: config.deploymentId },
-      {
-        $set: {
-          endpoint: config.endpoint,
-          lastHeartbeat: now,
-          functions,
-        },
-        $setOnInsert: {
-          _id: config.deploymentId,
-          createdAt: now,
-        },
-      },
-      { upsert: true }
-    )
-
-    this.heartbeatTimer = setInterval(
-      () => this.sendHeartbeat(),
-      this.heartbeatInterval
-    )
-  }
-
-  async stop(): Promise<void> {
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer)
-      this.heartbeatTimer = undefined
-    }
-
-    if (this.deploymentConfig) {
-      await this.deployments.deleteOne({
-        _id: this.deploymentConfig.deploymentId,
-      })
-    }
-  }
-
-  async invoke(
-    funcName: string,
-    data: unknown,
-    session?: unknown,
-    traceId?: string
-  ): Promise<unknown> {
-    const headers = await buildRemoteHeaders(
-      this.jwt,
-      this.secrets,
-      funcName,
-      session,
-      traceId
-    )
-    const cutoff = new Date(Date.now() - this.heartbeatTtl)
-    const result = await this.deployments.findOne(
-      { functions: funcName, lastHeartbeat: { $gt: cutoff } },
-      { sort: { lastHeartbeat: -1 } }
-    )
-    if (!result) {
-      throw new Error(`No deployment found for function '${funcName}'`)
-    }
-    const url = `${result.endpoint}/remote/rpc/${encodeURIComponent(funcName)}`
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...headers },
-      body: JSON.stringify({ data }),
-    })
-    if (!response.ok) {
-      throw new Error(
-        `Remote RPC call to '${funcName}' failed: ${response.status}`
-      )
-    }
-    return response.json()
-  }
-
-  private async sendHeartbeat(): Promise<void> {
-    if (!this.deploymentConfig) return
-
-    try {
-      await this.deployments.updateOne(
-        { _id: this.deploymentConfig.deploymentId },
-        { $set: { lastHeartbeat: new Date() } }
-      )
-    } catch {
-      // Heartbeat failed, will retry on next interval
-    }
-  }
-}

package/src/mongodb-eventhub-store.ts

@@ -1,52 +0,0 @@
-import { EventHubStore } from '@pikku/core/channel'
-import type { Db, Collection } from 'mongodb'
-
-interface ChannelSubscriptionDoc {
-  channelId: string
-  topic: string
-}
-
-export class MongoDBEventHubStore extends EventHubStore {
-  private initialized = false
-  private subscriptions!: Collection<ChannelSubscriptionDoc>
-
-  constructor(private db: Db) {
-    super()
-  }
-
-  public async init(): Promise<void> {
-    if (this.initialized) return
-    this.subscriptions = this.db.collection<ChannelSubscriptionDoc>(
-      'channel_subscriptions'
-    )
-    this.initialized = true
-  }
-
-  public async getChannelIdsForTopic(topic: string): Promise<string[]> {
-    const result = await this.subscriptions
-      .find({ topic })
-      .project({ channelId: 1 })
-      .toArray()
-    return result.map((row) => row.channelId)
-  }
-
-  public async subscribe(topic: string, channelId: string): Promise<boolean> {
-    try {
-      await this.subscriptions.updateOne(
-        { channelId, topic },
-        { $setOnInsert: { channelId, topic } },
-        { upsert: true }
-      )
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  public async unsubscribe(topic: string, channelId: string): Promise<boolean> {
-    const result = await this.subscriptions.deleteOne({ channelId, topic })
-    return result.deletedCount > 0
-  }
-
-  public async close(): Promise<void> {}
-}

package/src/mongodb-secret-service.ts

@@ -1,232 +0,0 @@
-import {
-  deriveKEK,
-  envelopeDecrypt,
-  envelopeEncrypt,
-  envelopeRewrap,
-  generateKEKSalt,
-} from '@pikku/core/crypto-utils'
-import { createSecretValue, isSecretValue } from '@pikku/core/classification'
-import type { SecretService, SecretValues } from '@pikku/core/services'
-import type { SecretValue } from '@pikku/core/classification'
-import type { Db, Collection } from 'mongodb'
-
-export interface MongoDBSecretServiceConfig {
-  key: string
-  keyVersion?: number
-  previousKey?: string
-  audit?: boolean
-  auditReads?: boolean
-}
-
-interface SecretDoc {
-  _id: string
-  ciphertext: string
-  wrappedDek: string
-  keyVersion: number
-  createdAt: Date
-  updatedAt: Date
-}
-
-interface KekSaltDoc {
-  _id: number
-  salt: string
-  createdAt: Date
-}
-
-interface SecretAuditDoc {
-  _id: string
-  secretKey: string
-  action: string
-  performedAt: Date
-}
-
-export class MongoDBSecretService implements SecretService {
-  private initialized = false
-  private key: string
-  private keyVersion: number
-  private previousKey?: string
-  private audit: boolean
-  private auditReads: boolean
-  private secrets!: Collection<SecretDoc>
-  private secretsAudit!: Collection<SecretAuditDoc>
-  private kekSaltDocs!: Collection<KekSaltDoc>
-  private kekSalts = new Map<number, string>()
-  private keks = new Map<number, CryptoKey>()
-
-  constructor(
-    private db: Db,
-    config: MongoDBSecretServiceConfig
-  ) {
-    this.key = config.key
-    this.keyVersion = config.keyVersion ?? 1
-    this.previousKey = config.previousKey
-    this.audit = config.audit ?? false
-    this.auditReads = config.auditReads ?? false
-  }
-
-  public async init(): Promise<void> {
-    if (this.initialized) return
-
-    this.secrets = this.db.collection<SecretDoc>('secrets')
-    this.secretsAudit = this.db.collection<SecretAuditDoc>('secrets_audit')
-    this.kekSaltDocs = this.db.collection<KekSaltDoc>('secret_kek_salts')
-
-    await this.secrets.createIndex({ _id: 1 })
-
-    if (this.audit) {
-      await this.secretsAudit.createIndex({ secretKey: 1 })
-    }
-
-    this.initialized = true
-  }
-
-  private async logAudit(
-    secretKey: string,
-    action: 'read' | 'write' | 'delete' | 'rotate'
-  ): Promise<void> {
-    if (!this.audit) return
-    if (action === 'read' && !this.auditReads) return
-
-    await this.secretsAudit.insertOne({
-      _id: crypto.randomUUID(),
-      secretKey,
-      action,
-      performedAt: new Date(),
-    })
-  }
-
-  private async getKEKSalt(version: number): Promise<string> {
-    const cached = this.kekSalts.get(version)
-    if (cached) return cached
-
-    const doc = await this.kekSaltDocs.findOneAndUpdate(
-      { _id: version },
-      { $setOnInsert: { salt: generateKEKSalt(), createdAt: new Date() } },
-      { upsert: true, returnDocument: 'after' }
-    )
-    if (!doc?.salt) {
-      throw new Error(`Failed to persist a KEK salt for key_version ${version}`)
-    }
-
-    this.kekSalts.set(version, doc.salt)
-    return doc.salt
-  }
-
-  private async getKEK(version: number): Promise<CryptoKey> {
-    const cached = this.keks.get(version)
-    if (cached) return cached
-
-    const passphrase = version === this.keyVersion ? this.key : this.previousKey
-    if (!passphrase) {
-      throw new Error(`No KEK available for key_version ${version}`)
-    }
-
-    const kek = await deriveKEK(passphrase, await this.getKEKSalt(version))
-    this.keks.set(version, kek)
-    return kek
-  }
-
-  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
-    const row = await this.secrets.findOne({ _id: key })
-    if (!row) throw new Error(`Requested secret not found: ${key}`)
-
-    const kek = await this.getKEK(row.keyVersion)
-    const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
-    await this.logAudit(key, 'read')
-    return createSecretValue(result)
-  }
-
-  async hasSecret(key: string): Promise<boolean> {
-    const count = await this.secrets.countDocuments({ _id: key }, { limit: 1 })
-    return count > 0
-  }
-
-  async setSecret(key: string, value: unknown): Promise<void> {
-    // Encrypting the wrapper would store its redaction, not the secret —
-    // writing a secret back to the vault is exactly what this method is for.
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      await this.getKEK(this.keyVersion),
-      isSecretValue(value) ? value.reveal() : value
-    )
-    const now = new Date()
-
-    await this.secrets.updateOne(
-      { _id: key },
-      {
-        $set: {
-          ciphertext,
-          wrappedDek: wrappedDEK,
-          keyVersion: this.keyVersion,
-          updatedAt: now,
-        },
-        $setOnInsert: {
-          _id: key,
-          createdAt: now,
-        },
-      },
-      { upsert: true }
-    )
-
-    await this.logAudit(key, 'write')
-  }
-
-  async deleteSecret(key: string): Promise<void> {
-    await this.secrets.deleteOne({ _id: key })
-    await this.logAudit(key, 'delete')
-  }
-
-  async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
-    keys: (keyof T & string)[]
-  ): Promise<Partial<SecretValues<T>>> {
-    const rows = await this.secrets
-      .find({ _id: { $in: keys } } as any)
-      .toArray()
-    const out: Record<string, unknown> = {}
-    for (const row of rows) {
-      try {
-        const kek = await this.getKEK(row.keyVersion)
-        out[row._id] = createSecretValue(
-          await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek)
-        )
-      } catch (cause) {
-        throw new Error(
-          `Failed to decrypt secret "${row._id}" (key_version ${row.keyVersion}): ` +
-            `the configured KEK does not match the key it was wrapped under`,
-          { cause }
-        )
-      }
-    }
-    return out as Partial<SecretValues<T>>
-  }
-
-  async rotateKEK(): Promise<number> {
-    if (!this.previousKey) {
-      throw new Error('No previousKey configured — nothing to rotate from')
-    }
-
-    const rows = await this.secrets
-      .find({ keyVersion: { $lt: this.keyVersion } })
-      .project({ _id: 1, wrappedDek: 1 })
-      .toArray()
-
-    const oldKEK = await this.getKEK(this.keyVersion - 1)
-    const newKEK = await this.getKEK(this.keyVersion)
-
-    for (const row of rows) {
-      const newWrappedDEK = await envelopeRewrap(oldKEK, newKEK, row.wrappedDek)
-      await this.secrets.updateOne(
-        { _id: row._id },
-        {
-          $set: {
-            wrappedDek: newWrappedDEK,
-            keyVersion: this.keyVersion,
-            updatedAt: new Date(),
-          },
-        }
-      )
-      await this.logAudit(row._id as string, 'rotate')
-    }
-
-    return rows.length
-  }
-}