@pikku/redis 0.12.19 → 0.12.21

package/src/redis-secret-service.test.ts

@@ -1,122 +0,0 @@
-import { describe, test, before, after } from 'node:test'
-import assert from 'node:assert/strict'
-import Redis from 'ioredis-mock'
-import { defineServiceTests } from '@pikku/core/testing'
-import { RedisSecretService } from './redis-secret-service.js'
-
-describe('RedisSecretService', () => {
-  let redis: InstanceType<typeof Redis>
-
-  before(() => {
-    redis = new Redis()
-  })
-
-  after(async () => {
-    redis.disconnect()
-  })
-
-  defineServiceTests({
-    name: 'Redis',
-    services: {
-      secretService: async (config) =>
-        new RedisSecretService(redis as any, config),
-    },
-  })
-
-  test('custom keyPrefix isolates secrets', async () => {
-    const prefixRedis = new Redis()
-    const kek = 'test-key-encryption-key-32chars!'
-    const s1 = new RedisSecretService(prefixRedis as any, {
-      key: kek,
-      keyPrefix: 'app1',
-    })
-    const s2 = new RedisSecretService(prefixRedis as any, {
-      key: kek,
-      keyPrefix: 'app2',
-    })
-
-    await s1.setSecret('shared-name', { from: 'app1' })
-    await s2.setSecret('shared-name', { from: 'app2' })
-
-    const r1 = await s1.getSecret<{ from: string }>('shared-name')
-    const r2 = await s2.getSecret<{ from: string }>('shared-name')
-
-    assert.deepEqual(r1.reveal(), { from: 'app1' })
-    assert.deepEqual(r2.reveal(), { from: 'app2' })
-    prefixRedis.disconnect()
-  })
-
-  describe('decryption failures', () => {
-    const kek = 'test-key-encryption-key-32chars!'
-    const otherKek = 'a-totally-different-kek-32chars!'
-
-    test('getSecrets throws naming a secret it cannot decrypt', async () => {
-      const writer = new RedisSecretService(redis as any, { key: kek })
-      await writer.setSecret('undecryptable', { token: 'abc' })
-
-      const reader = new RedisSecretService(redis as any, { key: otherKek })
-
-      await assert.rejects(
-        () => reader.getSecrets(['undecryptable']),
-        (error: Error) => {
-          assert.equal(
-            error.message,
-            'Failed to decrypt secret "undecryptable" (key_version 1): ' +
-              'the configured KEK does not match the key it was wrapped under'
-          )
-          assert.ok(error.cause, 'the underlying crypto failure is preserved')
-          return true
-        }
-      )
-    })
-
-    test('getSecrets throws when no KEK is available for a stored key_version', async () => {
-      const writer = new RedisSecretService(redis as any, {
-        key: kek,
-        keyVersion: 7,
-      })
-      await writer.setSecret('old-version', 'value')
-
-      const reader = new RedisSecretService(redis as any, {
-        key: kek,
-        keyVersion: 8,
-      })
-
-      await assert.rejects(
-        () => reader.getSecrets(['old-version']),
-        (error: Error) => {
-          assert.equal(
-            error.message,
-            'Failed to decrypt secret "old-version" (key_version 7): ' +
-              'the configured KEK does not match the key it was wrapped under'
-          )
-          return true
-        }
-      )
-    })
-
-    test('getSecrets returns every secret when they all decrypt', async () => {
-      const service = new RedisSecretService(redis as any, { key: kek })
-      await service.setSecret('batch-a', { v: 1 })
-      await service.setSecret('batch-b', 'two')
-
-      const out = await service.getSecrets<{
-        'batch-a': { v: number }
-        'batch-b': string
-      }>(['batch-a', 'batch-b'])
-
-      assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
-      assert.equal(out['batch-b']!.reveal(), 'two')
-    })
-
-    test('getSecrets omits keys that were never stored', async () => {
-      const service = new RedisSecretService(redis as any, { key: kek })
-      await service.setSecret('present', 'here')
-
-      const out = await service.getSecrets(['present', 'never-stored'])
-
-      assert.deepEqual(Object.keys(out), ['present'])
-      assert.equal(out.present!.reveal(), 'here')
-    })
-  })
-})

package/src/redis-secret-service.ts

@@ -1,210 +0,0 @@
-import {
-  deriveKEK,
-  envelopeDecrypt,
-  envelopeEncrypt,
-  envelopeRewrap,
-  generateKEKSalt,
-} from '@pikku/core/crypto-utils'
-import { createSecretValue, isSecretValue } from '@pikku/core/classification'
-import type { SecretService, SecretValues } from '@pikku/core/services'
-import type { SecretValue } from '@pikku/core/classification'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export interface RedisSecretServiceConfig {
-  key: string
-  keyVersion?: number
-  previousKey?: string
-  keyPrefix?: string
-}
-
-export class RedisSecretService implements SecretService {
-  private redis: Redis
-  private ownsConnection: boolean
-  private key: string
-  private keyVersion: number
-  private previousKey?: string
-  private keyPrefix: string
-  private kekSalts = new Map<number, string>()
-  private keks = new Map<number, CryptoKey>()
-
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    config: RedisSecretServiceConfig
-  ) {
-    if (
-      typeof connectionOrConfig === 'object' &&
-      'hgetall' in connectionOrConfig &&
-      'hset' in connectionOrConfig
-    ) {
-      this.redis = connectionOrConfig as Redis
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-
-    this.key = config.key
-    this.keyVersion = config.keyVersion ?? 1
-    this.previousKey = config.previousKey
-    this.keyPrefix = config.keyPrefix ?? 'pikku'
-  }
-
-  private secretKey(key: string): string {
-    return `${this.keyPrefix}:secret:${key}`
-  }
-
-  private saltKey(): string {
-    return `${this.keyPrefix}:kek-salt`
-  }
-
-  private async getKEKSalt(version: number): Promise<string> {
-    const cached = this.kekSalts.get(version)
-    if (cached) return cached
-
-    const field = String(version)
-    let salt = await this.redis.hget(this.saltKey(), field)
-    if (!salt) {
-      await this.redis.hsetnx(this.saltKey(), field, generateKEKSalt())
-      salt = await this.redis.hget(this.saltKey(), field)
-      if (!salt) {
-        throw new Error(
-          `Failed to persist a KEK salt for key_version ${version}`
-        )
-      }
-    }
-
-    this.kekSalts.set(version, salt)
-    return salt
-  }
-
-  private async getKEK(version: number): Promise<CryptoKey> {
-    const cached = this.keks.get(version)
-    if (cached) return cached
-
-    const passphrase = version === this.keyVersion ? this.key : this.previousKey
-    if (!passphrase) {
-      throw new Error(`No KEK available for key_version ${version}`)
-    }
-
-    const kek = await deriveKEK(passphrase, await this.getKEKSalt(version))
-    this.keks.set(version, kek)
-    return kek
-  }
-
-  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
-    const data = await this.redis.hgetall(this.secretKey(key))
-    if (!data.ciphertext) throw new Error('Requested secret not found')
-
-    const kek = await this.getKEK(Number(data.key_version))
-    return createSecretValue(
-      await envelopeDecrypt<T>(kek, data.ciphertext!, data.wrapped_dek!)
-    )
-  }
-
-  async hasSecret(key: string): Promise<boolean> {
-    const exists = await this.redis.exists(this.secretKey(key))
-    return exists === 1
-  }
-
-  async setSecret(key: string, value: unknown): Promise<void> {
-    // Encrypting the wrapper would store its redaction, not the secret —
-    // writing a secret back to the vault is exactly what this method is for.
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      await this.getKEK(this.keyVersion),
-      isSecretValue(value) ? value.reveal() : value
-    )
-
-    await this.redis.hset(this.secretKey(key), {
-      ciphertext,
-      wrapped_dek: wrappedDEK,
-      key_version: this.keyVersion.toString(),
-    })
-  }
-
-  async deleteSecret(key: string): Promise<void> {
-    await this.redis.del(this.secretKey(key))
-  }
-
-  async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
-    keys: (keyof T & string)[]
-  ): Promise<Partial<SecretValues<T>>> {
-    const rows = await Promise.all(
-      keys.map(async (key) => ({
-        key,
-        data: await this.redis.hgetall(this.secretKey(key)),
-      }))
-    )
-
-    const out: Record<string, unknown> = {}
-    for (const { key, data } of rows) {
-      if (!data.ciphertext) continue
-
-      const keyVersion = Number(data.key_version)
-      try {
-        const kek = await this.getKEK(keyVersion)
-        out[key] = createSecretValue(
-          await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek!)
-        )
-      } catch (cause) {
-        throw new Error(
-          `Failed to decrypt secret "${key}" (key_version ${keyVersion}): ` +
-            `the configured KEK does not match the key it was wrapped under`,
-          { cause }
-        )
-      }
-    }
-    return out as Partial<SecretValues<T>>
-  }
-
-  async rotateKEK(): Promise<number> {
-    if (!this.previousKey) {
-      throw new Error('No previousKey configured — nothing to rotate from')
-    }
-
-    const oldKEK = await this.getKEK(this.keyVersion - 1)
-    const newKEK = await this.getKEK(this.keyVersion)
-
-    const pattern = `${this.keyPrefix}:secret:*`
-    let cursor = '0'
-    let count = 0
-
-    do {
-      const [nextCursor, keys] = await this.redis.scan(
-        cursor,
-        'MATCH',
-        pattern,
-        'COUNT',
-        100
-      )
-      cursor = nextCursor
-
-      for (const redisKey of keys) {
-        const data = await this.redis.hgetall(redisKey)
-        const version = Number(data.key_version)
-        if (version >= this.keyVersion) continue
-
-        const newWrappedDEK = await envelopeRewrap(
-          oldKEK,
-          newKEK,
-          data.wrapped_dek!
-        )
-        await this.redis.hset(redisKey, {
-          wrapped_dek: newWrappedDEK,
-          key_version: this.keyVersion.toString(),
-        })
-        count++
-      }
-    } while (cursor !== '0')
-
-    return count
-  }
-
-  async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-session-store.ts

@@ -1,71 +0,0 @@
-import type { SessionStore } from '@pikku/core/services'
-import type { CoreUserSession } from '@pikku/core/types'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export class RedisSessionStore implements SessionStore {
-  private redis: Redis
-  private keyPrefix: string
-  private ownsConnection: boolean
-  private ttlSeconds?: number
-
-  /**
-   * @param connectionOrConfig - ioredis Redis instance or RedisOptions config
-   * @param keyPrefix - Redis key prefix (default: 'pikku')
-   * @param ttlSeconds - Optional TTL in seconds for session entries
-   */
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    keyPrefix = 'pikku',
-    ttlSeconds?: number
-  ) {
-    this.keyPrefix = keyPrefix
-    this.ttlSeconds = ttlSeconds
-
-    if (connectionOrConfig instanceof Redis) {
-      this.redis = connectionOrConfig
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-  }
-
-  public async init(): Promise<void> {
-    await this.redis.ping()
-  }
-
-  private sessionKey(pikkuUserId: string): string {
-    return `${this.keyPrefix}:session:${pikkuUserId}`
-  }
-
-  async get(pikkuUserId: string): Promise<CoreUserSession | undefined> {
-    const data = await this.redis.get(this.sessionKey(pikkuUserId))
-    if (!data) {
-      return undefined
-    }
-    return JSON.parse(data) as CoreUserSession
-  }
-
-  async set(pikkuUserId: string, session: CoreUserSession): Promise<void> {
-    const key = this.sessionKey(pikkuUserId)
-    const value = JSON.stringify(session)
-    if (this.ttlSeconds) {
-      await this.redis.set(key, value, 'EX', this.ttlSeconds)
-    } else {
-      await this.redis.set(key, value)
-    }
-  }
-
-  async clear(pikkuUserId: string): Promise<void> {
-    await this.redis.del(this.sessionKey(pikkuUserId))
-  }
-
-  public async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-workflow-run-service.ts

@@ -1,231 +0,0 @@
-import type {
-  WorkflowRun,
-  StepState,
-  WorkflowStatus,
-  WorkflowRunService,
-} from '@pikku/core/workflow'
-import type { Redis } from 'ioredis'
-
-export class RedisWorkflowRunService implements WorkflowRunService {
-  constructor(
-    private redis: Redis,
-    private keyPrefix = 'workflows'
-  ) {}
-
-  private runKey(runId: string): string {
-    return `${this.keyPrefix}:run:${runId}`
-  }
-
-  private stepKeyPattern(runId: string): string {
-    return `${this.keyPrefix}:step:${runId}:*`
-  }
-
-  private stepHistoryKey(stepId: string): string {
-    return `${this.keyPrefix}:step-history:${stepId}`
-  }
-
-  private versionKey(name: string, graphHash: string): string {
-    return `${this.keyPrefix}:version:${name}:${graphHash}`
-  }
-
-  async listRuns(options?: {
-    workflowName?: string
-    status?: string
-    limit?: number
-    offset?: number
-  }): Promise<WorkflowRun[]> {
-    const { workflowName, status, limit = 50, offset = 0 } = options ?? {}
-
-    const runKeys = await this.scanKeys(`${this.keyPrefix}:run:*`)
-
-    const runs: WorkflowRun[] = []
-    for (const key of runKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.id) continue
-
-      if (workflowName && data.workflow !== workflowName) continue
-      if (status && data.status !== status) continue
-
-      runs.push(this.mapRunData(data))
-    }
-
-    runs.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
-
-    return runs.slice(offset, offset + limit)
-  }
-
-  async getRun(id: string): Promise<WorkflowRun | null> {
-    const data = await this.redis.hgetall(this.runKey(id))
-    if (!data.id) return null
-    return this.mapRunData(data)
-  }
-
-  async getRunSteps(
-    runId: string
-  ): Promise<
-    Array<StepState & { stepName: string; rpcName?: string; data?: any }>
-  > {
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(runId))
-
-    const steps: Array<
-      StepState & { stepName: string; rpcName?: string; data?: any }
-    > = []
-
-    for (const key of stepKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.stepId) continue
-
-      steps.push({
-        stepId: data.stepId,
-        stepName: this.extractStepName(key, runId),
-        rpcName: data.rpcName || undefined,
-        data: data.data ? JSON.parse(data.data) : undefined,
-        status: data.status as any,
-        result: data.result ? JSON.parse(data.result) : undefined,
-        error: data.error ? JSON.parse(data.error) : undefined,
-        attemptCount: Number(data.attemptCount || 1),
-        retries: data.retries ? Number(data.retries) : undefined,
-        retryDelay: data.retryDelay || undefined,
-        createdAt: new Date(Number(data.createdAt)),
-        updatedAt: new Date(Number(data.updatedAt)),
-      })
-    }
-
-    steps.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())
-
-    return steps
-  }
-
-  async getRunHistory(
-    runId: string
-  ): Promise<Array<StepState & { stepName: string }>> {
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(runId))
-
-    const allHistoryEntries: Array<StepState & { stepName: string }> = []
-
-    for (const key of stepKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.stepId) continue
-
-      const historyEntries = await this.redis.zrange(
-        this.stepHistoryKey(data.stepId),
-        0,
-        '-1'
-      )
-
-      for (const entryStr of historyEntries) {
-        const entry = JSON.parse(entryStr)
-        allHistoryEntries.push({
-          stepId: entry.stepId,
-          stepName: entry.stepName,
-          status: entry.status,
-          result: entry.result ? JSON.parse(entry.result) : undefined,
-          error: entry.error ? JSON.parse(entry.error) : undefined,
-          attemptCount: entry.attemptCount,
-          retries: entry.retries,
-          retryDelay: entry.retryDelay,
-          createdAt: new Date(entry.createdAt),
-          updatedAt: new Date(entry.createdAt),
-          runningAt: entry.runningAt ? new Date(entry.runningAt) : undefined,
-          scheduledAt: entry.scheduledAt
-            ? new Date(entry.scheduledAt)
-            : undefined,
-          succeededAt: entry.succeededAt
-            ? new Date(entry.succeededAt)
-            : undefined,
-          failedAt: entry.failedAt ? new Date(entry.failedAt) : undefined,
-        })
-      }
-    }
-
-    return allHistoryEntries.sort(
-      (a, b) => a.createdAt.getTime() - b.createdAt.getTime()
-    )
-  }
-
-  async getDistinctWorkflowNames(): Promise<string[]> {
-    const runKeys = await this.scanKeys(`${this.keyPrefix}:run:*`)
-
-    const names = new Set<string>()
-    for (const key of runKeys) {
-      const workflow = await this.redis.hget(key, 'workflow')
-      if (workflow) names.add(workflow)
-    }
-
-    return [...names].sort()
-  }
-
-  async getWorkflowVersion(
-    name: string,
-    graphHash: string
-  ): Promise<{ graph: any; source: string } | null> {
-    const data = await this.redis.hgetall(this.versionKey(name, graphHash))
-    if (!data.graph) return null
-    return {
-      graph: JSON.parse(data.graph),
-      source: data.source!,
-    }
-  }
-
-  async deleteRun(id: string): Promise<boolean> {
-    const exists = await this.redis.exists(this.runKey(id))
-    if (!exists) return false
-
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(id))
-
-    const keysToDelete = [this.runKey(id)]
-
-    for (const stepKey of stepKeys) {
-      const stepId = await this.redis.hget(stepKey, 'stepId')
-      keysToDelete.push(stepKey)
-      if (stepId) {
-        keysToDelete.push(this.stepHistoryKey(stepId))
-      }
-    }
-
-    await this.redis.del(...keysToDelete)
-    return true
-  }
-
-  private mapRunData(data: Record<string, string>): WorkflowRun {
-    return {
-      id: data.id!,
-      workflow: data.workflow!,
-      status: data.status! as WorkflowStatus,
-      input: JSON.parse(data.input!),
-      output: data.output ? JSON.parse(data.output) : undefined,
-      error: data.error ? JSON.parse(data.error) : undefined,
-      inline: data.inline === 'true' ? true : undefined,
-      graphHash: data.graphHash || undefined,
-      deterministic: data.deterministic === 'true' ? true : undefined,
-      plannedSteps: data.plannedSteps
-        ? JSON.parse(data.plannedSteps)
-        : undefined,
-      wire: data.wire ? JSON.parse(data.wire) : { type: 'unknown' },
-      createdAt: new Date(Number(data.createdAt!)),
-      updatedAt: new Date(Number(data.updatedAt!)),
-    }
-  }
-
-  private extractStepName(key: string, runId: string): string {
-    const prefix = `${this.keyPrefix}:step:${runId}:`
-    return key.slice(prefix.length)
-  }
-
-  private async scanKeys(pattern: string): Promise<string[]> {
-    const keys: string[] = []
-    let cursor = '0'
-    do {
-      const [newCursor, foundKeys] = await this.redis.scan(
-        cursor,
-        'MATCH',
-        pattern,
-        'COUNT',
-        100
-      )
-      cursor = newCursor
-      keys.push(...foundKeys)
-    } while (cursor !== '0')
-    return keys
-  }
-}