@pikku/redis 0.12.20 → 0.12.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/dist/src/redis-agent-run-service.js.map +1 -1
- package/dist/src/redis-deployment-service.js.map +1 -1
- package/dist/src/redis-workflow-run-service.js.map +1 -1
- package/dist/src/redis-workflow-service.js.map +1 -1
- package/package.json +10 -6
- package/run-tests.sh +59 -24
- package/dist/tsconfig.tsbuildinfo +0 -1
- package/src/index.ts +0 -10
- package/src/redis-agent-run-service.ts +0 -207
- package/src/redis-channel-store.ts +0 -158
- package/src/redis-deployment-service.ts +0 -171
- package/src/redis-eventhub-store.ts +0 -104
- package/src/redis-secret-service.test.ts +0 -122
- package/src/redis-secret-service.ts +0 -210
- package/src/redis-session-store.ts +0 -71
- package/src/redis-workflow-run-service.ts +0 -231
- package/src/redis-workflow-service.test.ts +0 -115
- package/src/redis-workflow-service.ts +0 -1025
- package/tsconfig.json +0 -17
|
@@ -1,158 +0,0 @@
|
|
|
1
|
-
import { ChannelStore } from '@pikku/core/channel'
|
|
2
|
-
import type { Channel } from '@pikku/core/channel'
|
|
3
|
-
import { Redis, type RedisOptions } from 'ioredis'
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* Redis-based implementation of ChannelStore
|
|
7
|
-
*
|
|
8
|
-
* Stores channel state in Redis with configurable key prefix.
|
|
9
|
-
*
|
|
10
|
-
* @example
|
|
11
|
-
* ```typescript
|
|
12
|
-
* const redis = new Redis({ host: 'localhost', port: 6379 })
|
|
13
|
-
* const store = new RedisChannelStore(redis, 'myapp')
|
|
14
|
-
* ```
|
|
15
|
-
*/
|
|
16
|
-
export class RedisChannelStore extends ChannelStore {
|
|
17
|
-
private redis: Redis
|
|
18
|
-
private keyPrefix: string
|
|
19
|
-
private ownsConnection: boolean
|
|
20
|
-
|
|
21
|
-
/**
|
|
22
|
-
* @param connectionOrConfig - ioredis Redis instance or RedisOptions config
|
|
23
|
-
* @param keyPrefix - Redis key prefix (default: 'pikku')
|
|
24
|
-
*/
|
|
25
|
-
constructor(
|
|
26
|
-
connectionOrConfig: Redis | RedisOptions | string,
|
|
27
|
-
keyPrefix = 'pikku'
|
|
28
|
-
) {
|
|
29
|
-
super()
|
|
30
|
-
this.keyPrefix = keyPrefix
|
|
31
|
-
|
|
32
|
-
// Check if it's a Redis instance or config options
|
|
33
|
-
if (connectionOrConfig instanceof Redis) {
|
|
34
|
-
this.redis = connectionOrConfig
|
|
35
|
-
this.ownsConnection = false
|
|
36
|
-
} else if (typeof connectionOrConfig === 'string') {
|
|
37
|
-
// It's a connection string
|
|
38
|
-
this.redis = new Redis(connectionOrConfig)
|
|
39
|
-
this.ownsConnection = true
|
|
40
|
-
} else {
|
|
41
|
-
// It's a config object
|
|
42
|
-
this.redis = new Redis(connectionOrConfig)
|
|
43
|
-
this.ownsConnection = true
|
|
44
|
-
}
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
/**
|
|
48
|
-
* Initialize the store (no-op for Redis, always ready)
|
|
49
|
-
*/
|
|
50
|
-
public async init(): Promise<void> {
|
|
51
|
-
// Redis doesn't require schema initialization
|
|
52
|
-
// Just verify connection works
|
|
53
|
-
await this.redis.ping()
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
private channelKey(channelId: string): string {
|
|
57
|
-
return `${this.keyPrefix}:channel:${channelId}`
|
|
58
|
-
}
|
|
59
|
-
|
|
60
|
-
public async addChannel({
|
|
61
|
-
channelId,
|
|
62
|
-
channelName,
|
|
63
|
-
openingData,
|
|
64
|
-
}: Channel): Promise<void> {
|
|
65
|
-
const key = this.channelKey(channelId)
|
|
66
|
-
|
|
67
|
-
await this.redis.hmset(
|
|
68
|
-
key,
|
|
69
|
-
'channelId',
|
|
70
|
-
channelId,
|
|
71
|
-
'channelName',
|
|
72
|
-
channelName,
|
|
73
|
-
'openingData',
|
|
74
|
-
JSON.stringify(openingData || {}),
|
|
75
|
-
'createdAt',
|
|
76
|
-
Date.now().toString()
|
|
77
|
-
)
|
|
78
|
-
}
|
|
79
|
-
|
|
80
|
-
public async removeChannels(channelIds: string[]): Promise<void> {
|
|
81
|
-
if (channelIds.length === 0) {
|
|
82
|
-
return
|
|
83
|
-
}
|
|
84
|
-
|
|
85
|
-
const pipeline = this.redis.pipeline()
|
|
86
|
-
|
|
87
|
-
for (const channelId of channelIds) {
|
|
88
|
-
const key = this.channelKey(channelId)
|
|
89
|
-
pipeline.del(key)
|
|
90
|
-
// Also remove from subscriptions
|
|
91
|
-
pipeline.del(`${this.keyPrefix}:subs:${channelId}`)
|
|
92
|
-
}
|
|
93
|
-
|
|
94
|
-
await pipeline.exec()
|
|
95
|
-
}
|
|
96
|
-
|
|
97
|
-
public async setPikkuUserId(
|
|
98
|
-
channelId: string,
|
|
99
|
-
pikkuUserId: string | null
|
|
100
|
-
): Promise<void> {
|
|
101
|
-
const key = this.channelKey(channelId)
|
|
102
|
-
|
|
103
|
-
if (pikkuUserId) {
|
|
104
|
-
await this.redis.hset(key, 'pikkuUserId', pikkuUserId)
|
|
105
|
-
} else {
|
|
106
|
-
await this.redis.hdel(key, 'pikkuUserId')
|
|
107
|
-
}
|
|
108
|
-
}
|
|
109
|
-
|
|
110
|
-
public async getChannel(
|
|
111
|
-
channelId: string
|
|
112
|
-
): Promise<Channel & { pikkuUserId?: string }> {
|
|
113
|
-
const key = this.channelKey(channelId)
|
|
114
|
-
const data = await this.redis.hgetall(key)
|
|
115
|
-
|
|
116
|
-
if (!data.channelId) {
|
|
117
|
-
throw new Error(`Channel not found: ${channelId}`)
|
|
118
|
-
}
|
|
119
|
-
|
|
120
|
-
return {
|
|
121
|
-
channelId: data.channelId!,
|
|
122
|
-
channelName: data.channelName!,
|
|
123
|
-
openingData: data.openingData ? JSON.parse(data.openingData) : {},
|
|
124
|
-
pikkuUserId: data.pikkuUserId || undefined,
|
|
125
|
-
}
|
|
126
|
-
}
|
|
127
|
-
|
|
128
|
-
public async setState(channelId: string, state: unknown): Promise<void> {
|
|
129
|
-
const key = this.channelKey(channelId)
|
|
130
|
-
await this.redis.hset(key, 'state', JSON.stringify(state ?? null))
|
|
131
|
-
}
|
|
132
|
-
|
|
133
|
-
public async getState(channelId: string): Promise<unknown | undefined> {
|
|
134
|
-
const key = this.channelKey(channelId)
|
|
135
|
-
const raw = await this.redis.hget(key, 'state')
|
|
136
|
-
if (!raw) return undefined
|
|
137
|
-
try {
|
|
138
|
-
const parsed = JSON.parse(raw)
|
|
139
|
-
return parsed ?? undefined
|
|
140
|
-
} catch {
|
|
141
|
-
return undefined
|
|
142
|
-
}
|
|
143
|
-
}
|
|
144
|
-
|
|
145
|
-
public async clearState(channelId: string): Promise<void> {
|
|
146
|
-
const key = this.channelKey(channelId)
|
|
147
|
-
await this.redis.hdel(key, 'state')
|
|
148
|
-
}
|
|
149
|
-
|
|
150
|
-
/**
|
|
151
|
-
* Close the Redis connection if owned by this store
|
|
152
|
-
*/
|
|
153
|
-
public async close(): Promise<void> {
|
|
154
|
-
if (this.ownsConnection) {
|
|
155
|
-
await this.redis.quit()
|
|
156
|
-
}
|
|
157
|
-
}
|
|
158
|
-
}
|
|
@@ -1,171 +0,0 @@
|
|
|
1
|
-
import { buildRemoteHeaders } from '@pikku/core/remote'
|
|
2
|
-
import type {
|
|
3
|
-
DeploymentService,
|
|
4
|
-
DeploymentServiceConfig,
|
|
5
|
-
DeploymentConfig,
|
|
6
|
-
} from '@pikku/core/services'
|
|
7
|
-
import type { JWTService } from '@pikku/core/services'
|
|
8
|
-
import type { SecretService } from '@pikku/core/services'
|
|
9
|
-
import { getAllFunctionNames } from '@pikku/core/function'
|
|
10
|
-
import { Redis, type RedisOptions } from 'ioredis'
|
|
11
|
-
|
|
12
|
-
export class RedisDeploymentService implements DeploymentService {
|
|
13
|
-
private redis: Redis
|
|
14
|
-
private keyPrefix: string
|
|
15
|
-
private ownsConnection: boolean
|
|
16
|
-
private heartbeatTimer?: ReturnType<typeof setInterval>
|
|
17
|
-
private deploymentConfig?: DeploymentConfig
|
|
18
|
-
private heartbeatInterval: number
|
|
19
|
-
private heartbeatTtl: number
|
|
20
|
-
|
|
21
|
-
constructor(
|
|
22
|
-
config: DeploymentServiceConfig,
|
|
23
|
-
connectionOrConfig: Redis | RedisOptions | string,
|
|
24
|
-
keyPrefix = 'pikku',
|
|
25
|
-
private jwt?: JWTService,
|
|
26
|
-
private secrets?: SecretService
|
|
27
|
-
) {
|
|
28
|
-
this.heartbeatInterval = config.heartbeatInterval ?? 10000
|
|
29
|
-
this.heartbeatTtl = config.heartbeatTtl ?? 30000
|
|
30
|
-
this.keyPrefix = keyPrefix
|
|
31
|
-
|
|
32
|
-
if (connectionOrConfig instanceof Redis) {
|
|
33
|
-
this.redis = connectionOrConfig
|
|
34
|
-
this.ownsConnection = false
|
|
35
|
-
} else if (typeof connectionOrConfig === 'string') {
|
|
36
|
-
this.redis = new Redis(connectionOrConfig)
|
|
37
|
-
this.ownsConnection = true
|
|
38
|
-
} else {
|
|
39
|
-
this.redis = new Redis(connectionOrConfig)
|
|
40
|
-
this.ownsConnection = true
|
|
41
|
-
}
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
private deploymentKey(deploymentId: string): string {
|
|
45
|
-
return `${this.keyPrefix}:deployment:${deploymentId}`
|
|
46
|
-
}
|
|
47
|
-
|
|
48
|
-
private functionsIndexKey(funcName: string): string {
|
|
49
|
-
return `${this.keyPrefix}:fn:${funcName}`
|
|
50
|
-
}
|
|
51
|
-
|
|
52
|
-
public async init(): Promise<void> {}
|
|
53
|
-
|
|
54
|
-
async start(config: DeploymentConfig): Promise<void> {
|
|
55
|
-
const functions = config.functions ?? getAllFunctionNames()
|
|
56
|
-
this.deploymentConfig = { ...config, functions }
|
|
57
|
-
const ttlSeconds = Math.ceil(this.heartbeatTtl / 1000)
|
|
58
|
-
const expiryScore = Date.now() + this.heartbeatTtl
|
|
59
|
-
|
|
60
|
-
const pipeline = this.redis.pipeline()
|
|
61
|
-
|
|
62
|
-
pipeline.hset(this.deploymentKey(config.deploymentId), {
|
|
63
|
-
endpoint: config.endpoint,
|
|
64
|
-
functions: JSON.stringify(functions),
|
|
65
|
-
})
|
|
66
|
-
pipeline.expire(this.deploymentKey(config.deploymentId), ttlSeconds)
|
|
67
|
-
|
|
68
|
-
for (const fn of functions) {
|
|
69
|
-
pipeline.zadd(
|
|
70
|
-
this.functionsIndexKey(fn),
|
|
71
|
-
expiryScore,
|
|
72
|
-
config.deploymentId
|
|
73
|
-
)
|
|
74
|
-
}
|
|
75
|
-
|
|
76
|
-
await pipeline.exec()
|
|
77
|
-
|
|
78
|
-
this.heartbeatTimer = setInterval(
|
|
79
|
-
() => this.sendHeartbeat(),
|
|
80
|
-
this.heartbeatInterval
|
|
81
|
-
)
|
|
82
|
-
}
|
|
83
|
-
|
|
84
|
-
async stop(): Promise<void> {
|
|
85
|
-
if (this.heartbeatTimer) {
|
|
86
|
-
clearInterval(this.heartbeatTimer)
|
|
87
|
-
this.heartbeatTimer = undefined
|
|
88
|
-
}
|
|
89
|
-
|
|
90
|
-
if (this.deploymentConfig) {
|
|
91
|
-
const { deploymentId, functions } = this.deploymentConfig
|
|
92
|
-
const pipeline = this.redis.pipeline()
|
|
93
|
-
|
|
94
|
-
pipeline.del(this.deploymentKey(deploymentId))
|
|
95
|
-
for (const fn of functions!) {
|
|
96
|
-
pipeline.zrem(this.functionsIndexKey(fn), deploymentId)
|
|
97
|
-
}
|
|
98
|
-
|
|
99
|
-
await pipeline.exec()
|
|
100
|
-
}
|
|
101
|
-
|
|
102
|
-
if (this.ownsConnection) {
|
|
103
|
-
await this.redis.quit()
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
|
|
107
|
-
async invoke(
|
|
108
|
-
funcName: string,
|
|
109
|
-
data: unknown,
|
|
110
|
-
session?: unknown,
|
|
111
|
-
traceId?: string
|
|
112
|
-
): Promise<unknown> {
|
|
113
|
-
const headers = await buildRemoteHeaders(
|
|
114
|
-
this.jwt,
|
|
115
|
-
this.secrets,
|
|
116
|
-
funcName,
|
|
117
|
-
session,
|
|
118
|
-
traceId
|
|
119
|
-
)
|
|
120
|
-
const indexKey = this.functionsIndexKey(funcName)
|
|
121
|
-
const now = Date.now()
|
|
122
|
-
|
|
123
|
-
await this.redis.zremrangebyscore(indexKey, '-inf', now)
|
|
124
|
-
const deploymentIds = await this.redis.zrangebyscore(indexKey, now, '+inf')
|
|
125
|
-
|
|
126
|
-
let endpoint: string | null = null
|
|
127
|
-
for (const deploymentId of deploymentIds) {
|
|
128
|
-
endpoint = await this.redis.hget(
|
|
129
|
-
this.deploymentKey(deploymentId),
|
|
130
|
-
'endpoint'
|
|
131
|
-
)
|
|
132
|
-
if (endpoint) break
|
|
133
|
-
}
|
|
134
|
-
|
|
135
|
-
if (!endpoint) {
|
|
136
|
-
throw new Error(`No deployment found for function '${funcName}'`)
|
|
137
|
-
}
|
|
138
|
-
|
|
139
|
-
const url = `${endpoint}/remote/rpc/${encodeURIComponent(funcName)}`
|
|
140
|
-
const response = await fetch(url, {
|
|
141
|
-
method: 'POST',
|
|
142
|
-
headers,
|
|
143
|
-
body: JSON.stringify({ data }),
|
|
144
|
-
})
|
|
145
|
-
if (!response.ok) {
|
|
146
|
-
throw new Error(
|
|
147
|
-
`Remote RPC call to '${funcName}' failed: ${response.status}`
|
|
148
|
-
)
|
|
149
|
-
}
|
|
150
|
-
return response.json()
|
|
151
|
-
}
|
|
152
|
-
|
|
153
|
-
private async sendHeartbeat(): Promise<void> {
|
|
154
|
-
if (!this.deploymentConfig) return
|
|
155
|
-
|
|
156
|
-
const { deploymentId, functions } = this.deploymentConfig
|
|
157
|
-
const ttlSeconds = Math.ceil(this.heartbeatTtl / 1000)
|
|
158
|
-
const expiryScore = Date.now() + this.heartbeatTtl
|
|
159
|
-
|
|
160
|
-
try {
|
|
161
|
-
const pipeline = this.redis.pipeline()
|
|
162
|
-
pipeline.expire(this.deploymentKey(deploymentId), ttlSeconds)
|
|
163
|
-
for (const fn of functions!) {
|
|
164
|
-
pipeline.zadd(this.functionsIndexKey(fn), expiryScore, deploymentId)
|
|
165
|
-
}
|
|
166
|
-
await pipeline.exec()
|
|
167
|
-
} catch {
|
|
168
|
-
// Heartbeat failed, will retry on next interval
|
|
169
|
-
}
|
|
170
|
-
}
|
|
171
|
-
}
|
|
@@ -1,104 +0,0 @@
|
|
|
1
|
-
import type { EventHubStore } from '@pikku/core/channel'
|
|
2
|
-
import { Redis, type RedisOptions } from 'ioredis'
|
|
3
|
-
|
|
4
|
-
/**
|
|
5
|
-
* Redis-based implementation of EventHubStore
|
|
6
|
-
*
|
|
7
|
-
* Manages pub/sub topic subscriptions for channels in Redis.
|
|
8
|
-
*
|
|
9
|
-
* @example
|
|
10
|
-
* ```typescript
|
|
11
|
-
* const redis = new Redis({ host: 'localhost', port: 6379 })
|
|
12
|
-
* const store = new RedisEventHubStore(redis, 'myapp')
|
|
13
|
-
* await store.subscribe('user.123', channelId)
|
|
14
|
-
* ```
|
|
15
|
-
*/
|
|
16
|
-
export class RedisEventHubStore implements EventHubStore {
|
|
17
|
-
private redis: Redis
|
|
18
|
-
private keyPrefix: string
|
|
19
|
-
private ownsConnection: boolean
|
|
20
|
-
|
|
21
|
-
/**
|
|
22
|
-
* @param connectionOrConfig - ioredis Redis instance or RedisOptions config
|
|
23
|
-
* @param keyPrefix - Redis key prefix (default: 'pikku')
|
|
24
|
-
*/
|
|
25
|
-
constructor(
|
|
26
|
-
connectionOrConfig: Redis | RedisOptions | string,
|
|
27
|
-
keyPrefix = 'pikku'
|
|
28
|
-
) {
|
|
29
|
-
this.keyPrefix = keyPrefix
|
|
30
|
-
|
|
31
|
-
// Check if it's a Redis instance or config options
|
|
32
|
-
if (connectionOrConfig instanceof Redis) {
|
|
33
|
-
this.redis = connectionOrConfig
|
|
34
|
-
this.ownsConnection = false
|
|
35
|
-
} else if (typeof connectionOrConfig === 'string') {
|
|
36
|
-
// It's a connection string
|
|
37
|
-
this.redis = new Redis(connectionOrConfig)
|
|
38
|
-
this.ownsConnection = true
|
|
39
|
-
} else {
|
|
40
|
-
// It's a config object
|
|
41
|
-
this.redis = new Redis(connectionOrConfig)
|
|
42
|
-
this.ownsConnection = true
|
|
43
|
-
}
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
/**
|
|
47
|
-
* Initialize the store (no-op for Redis, always ready)
|
|
48
|
-
*/
|
|
49
|
-
public async init(): Promise<void> {
|
|
50
|
-
// Redis doesn't require schema initialization
|
|
51
|
-
await this.redis.ping()
|
|
52
|
-
}
|
|
53
|
-
|
|
54
|
-
private topicKey(topic: string): string {
|
|
55
|
-
return `${this.keyPrefix}:topic:${topic}`
|
|
56
|
-
}
|
|
57
|
-
|
|
58
|
-
private channelSubsKey(channelId: string): string {
|
|
59
|
-
return `${this.keyPrefix}:subs:${channelId}`
|
|
60
|
-
}
|
|
61
|
-
|
|
62
|
-
public async getChannelIdsForTopic(topic: string): Promise<string[]> {
|
|
63
|
-
const key = this.topicKey(topic)
|
|
64
|
-
return await this.redis.smembers(key)
|
|
65
|
-
}
|
|
66
|
-
|
|
67
|
-
public async subscribe(topic: string, channelId: string): Promise<boolean> {
|
|
68
|
-
const topicKey = this.topicKey(topic)
|
|
69
|
-
const subsKey = this.channelSubsKey(channelId)
|
|
70
|
-
|
|
71
|
-
// Add channelId to topic set and topic to channel's subscription set
|
|
72
|
-
const pipeline = this.redis.pipeline()
|
|
73
|
-
pipeline.sadd(topicKey, channelId)
|
|
74
|
-
pipeline.sadd(subsKey, topic)
|
|
75
|
-
|
|
76
|
-
await pipeline.exec()
|
|
77
|
-
|
|
78
|
-
return true
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
public async unsubscribe(topic: string, channelId: string): Promise<boolean> {
|
|
82
|
-
const topicKey = this.topicKey(topic)
|
|
83
|
-
const subsKey = this.channelSubsKey(channelId)
|
|
84
|
-
|
|
85
|
-
// Remove channelId from topic set and topic from channel's subscription set
|
|
86
|
-
const pipeline = this.redis.pipeline()
|
|
87
|
-
pipeline.srem(topicKey, channelId)
|
|
88
|
-
pipeline.srem(subsKey, topic)
|
|
89
|
-
|
|
90
|
-
const results = await pipeline.exec()
|
|
91
|
-
|
|
92
|
-
// Check if the channel was actually in the topic set
|
|
93
|
-
return (results![0]![1] as number) > 0
|
|
94
|
-
}
|
|
95
|
-
|
|
96
|
-
/**
|
|
97
|
-
* Close the Redis connection if owned by this store
|
|
98
|
-
*/
|
|
99
|
-
public async close(): Promise<void> {
|
|
100
|
-
if (this.ownsConnection) {
|
|
101
|
-
await this.redis.quit()
|
|
102
|
-
}
|
|
103
|
-
}
|
|
104
|
-
}
|
|
@@ -1,122 +0,0 @@
|
|
|
1
|
-
import { describe, test, before, after } from 'node:test'
|
|
2
|
-
import assert from 'node:assert/strict'
|
|
3
|
-
import Redis from 'ioredis-mock'
|
|
4
|
-
import { defineServiceTests } from '@pikku/core/testing'
|
|
5
|
-
import { RedisSecretService } from './redis-secret-service.js'
|
|
6
|
-
|
|
7
|
-
describe('RedisSecretService', () => {
|
|
8
|
-
let redis: InstanceType<typeof Redis>
|
|
9
|
-
|
|
10
|
-
before(() => {
|
|
11
|
-
redis = new Redis()
|
|
12
|
-
})
|
|
13
|
-
|
|
14
|
-
after(async () => {
|
|
15
|
-
redis.disconnect()
|
|
16
|
-
})
|
|
17
|
-
|
|
18
|
-
defineServiceTests({
|
|
19
|
-
name: 'Redis',
|
|
20
|
-
services: {
|
|
21
|
-
secretService: async (config) =>
|
|
22
|
-
new RedisSecretService(redis as any, config),
|
|
23
|
-
},
|
|
24
|
-
})
|
|
25
|
-
|
|
26
|
-
test('custom keyPrefix isolates secrets', async () => {
|
|
27
|
-
const prefixRedis = new Redis()
|
|
28
|
-
const kek = 'test-key-encryption-key-32chars!'
|
|
29
|
-
const s1 = new RedisSecretService(prefixRedis as any, {
|
|
30
|
-
key: kek,
|
|
31
|
-
keyPrefix: 'app1',
|
|
32
|
-
})
|
|
33
|
-
const s2 = new RedisSecretService(prefixRedis as any, {
|
|
34
|
-
key: kek,
|
|
35
|
-
keyPrefix: 'app2',
|
|
36
|
-
})
|
|
37
|
-
|
|
38
|
-
await s1.setSecret('shared-name', { from: 'app1' })
|
|
39
|
-
await s2.setSecret('shared-name', { from: 'app2' })
|
|
40
|
-
|
|
41
|
-
const r1 = await s1.getSecret<{ from: string }>('shared-name')
|
|
42
|
-
const r2 = await s2.getSecret<{ from: string }>('shared-name')
|
|
43
|
-
|
|
44
|
-
assert.deepEqual(r1.reveal(), { from: 'app1' })
|
|
45
|
-
assert.deepEqual(r2.reveal(), { from: 'app2' })
|
|
46
|
-
prefixRedis.disconnect()
|
|
47
|
-
})
|
|
48
|
-
|
|
49
|
-
describe('decryption failures', () => {
|
|
50
|
-
const kek = 'test-key-encryption-key-32chars!'
|
|
51
|
-
const otherKek = 'a-totally-different-kek-32chars!'
|
|
52
|
-
|
|
53
|
-
test('getSecrets throws naming a secret it cannot decrypt', async () => {
|
|
54
|
-
const writer = new RedisSecretService(redis as any, { key: kek })
|
|
55
|
-
await writer.setSecret('undecryptable', { token: 'abc' })
|
|
56
|
-
|
|
57
|
-
const reader = new RedisSecretService(redis as any, { key: otherKek })
|
|
58
|
-
|
|
59
|
-
await assert.rejects(
|
|
60
|
-
() => reader.getSecrets(['undecryptable']),
|
|
61
|
-
(error: Error) => {
|
|
62
|
-
assert.equal(
|
|
63
|
-
error.message,
|
|
64
|
-
'Failed to decrypt secret "undecryptable" (key_version 1): ' +
|
|
65
|
-
'the configured KEK does not match the key it was wrapped under'
|
|
66
|
-
)
|
|
67
|
-
assert.ok(error.cause, 'the underlying crypto failure is preserved')
|
|
68
|
-
return true
|
|
69
|
-
}
|
|
70
|
-
)
|
|
71
|
-
})
|
|
72
|
-
|
|
73
|
-
test('getSecrets throws when no KEK is available for a stored key_version', async () => {
|
|
74
|
-
const writer = new RedisSecretService(redis as any, {
|
|
75
|
-
key: kek,
|
|
76
|
-
keyVersion: 7,
|
|
77
|
-
})
|
|
78
|
-
await writer.setSecret('old-version', 'value')
|
|
79
|
-
|
|
80
|
-
const reader = new RedisSecretService(redis as any, {
|
|
81
|
-
key: kek,
|
|
82
|
-
keyVersion: 8,
|
|
83
|
-
})
|
|
84
|
-
|
|
85
|
-
await assert.rejects(
|
|
86
|
-
() => reader.getSecrets(['old-version']),
|
|
87
|
-
(error: Error) => {
|
|
88
|
-
assert.equal(
|
|
89
|
-
error.message,
|
|
90
|
-
'Failed to decrypt secret "old-version" (key_version 7): ' +
|
|
91
|
-
'the configured KEK does not match the key it was wrapped under'
|
|
92
|
-
)
|
|
93
|
-
return true
|
|
94
|
-
}
|
|
95
|
-
)
|
|
96
|
-
})
|
|
97
|
-
|
|
98
|
-
test('getSecrets returns every secret when they all decrypt', async () => {
|
|
99
|
-
const service = new RedisSecretService(redis as any, { key: kek })
|
|
100
|
-
await service.setSecret('batch-a', { v: 1 })
|
|
101
|
-
await service.setSecret('batch-b', 'two')
|
|
102
|
-
|
|
103
|
-
const out = await service.getSecrets<{
|
|
104
|
-
'batch-a': { v: number }
|
|
105
|
-
'batch-b': string
|
|
106
|
-
}>(['batch-a', 'batch-b'])
|
|
107
|
-
|
|
108
|
-
assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
|
|
109
|
-
assert.equal(out['batch-b']!.reveal(), 'two')
|
|
110
|
-
})
|
|
111
|
-
|
|
112
|
-
test('getSecrets omits keys that were never stored', async () => {
|
|
113
|
-
const service = new RedisSecretService(redis as any, { key: kek })
|
|
114
|
-
await service.setSecret('present', 'here')
|
|
115
|
-
|
|
116
|
-
const out = await service.getSecrets(['present', 'never-stored'])
|
|
117
|
-
|
|
118
|
-
assert.deepEqual(Object.keys(out), ['present'])
|
|
119
|
-
assert.equal(out.present!.reveal(), 'here')
|
|
120
|
-
})
|
|
121
|
-
})
|
|
122
|
-
})
|