@pikku/redis 0.12.20 → 0.12.21

package/src/redis-secret-service.ts

@@ -1,210 +0,0 @@
-import {
-  deriveKEK,
-  envelopeDecrypt,
-  envelopeEncrypt,
-  envelopeRewrap,
-  generateKEKSalt,
-} from '@pikku/core/crypto-utils'
-import { createSecretValue, isSecretValue } from '@pikku/core/classification'
-import type { SecretService, SecretValues } from '@pikku/core/services'
-import type { SecretValue } from '@pikku/core/classification'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export interface RedisSecretServiceConfig {
-  key: string
-  keyVersion?: number
-  previousKey?: string
-  keyPrefix?: string
-}
-
-export class RedisSecretService implements SecretService {
-  private redis: Redis
-  private ownsConnection: boolean
-  private key: string
-  private keyVersion: number
-  private previousKey?: string
-  private keyPrefix: string
-  private kekSalts = new Map<number, string>()
-  private keks = new Map<number, CryptoKey>()
-
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    config: RedisSecretServiceConfig
-  ) {
-    if (
-      typeof connectionOrConfig === 'object' &&
-      'hgetall' in connectionOrConfig &&
-      'hset' in connectionOrConfig
-    ) {
-      this.redis = connectionOrConfig as Redis
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-
-    this.key = config.key
-    this.keyVersion = config.keyVersion ?? 1
-    this.previousKey = config.previousKey
-    this.keyPrefix = config.keyPrefix ?? 'pikku'
-  }
-
-  private secretKey(key: string): string {
-    return `${this.keyPrefix}:secret:${key}`
-  }
-
-  private saltKey(): string {
-    return `${this.keyPrefix}:kek-salt`
-  }
-
-  private async getKEKSalt(version: number): Promise<string> {
-    const cached = this.kekSalts.get(version)
-    if (cached) return cached
-
-    const field = String(version)
-    let salt = await this.redis.hget(this.saltKey(), field)
-    if (!salt) {
-      await this.redis.hsetnx(this.saltKey(), field, generateKEKSalt())
-      salt = await this.redis.hget(this.saltKey(), field)
-      if (!salt) {
-        throw new Error(
-          `Failed to persist a KEK salt for key_version ${version}`
-        )
-      }
-    }
-
-    this.kekSalts.set(version, salt)
-    return salt
-  }
-
-  private async getKEK(version: number): Promise<CryptoKey> {
-    const cached = this.keks.get(version)
-    if (cached) return cached
-
-    const passphrase = version === this.keyVersion ? this.key : this.previousKey
-    if (!passphrase) {
-      throw new Error(`No KEK available for key_version ${version}`)
-    }
-
-    const kek = await deriveKEK(passphrase, await this.getKEKSalt(version))
-    this.keks.set(version, kek)
-    return kek
-  }
-
-  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
-    const data = await this.redis.hgetall(this.secretKey(key))
-    if (!data.ciphertext) throw new Error(`Requested secret not found: ${key}`)
-
-    const kek = await this.getKEK(Number(data.key_version))
-    return createSecretValue(
-      await envelopeDecrypt<T>(kek, data.ciphertext!, data.wrapped_dek!)
-    )
-  }
-
-  async hasSecret(key: string): Promise<boolean> {
-    const exists = await this.redis.exists(this.secretKey(key))
-    return exists === 1
-  }
-
-  async setSecret(key: string, value: unknown): Promise<void> {
-    // Encrypting the wrapper would store its redaction, not the secret —
-    // writing a secret back to the vault is exactly what this method is for.
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      await this.getKEK(this.keyVersion),
-      isSecretValue(value) ? value.reveal() : value
-    )
-
-    await this.redis.hset(this.secretKey(key), {
-      ciphertext,
-      wrapped_dek: wrappedDEK,
-      key_version: this.keyVersion.toString(),
-    })
-  }
-
-  async deleteSecret(key: string): Promise<void> {
-    await this.redis.del(this.secretKey(key))
-  }
-
-  async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
-    keys: (keyof T & string)[]
-  ): Promise<Partial<SecretValues<T>>> {
-    const rows = await Promise.all(
-      keys.map(async (key) => ({
-        key,
-        data: await this.redis.hgetall(this.secretKey(key)),
-      }))
-    )
-
-    const out: Record<string, unknown> = {}
-    for (const { key, data } of rows) {
-      if (!data.ciphertext) continue
-
-      const keyVersion = Number(data.key_version)
-      try {
-        const kek = await this.getKEK(keyVersion)
-        out[key] = createSecretValue(
-          await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek!)
-        )
-      } catch (cause) {
-        throw new Error(
-          `Failed to decrypt secret "${key}" (key_version ${keyVersion}): ` +
-            `the configured KEK does not match the key it was wrapped under`,
-          { cause }
-        )
-      }
-    }
-    return out as Partial<SecretValues<T>>
-  }
-
-  async rotateKEK(): Promise<number> {
-    if (!this.previousKey) {
-      throw new Error('No previousKey configured — nothing to rotate from')
-    }
-
-    const oldKEK = await this.getKEK(this.keyVersion - 1)
-    const newKEK = await this.getKEK(this.keyVersion)
-
-    const pattern = `${this.keyPrefix}:secret:*`
-    let cursor = '0'
-    let count = 0
-
-    do {
-      const [nextCursor, keys] = await this.redis.scan(
-        cursor,
-        'MATCH',
-        pattern,
-        'COUNT',
-        100
-      )
-      cursor = nextCursor
-
-      for (const redisKey of keys) {
-        const data = await this.redis.hgetall(redisKey)
-        const version = Number(data.key_version)
-        if (version >= this.keyVersion) continue
-
-        const newWrappedDEK = await envelopeRewrap(
-          oldKEK,
-          newKEK,
-          data.wrapped_dek!
-        )
-        await this.redis.hset(redisKey, {
-          wrapped_dek: newWrappedDEK,
-          key_version: this.keyVersion.toString(),
-        })
-        count++
-      }
-    } while (cursor !== '0')
-
-    return count
-  }
-
-  async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-session-store.ts

@@ -1,71 +0,0 @@
-import type { SessionStore } from '@pikku/core/services'
-import type { CoreUserSession } from '@pikku/core/types'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export class RedisSessionStore implements SessionStore {
-  private redis: Redis
-  private keyPrefix: string
-  private ownsConnection: boolean
-  private ttlSeconds?: number
-
-  /**
-   * @param connectionOrConfig - ioredis Redis instance or RedisOptions config
-   * @param keyPrefix - Redis key prefix (default: 'pikku')
-   * @param ttlSeconds - Optional TTL in seconds for session entries
-   */
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    keyPrefix = 'pikku',
-    ttlSeconds?: number
-  ) {
-    this.keyPrefix = keyPrefix
-    this.ttlSeconds = ttlSeconds
-
-    if (connectionOrConfig instanceof Redis) {
-      this.redis = connectionOrConfig
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-  }
-
-  public async init(): Promise<void> {
-    await this.redis.ping()
-  }
-
-  private sessionKey(pikkuUserId: string): string {
-    return `${this.keyPrefix}:session:${pikkuUserId}`
-  }
-
-  async get(pikkuUserId: string): Promise<CoreUserSession | undefined> {
-    const data = await this.redis.get(this.sessionKey(pikkuUserId))
-    if (!data) {
-      return undefined
-    }
-    return JSON.parse(data) as CoreUserSession
-  }
-
-  async set(pikkuUserId: string, session: CoreUserSession): Promise<void> {
-    const key = this.sessionKey(pikkuUserId)
-    const value = JSON.stringify(session)
-    if (this.ttlSeconds) {
-      await this.redis.set(key, value, 'EX', this.ttlSeconds)
-    } else {
-      await this.redis.set(key, value)
-    }
-  }
-
-  async clear(pikkuUserId: string): Promise<void> {
-    await this.redis.del(this.sessionKey(pikkuUserId))
-  }
-
-  public async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-workflow-run-service.ts

@@ -1,231 +0,0 @@
-import type {
-  WorkflowRun,
-  StepState,
-  WorkflowStatus,
-  WorkflowRunService,
-} from '@pikku/core/workflow'
-import type { Redis } from 'ioredis'
-
-export class RedisWorkflowRunService implements WorkflowRunService {
-  constructor(
-    private redis: Redis,
-    private keyPrefix = 'workflows'
-  ) {}
-
-  private runKey(runId: string): string {
-    return `${this.keyPrefix}:run:${runId}`
-  }
-
-  private stepKeyPattern(runId: string): string {
-    return `${this.keyPrefix}:step:${runId}:*`
-  }
-
-  private stepHistoryKey(stepId: string): string {
-    return `${this.keyPrefix}:step-history:${stepId}`
-  }
-
-  private versionKey(name: string, graphHash: string): string {
-    return `${this.keyPrefix}:version:${name}:${graphHash}`
-  }
-
-  async listRuns(options?: {
-    workflowName?: string
-    status?: string
-    limit?: number
-    offset?: number
-  }): Promise<WorkflowRun[]> {
-    const { workflowName, status, limit = 50, offset = 0 } = options ?? {}
-
-    const runKeys = await this.scanKeys(`${this.keyPrefix}:run:*`)
-
-    const runs: WorkflowRun[] = []
-    for (const key of runKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.id) continue
-
-      if (workflowName && data.workflow !== workflowName) continue
-      if (status && data.status !== status) continue
-
-      runs.push(this.mapRunData(data))
-    }
-
-    runs.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
-
-    return runs.slice(offset, offset + limit)
-  }
-
-  async getRun(id: string): Promise<WorkflowRun | null> {
-    const data = await this.redis.hgetall(this.runKey(id))
-    if (!data.id) return null
-    return this.mapRunData(data)
-  }
-
-  async getRunSteps(
-    runId: string
-  ): Promise<
-    Array<StepState & { stepName: string; rpcName?: string; data?: any }>
-  > {
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(runId))
-
-    const steps: Array<
-      StepState & { stepName: string; rpcName?: string; data?: any }
-    > = []
-
-    for (const key of stepKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.stepId) continue
-
-      steps.push({
-        stepId: data.stepId,
-        stepName: this.extractStepName(key, runId),
-        rpcName: data.rpcName || undefined,
-        data: data.data ? JSON.parse(data.data) : undefined,
-        status: data.status as any,
-        result: data.result ? JSON.parse(data.result) : undefined,
-        error: data.error ? JSON.parse(data.error) : undefined,
-        attemptCount: Number(data.attemptCount || 1),
-        retries: data.retries ? Number(data.retries) : undefined,
-        retryDelay: data.retryDelay || undefined,
-        createdAt: new Date(Number(data.createdAt)),
-        updatedAt: new Date(Number(data.updatedAt)),
-      })
-    }
-
-    steps.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())
-
-    return steps
-  }
-
-  async getRunHistory(
-    runId: string
-  ): Promise<Array<StepState & { stepName: string }>> {
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(runId))
-
-    const allHistoryEntries: Array<StepState & { stepName: string }> = []
-
-    for (const key of stepKeys) {
-      const data = await this.redis.hgetall(key)
-      if (!data.stepId) continue
-
-      const historyEntries = await this.redis.zrange(
-        this.stepHistoryKey(data.stepId),
-        0,
-        '-1'
-      )
-
-      for (const entryStr of historyEntries) {
-        const entry = JSON.parse(entryStr)
-        allHistoryEntries.push({
-          stepId: entry.stepId,
-          stepName: entry.stepName,
-          status: entry.status,
-          result: entry.result ? JSON.parse(entry.result) : undefined,
-          error: entry.error ? JSON.parse(entry.error) : undefined,
-          attemptCount: entry.attemptCount,
-          retries: entry.retries,
-          retryDelay: entry.retryDelay,
-          createdAt: new Date(entry.createdAt),
-          updatedAt: new Date(entry.createdAt),
-          runningAt: entry.runningAt ? new Date(entry.runningAt) : undefined,
-          scheduledAt: entry.scheduledAt
-            ? new Date(entry.scheduledAt)
-            : undefined,
-          succeededAt: entry.succeededAt
-            ? new Date(entry.succeededAt)
-            : undefined,
-          failedAt: entry.failedAt ? new Date(entry.failedAt) : undefined,
-        })
-      }
-    }
-
-    return allHistoryEntries.sort(
-      (a, b) => a.createdAt.getTime() - b.createdAt.getTime()
-    )
-  }
-
-  async getDistinctWorkflowNames(): Promise<string[]> {
-    const runKeys = await this.scanKeys(`${this.keyPrefix}:run:*`)
-
-    const names = new Set<string>()
-    for (const key of runKeys) {
-      const workflow = await this.redis.hget(key, 'workflow')
-      if (workflow) names.add(workflow)
-    }
-
-    return [...names].sort()
-  }
-
-  async getWorkflowVersion(
-    name: string,
-    graphHash: string
-  ): Promise<{ graph: any; source: string } | null> {
-    const data = await this.redis.hgetall(this.versionKey(name, graphHash))
-    if (!data.graph) return null
-    return {
-      graph: JSON.parse(data.graph),
-      source: data.source!,
-    }
-  }
-
-  async deleteRun(id: string): Promise<boolean> {
-    const exists = await this.redis.exists(this.runKey(id))
-    if (!exists) return false
-
-    const stepKeys = await this.scanKeys(this.stepKeyPattern(id))
-
-    const keysToDelete = [this.runKey(id)]
-
-    for (const stepKey of stepKeys) {
-      const stepId = await this.redis.hget(stepKey, 'stepId')
-      keysToDelete.push(stepKey)
-      if (stepId) {
-        keysToDelete.push(this.stepHistoryKey(stepId))
-      }
-    }
-
-    await this.redis.del(...keysToDelete)
-    return true
-  }
-
-  private mapRunData(data: Record<string, string>): WorkflowRun {
-    return {
-      id: data.id!,
-      workflow: data.workflow!,
-      status: data.status! as WorkflowStatus,
-      input: JSON.parse(data.input!),
-      output: data.output ? JSON.parse(data.output) : undefined,
-      error: data.error ? JSON.parse(data.error) : undefined,
-      inline: data.inline === 'true' ? true : undefined,
-      graphHash: data.graphHash || undefined,
-      deterministic: data.deterministic === 'true' ? true : undefined,
-      plannedSteps: data.plannedSteps
-        ? JSON.parse(data.plannedSteps)
-        : undefined,
-      wire: data.wire ? JSON.parse(data.wire) : { type: 'unknown' },
-      createdAt: new Date(Number(data.createdAt!)),
-      updatedAt: new Date(Number(data.updatedAt!)),
-    }
-  }
-
-  private extractStepName(key: string, runId: string): string {
-    const prefix = `${this.keyPrefix}:step:${runId}:`
-    return key.slice(prefix.length)
-  }
-
-  private async scanKeys(pattern: string): Promise<string[]> {
-    const keys: string[] = []
-    let cursor = '0'
-    do {
-      const [newCursor, foundKeys] = await this.redis.scan(
-        cursor,
-        'MATCH',
-        pattern,
-        'COUNT',
-        100
-      )
-      cursor = newCursor
-      keys.push(...foundKeys)
-    } while (cursor !== '0')
-    return keys
-  }
-}

package/src/redis-workflow-service.test.ts

@@ -1,115 +0,0 @@
-import { describe, test, beforeEach, afterEach } from 'node:test'
-import assert from 'node:assert/strict'
-import Redis from 'ioredis-mock'
-
-import { RedisWorkflowService } from './redis-workflow-service.js'
-
-const KEY_PREFIX = 'workflows'
-
-let ws: RedisWorkflowService
-let redis: any
-
-const newRun = () =>
-  ws.createRun('flow', {}, false, 'hash', { type: 'test' } as any)
-
-beforeEach(() => {
-  redis = new Redis()
-  ws = new RedisWorkflowService(redis, KEY_PREFIX)
-})
-
-afterEach(() => {
-  redis.disconnect()
-})
-
-describe('workflow run state in redis', () => {
-  test('two branches setting different keys both survive', async () => {
-    const runId = await newRun()
-
-    await Promise.all([
-      ws.updateRunState(runId, 'left', 'a'),
-      ws.updateRunState(runId, 'right', 'b'),
-    ])
-
-    assert.deepEqual(
-      await ws.getRunState(runId),
-      { left: 'a', right: 'b' },
-      'a parallel branch overwrote the other branch’s state'
-    )
-  })
-
-  test('many concurrent writers all land', async () => {
-    const runId = await newRun()
-    const keys = Array.from({ length: 20 }, (_, i) => `k${i}`)
-
-    await Promise.all(keys.map((k, i) => ws.updateRunState(runId, k, i)))
-
-    const state = await ws.getRunState(runId)
-    assert.equal(Object.keys(state).length, keys.length)
-    keys.forEach((k, i) => assert.equal(state[k], i))
-  })
-
-  test('an empty array stays an array when another key is written', async () => {
-    const runId = await newRun()
-
-    await ws.updateRunState(runId, 'items', [])
-    await ws.updateRunState(runId, 'count', 0)
-
-    const state = await ws.getRunState(runId)
-    assert.ok(
-      Array.isArray(state.items),
-      `an empty array came back as ${JSON.stringify(state.items)}`
-    )
-    assert.equal(state.count, 0)
-  })
-
-  test('values keep their types, including null and nested objects', async () => {
-    const runId = await newRun()
-
-    await ws.updateRunState(runId, 'nothing', null)
-    await ws.updateRunState(runId, 'nested', { a: [1, { b: true }] })
-    await ws.updateRunState(runId, 'flag', false)
-
-    assert.deepEqual(await ws.getRunState(runId), {
-      nothing: null,
-      nested: { a: [1, { b: true }] },
-      flag: false,
-    })
-  })
-
-  test('a later write to the same key replaces it', async () => {
-    const runId = await newRun()
-
-    await ws.updateRunState(runId, 'attempt', 1)
-    await ws.updateRunState(runId, 'attempt', 2)
-
-    assert.deepEqual(await ws.getRunState(runId), { attempt: 2 })
-  })
-
-  test('the state of a run that has none is empty', async () => {
-    assert.deepEqual(await ws.getRunState(await newRun()), {})
-  })
-
-  test('state written before the per-key layout is still readable', async () => {
-    const runId = await newRun()
-    const redis = (ws as any).redis
-    await redis.hset(
-      (ws as any).runKey(runId),
-      'state',
-      JSON.stringify({ legacy: 'kept', shared: 'old' })
-    )
-
-    assert.deepEqual(await ws.getRunState(runId), {
-      legacy: 'kept',
-      shared: 'old',
-    })
-
-    await ws.updateRunState(runId, 'shared', 'new')
-    await ws.updateRunState(runId, 'fresh', 1)
-
-    assert.deepEqual(
-      await ws.getRunState(runId),
-      { legacy: 'kept', shared: 'new', fresh: 1 },
-      'a run in flight across the deploy lost the state it already had'
-    )
-  })
-})