@pikku/redis 0.12.20 → 0.12.23

package/src/redis-deployment-service.ts

@@ -1,171 +0,0 @@
-import { buildRemoteHeaders } from '@pikku/core/remote'
-import type {
-  DeploymentService,
-  DeploymentServiceConfig,
-  DeploymentConfig,
-} from '@pikku/core/services'
-import type { JWTService } from '@pikku/core/services'
-import type { SecretService } from '@pikku/core/services'
-import { getAllFunctionNames } from '@pikku/core/function'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export class RedisDeploymentService implements DeploymentService {
-  private redis: Redis
-  private keyPrefix: string
-  private ownsConnection: boolean
-  private heartbeatTimer?: ReturnType<typeof setInterval>
-  private deploymentConfig?: DeploymentConfig
-  private heartbeatInterval: number
-  private heartbeatTtl: number
-
-  constructor(
-    config: DeploymentServiceConfig,
-    connectionOrConfig: Redis | RedisOptions | string,
-    keyPrefix = 'pikku',
-    private jwt?: JWTService,
-    private secrets?: SecretService
-  ) {
-    this.heartbeatInterval = config.heartbeatInterval ?? 10000
-    this.heartbeatTtl = config.heartbeatTtl ?? 30000
-    this.keyPrefix = keyPrefix
-
-    if (connectionOrConfig instanceof Redis) {
-      this.redis = connectionOrConfig
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-  }
-
-  private deploymentKey(deploymentId: string): string {
-    return `${this.keyPrefix}:deployment:${deploymentId}`
-  }
-
-  private functionsIndexKey(funcName: string): string {
-    return `${this.keyPrefix}:fn:${funcName}`
-  }
-
-  public async init(): Promise<void> {}
-
-  async start(config: DeploymentConfig): Promise<void> {
-    const functions = config.functions ?? getAllFunctionNames()
-    this.deploymentConfig = { ...config, functions }
-    const ttlSeconds = Math.ceil(this.heartbeatTtl / 1000)
-    const expiryScore = Date.now() + this.heartbeatTtl
-
-    const pipeline = this.redis.pipeline()
-
-    pipeline.hset(this.deploymentKey(config.deploymentId), {
-      endpoint: config.endpoint,
-      functions: JSON.stringify(functions),
-    })
-    pipeline.expire(this.deploymentKey(config.deploymentId), ttlSeconds)
-
-    for (const fn of functions) {
-      pipeline.zadd(
-        this.functionsIndexKey(fn),
-        expiryScore,
-        config.deploymentId
-      )
-    }
-
-    await pipeline.exec()
-
-    this.heartbeatTimer = setInterval(
-      () => this.sendHeartbeat(),
-      this.heartbeatInterval
-    )
-  }
-
-  async stop(): Promise<void> {
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer)
-      this.heartbeatTimer = undefined
-    }
-
-    if (this.deploymentConfig) {
-      const { deploymentId, functions } = this.deploymentConfig
-      const pipeline = this.redis.pipeline()
-
-      pipeline.del(this.deploymentKey(deploymentId))
-      for (const fn of functions!) {
-        pipeline.zrem(this.functionsIndexKey(fn), deploymentId)
-      }
-
-      await pipeline.exec()
-    }
-
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-
-  async invoke(
-    funcName: string,
-    data: unknown,
-    session?: unknown,
-    traceId?: string
-  ): Promise<unknown> {
-    const headers = await buildRemoteHeaders(
-      this.jwt,
-      this.secrets,
-      funcName,
-      session,
-      traceId
-    )
-    const indexKey = this.functionsIndexKey(funcName)
-    const now = Date.now()
-
-    await this.redis.zremrangebyscore(indexKey, '-inf', now)
-    const deploymentIds = await this.redis.zrangebyscore(indexKey, now, '+inf')
-
-    let endpoint: string | null = null
-    for (const deploymentId of deploymentIds) {
-      endpoint = await this.redis.hget(
-        this.deploymentKey(deploymentId),
-        'endpoint'
-      )
-      if (endpoint) break
-    }
-
-    if (!endpoint) {
-      throw new Error(`No deployment found for function '${funcName}'`)
-    }
-
-    const url = `${endpoint}/remote/rpc/${encodeURIComponent(funcName)}`
-    const response = await fetch(url, {
-      method: 'POST',
-      headers,
-      body: JSON.stringify({ data }),
-    })
-    if (!response.ok) {
-      throw new Error(
-        `Remote RPC call to '${funcName}' failed: ${response.status}`
-      )
-    }
-    return response.json()
-  }
-
-  private async sendHeartbeat(): Promise<void> {
-    if (!this.deploymentConfig) return
-
-    const { deploymentId, functions } = this.deploymentConfig
-    const ttlSeconds = Math.ceil(this.heartbeatTtl / 1000)
-    const expiryScore = Date.now() + this.heartbeatTtl
-
-    try {
-      const pipeline = this.redis.pipeline()
-      pipeline.expire(this.deploymentKey(deploymentId), ttlSeconds)
-      for (const fn of functions!) {
-        pipeline.zadd(this.functionsIndexKey(fn), expiryScore, deploymentId)
-      }
-      await pipeline.exec()
-    } catch {
-      // Heartbeat failed, will retry on next interval
-    }
-  }
-}

package/src/redis-eventhub-store.ts

@@ -1,104 +0,0 @@
-import type { EventHubStore } from '@pikku/core/channel'
-import { Redis, type RedisOptions } from 'ioredis'
-
-/**
- * Redis-based implementation of EventHubStore
- *
- * Manages pub/sub topic subscriptions for channels in Redis.
- *
- * @example
- * ```typescript
- * const redis = new Redis({ host: 'localhost', port: 6379 })
- * const store = new RedisEventHubStore(redis, 'myapp')
- * await store.subscribe('user.123', channelId)
- * ```
- */
-export class RedisEventHubStore implements EventHubStore {
-  private redis: Redis
-  private keyPrefix: string
-  private ownsConnection: boolean
-
-  /**
-   * @param connectionOrConfig - ioredis Redis instance or RedisOptions config
-   * @param keyPrefix - Redis key prefix (default: 'pikku')
-   */
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    keyPrefix = 'pikku'
-  ) {
-    this.keyPrefix = keyPrefix
-
-    // Check if it's a Redis instance or config options
-    if (connectionOrConfig instanceof Redis) {
-      this.redis = connectionOrConfig
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      // It's a connection string
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      // It's a config object
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-  }
-
-  /**
-   * Initialize the store (no-op for Redis, always ready)
-   */
-  public async init(): Promise<void> {
-    // Redis doesn't require schema initialization
-    await this.redis.ping()
-  }
-
-  private topicKey(topic: string): string {
-    return `${this.keyPrefix}:topic:${topic}`
-  }
-
-  private channelSubsKey(channelId: string): string {
-    return `${this.keyPrefix}:subs:${channelId}`
-  }
-
-  public async getChannelIdsForTopic(topic: string): Promise<string[]> {
-    const key = this.topicKey(topic)
-    return await this.redis.smembers(key)
-  }
-
-  public async subscribe(topic: string, channelId: string): Promise<boolean> {
-    const topicKey = this.topicKey(topic)
-    const subsKey = this.channelSubsKey(channelId)
-
-    // Add channelId to topic set and topic to channel's subscription set
-    const pipeline = this.redis.pipeline()
-    pipeline.sadd(topicKey, channelId)
-    pipeline.sadd(subsKey, topic)
-
-    await pipeline.exec()
-
-    return true
-  }
-
-  public async unsubscribe(topic: string, channelId: string): Promise<boolean> {
-    const topicKey = this.topicKey(topic)
-    const subsKey = this.channelSubsKey(channelId)
-
-    // Remove channelId from topic set and topic from channel's subscription set
-    const pipeline = this.redis.pipeline()
-    pipeline.srem(topicKey, channelId)
-    pipeline.srem(subsKey, topic)
-
-    const results = await pipeline.exec()
-
-    // Check if the channel was actually in the topic set
-    return (results![0]![1] as number) > 0
-  }
-
-  /**
-   * Close the Redis connection if owned by this store
-   */
-  public async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-secret-service.test.ts

@@ -1,122 +0,0 @@
-import { describe, test, before, after } from 'node:test'
-import assert from 'node:assert/strict'
-import Redis from 'ioredis-mock'
-import { defineServiceTests } from '@pikku/core/testing'
-import { RedisSecretService } from './redis-secret-service.js'
-
-describe('RedisSecretService', () => {
-  let redis: InstanceType<typeof Redis>
-
-  before(() => {
-    redis = new Redis()
-  })
-
-  after(async () => {
-    redis.disconnect()
-  })
-
-  defineServiceTests({
-    name: 'Redis',
-    services: {
-      secretService: async (config) =>
-        new RedisSecretService(redis as any, config),
-    },
-  })
-
-  test('custom keyPrefix isolates secrets', async () => {
-    const prefixRedis = new Redis()
-    const kek = 'test-key-encryption-key-32chars!'
-    const s1 = new RedisSecretService(prefixRedis as any, {
-      key: kek,
-      keyPrefix: 'app1',
-    })
-    const s2 = new RedisSecretService(prefixRedis as any, {
-      key: kek,
-      keyPrefix: 'app2',
-    })
-
-    await s1.setSecret('shared-name', { from: 'app1' })
-    await s2.setSecret('shared-name', { from: 'app2' })
-
-    const r1 = await s1.getSecret<{ from: string }>('shared-name')
-    const r2 = await s2.getSecret<{ from: string }>('shared-name')
-
-    assert.deepEqual(r1.reveal(), { from: 'app1' })
-    assert.deepEqual(r2.reveal(), { from: 'app2' })
-    prefixRedis.disconnect()
-  })
-
-  describe('decryption failures', () => {
-    const kek = 'test-key-encryption-key-32chars!'
-    const otherKek = 'a-totally-different-kek-32chars!'
-
-    test('getSecrets throws naming a secret it cannot decrypt', async () => {
-      const writer = new RedisSecretService(redis as any, { key: kek })
-      await writer.setSecret('undecryptable', { token: 'abc' })
-
-      const reader = new RedisSecretService(redis as any, { key: otherKek })
-
-      await assert.rejects(
-        () => reader.getSecrets(['undecryptable']),
-        (error: Error) => {
-          assert.equal(
-            error.message,
-            'Failed to decrypt secret "undecryptable" (key_version 1): ' +
-              'the configured KEK does not match the key it was wrapped under'
-          )
-          assert.ok(error.cause, 'the underlying crypto failure is preserved')
-          return true
-        }
-      )
-    })
-
-    test('getSecrets throws when no KEK is available for a stored key_version', async () => {
-      const writer = new RedisSecretService(redis as any, {
-        key: kek,
-        keyVersion: 7,
-      })
-      await writer.setSecret('old-version', 'value')
-
-      const reader = new RedisSecretService(redis as any, {
-        key: kek,
-        keyVersion: 8,
-      })
-
-      await assert.rejects(
-        () => reader.getSecrets(['old-version']),
-        (error: Error) => {
-          assert.equal(
-            error.message,
-            'Failed to decrypt secret "old-version" (key_version 7): ' +
-              'the configured KEK does not match the key it was wrapped under'
-          )
-          return true
-        }
-      )
-    })
-
-    test('getSecrets returns every secret when they all decrypt', async () => {
-      const service = new RedisSecretService(redis as any, { key: kek })
-      await service.setSecret('batch-a', { v: 1 })
-      await service.setSecret('batch-b', 'two')
-
-      const out = await service.getSecrets<{
-        'batch-a': { v: number }
-        'batch-b': string
-      }>(['batch-a', 'batch-b'])
-
-      assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
-      assert.equal(out['batch-b']!.reveal(), 'two')
-    })
-
-    test('getSecrets omits keys that were never stored', async () => {
-      const service = new RedisSecretService(redis as any, { key: kek })
-      await service.setSecret('present', 'here')
-
-      const out = await service.getSecrets(['present', 'never-stored'])
-
-      assert.deepEqual(Object.keys(out), ['present'])
-      assert.equal(out.present!.reveal(), 'here')
-    })
-  })
-})

package/src/redis-secret-service.ts

@@ -1,210 +0,0 @@
-import {
-  deriveKEK,
-  envelopeDecrypt,
-  envelopeEncrypt,
-  envelopeRewrap,
-  generateKEKSalt,
-} from '@pikku/core/crypto-utils'
-import { createSecretValue, isSecretValue } from '@pikku/core/classification'
-import type { SecretService, SecretValues } from '@pikku/core/services'
-import type { SecretValue } from '@pikku/core/classification'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export interface RedisSecretServiceConfig {
-  key: string
-  keyVersion?: number
-  previousKey?: string
-  keyPrefix?: string
-}
-
-export class RedisSecretService implements SecretService {
-  private redis: Redis
-  private ownsConnection: boolean
-  private key: string
-  private keyVersion: number
-  private previousKey?: string
-  private keyPrefix: string
-  private kekSalts = new Map<number, string>()
-  private keks = new Map<number, CryptoKey>()
-
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    config: RedisSecretServiceConfig
-  ) {
-    if (
-      typeof connectionOrConfig === 'object' &&
-      'hgetall' in connectionOrConfig &&
-      'hset' in connectionOrConfig
-    ) {
-      this.redis = connectionOrConfig as Redis
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-
-    this.key = config.key
-    this.keyVersion = config.keyVersion ?? 1
-    this.previousKey = config.previousKey
-    this.keyPrefix = config.keyPrefix ?? 'pikku'
-  }
-
-  private secretKey(key: string): string {
-    return `${this.keyPrefix}:secret:${key}`
-  }
-
-  private saltKey(): string {
-    return `${this.keyPrefix}:kek-salt`
-  }
-
-  private async getKEKSalt(version: number): Promise<string> {
-    const cached = this.kekSalts.get(version)
-    if (cached) return cached
-
-    const field = String(version)
-    let salt = await this.redis.hget(this.saltKey(), field)
-    if (!salt) {
-      await this.redis.hsetnx(this.saltKey(), field, generateKEKSalt())
-      salt = await this.redis.hget(this.saltKey(), field)
-      if (!salt) {
-        throw new Error(
-          `Failed to persist a KEK salt for key_version ${version}`
-        )
-      }
-    }
-
-    this.kekSalts.set(version, salt)
-    return salt
-  }
-
-  private async getKEK(version: number): Promise<CryptoKey> {
-    const cached = this.keks.get(version)
-    if (cached) return cached
-
-    const passphrase = version === this.keyVersion ? this.key : this.previousKey
-    if (!passphrase) {
-      throw new Error(`No KEK available for key_version ${version}`)
-    }
-
-    const kek = await deriveKEK(passphrase, await this.getKEKSalt(version))
-    this.keks.set(version, kek)
-    return kek
-  }
-
-  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
-    const data = await this.redis.hgetall(this.secretKey(key))
-    if (!data.ciphertext) throw new Error(`Requested secret not found: ${key}`)
-
-    const kek = await this.getKEK(Number(data.key_version))
-    return createSecretValue(
-      await envelopeDecrypt<T>(kek, data.ciphertext!, data.wrapped_dek!)
-    )
-  }
-
-  async hasSecret(key: string): Promise<boolean> {
-    const exists = await this.redis.exists(this.secretKey(key))
-    return exists === 1
-  }
-
-  async setSecret(key: string, value: unknown): Promise<void> {
-    // Encrypting the wrapper would store its redaction, not the secret —
-    // writing a secret back to the vault is exactly what this method is for.
-    const { ciphertext, wrappedDEK } = await envelopeEncrypt(
-      await this.getKEK(this.keyVersion),
-      isSecretValue(value) ? value.reveal() : value
-    )
-
-    await this.redis.hset(this.secretKey(key), {
-      ciphertext,
-      wrapped_dek: wrappedDEK,
-      key_version: this.keyVersion.toString(),
-    })
-  }
-
-  async deleteSecret(key: string): Promise<void> {
-    await this.redis.del(this.secretKey(key))
-  }
-
-  async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
-    keys: (keyof T & string)[]
-  ): Promise<Partial<SecretValues<T>>> {
-    const rows = await Promise.all(
-      keys.map(async (key) => ({
-        key,
-        data: await this.redis.hgetall(this.secretKey(key)),
-      }))
-    )
-
-    const out: Record<string, unknown> = {}
-    for (const { key, data } of rows) {
-      if (!data.ciphertext) continue
-
-      const keyVersion = Number(data.key_version)
-      try {
-        const kek = await this.getKEK(keyVersion)
-        out[key] = createSecretValue(
-          await envelopeDecrypt(kek, data.ciphertext, data.wrapped_dek!)
-        )
-      } catch (cause) {
-        throw new Error(
-          `Failed to decrypt secret "${key}" (key_version ${keyVersion}): ` +
-            `the configured KEK does not match the key it was wrapped under`,
-          { cause }
-        )
-      }
-    }
-    return out as Partial<SecretValues<T>>
-  }
-
-  async rotateKEK(): Promise<number> {
-    if (!this.previousKey) {
-      throw new Error('No previousKey configured — nothing to rotate from')
-    }
-
-    const oldKEK = await this.getKEK(this.keyVersion - 1)
-    const newKEK = await this.getKEK(this.keyVersion)
-
-    const pattern = `${this.keyPrefix}:secret:*`
-    let cursor = '0'
-    let count = 0
-
-    do {
-      const [nextCursor, keys] = await this.redis.scan(
-        cursor,
-        'MATCH',
-        pattern,
-        'COUNT',
-        100
-      )
-      cursor = nextCursor
-
-      for (const redisKey of keys) {
-        const data = await this.redis.hgetall(redisKey)
-        const version = Number(data.key_version)
-        if (version >= this.keyVersion) continue
-
-        const newWrappedDEK = await envelopeRewrap(
-          oldKEK,
-          newKEK,
-          data.wrapped_dek!
-        )
-        await this.redis.hset(redisKey, {
-          wrapped_dek: newWrappedDEK,
-          key_version: this.keyVersion.toString(),
-        })
-        count++
-      }
-    } while (cursor !== '0')
-
-    return count
-  }
-
-  async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}

package/src/redis-session-store.ts

@@ -1,71 +0,0 @@
-import type { SessionStore } from '@pikku/core/services'
-import type { CoreUserSession } from '@pikku/core/types'
-import { Redis, type RedisOptions } from 'ioredis'
-
-export class RedisSessionStore implements SessionStore {
-  private redis: Redis
-  private keyPrefix: string
-  private ownsConnection: boolean
-  private ttlSeconds?: number
-
-  /**
-   * @param connectionOrConfig - ioredis Redis instance or RedisOptions config
-   * @param keyPrefix - Redis key prefix (default: 'pikku')
-   * @param ttlSeconds - Optional TTL in seconds for session entries
-   */
-  constructor(
-    connectionOrConfig: Redis | RedisOptions | string,
-    keyPrefix = 'pikku',
-    ttlSeconds?: number
-  ) {
-    this.keyPrefix = keyPrefix
-    this.ttlSeconds = ttlSeconds
-
-    if (connectionOrConfig instanceof Redis) {
-      this.redis = connectionOrConfig
-      this.ownsConnection = false
-    } else if (typeof connectionOrConfig === 'string') {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    } else {
-      this.redis = new Redis(connectionOrConfig)
-      this.ownsConnection = true
-    }
-  }
-
-  public async init(): Promise<void> {
-    await this.redis.ping()
-  }
-
-  private sessionKey(pikkuUserId: string): string {
-    return `${this.keyPrefix}:session:${pikkuUserId}`
-  }
-
-  async get(pikkuUserId: string): Promise<CoreUserSession | undefined> {
-    const data = await this.redis.get(this.sessionKey(pikkuUserId))
-    if (!data) {
-      return undefined
-    }
-    return JSON.parse(data) as CoreUserSession
-  }
-
-  async set(pikkuUserId: string, session: CoreUserSession): Promise<void> {
-    const key = this.sessionKey(pikkuUserId)
-    const value = JSON.stringify(session)
-    if (this.ttlSeconds) {
-      await this.redis.set(key, value, 'EX', this.ttlSeconds)
-    } else {
-      await this.redis.set(key, value)
-    }
-  }
-
-  async clear(pikkuUserId: string): Promise<void> {
-    await this.redis.del(this.sessionKey(pikkuUserId))
-  }
-
-  public async close(): Promise<void> {
-    if (this.ownsConnection) {
-      await this.redis.quit()
-    }
-  }
-}