@rudderhq/server 0.1.0-canary.0

package/dist/routes/sidebar-badges.js

@@ -0,0 +1,70 @@
+import { Router } from "express";
+import { and, eq, sql } from "drizzle-orm";
+import { joinRequests } from "@rudderhq/db";
+import { sidebarBadgeService } from "../services/sidebar-badges.js";
+import { accessService } from "../services/access.js";
+import { chatService } from "../services/chats.js";
+import { dashboardService } from "../services/dashboard.js";
+import { issueService } from "../services/issues.js";
+import { assertCompanyAccess } from "./authz.js";
+export function sidebarBadgeRoutes(db) {
+    const router = Router();
+    const svc = sidebarBadgeService(db);
+    const access = accessService(db);
+    const chats = chatService(db);
+    const dashboard = dashboardService(db);
+    const issues = issueService(db);
+    const inboxIssueStatuses = "backlog,todo,in_progress,in_review,blocked,done";
+    router.get("/orgs/:orgId/sidebar-badges", async (req, res) => {
+        const orgId = req.params.orgId;
+        assertCompanyAccess(req, orgId);
+        let canApproveJoins = false;
+        if (req.actor.type === "board") {
+            canApproveJoins =
+                req.actor.source === "local_implicit" ||
+                    Boolean(req.actor.isInstanceAdmin) ||
+                    (await access.canUser(orgId, req.actor.userId, "joins:approve"));
+        }
+        else if (req.actor.type === "agent" && req.actor.agentId) {
+            canApproveJoins = await access.hasPermission(orgId, "agent", req.actor.agentId, "joins:approve");
+        }
+        const joinRequestCount = canApproveJoins
+            ? await db
+                .select({ count: sql `count(*)` })
+                .from(joinRequests)
+                .where(and(eq(joinRequests.orgId, orgId), eq(joinRequests.status, "pending_approval")))
+                .then((rows) => Number(rows[0]?.count ?? 0))
+            : 0;
+        const summary = await dashboard.summary(orgId);
+        const boardUserId = req.actor.type === "board" ? (req.actor.userId ?? "local-board") : null;
+        const [touchedIssues, activeChats] = boardUserId
+            ? await Promise.all([
+                issues.list(orgId, {
+                    touchedByUserId: boardUserId,
+                    unreadForUserId: boardUserId,
+                    status: inboxIssueStatuses,
+                }),
+                chats.list(orgId, { status: "active" }, boardUserId),
+            ])
+            : [[], []];
+        const unreadTouchedIssues = touchedIssues.length;
+        const chatAttention = activeChats.filter((conversation) => conversation.needsAttention).length;
+        const provisionalBadges = await svc.get(orgId, {
+            joinRequests: joinRequestCount,
+            unreadTouchedIssues,
+            chatAttention,
+        });
+        const hasFailedRuns = provisionalBadges.failedRuns > 0;
+        const alertsCount = (summary.agents.error > 0 && !hasFailedRuns ? 1 : 0) +
+            (summary.costs.monthBudgetCents > 0 && summary.costs.monthUtilizationPercent >= 80 ? 1 : 0);
+        const badges = await svc.get(orgId, {
+            joinRequests: joinRequestCount,
+            unreadTouchedIssues,
+            chatAttention,
+            alerts: alertsCount,
+        });
+        res.json(badges);
+    });
+    return router;
+}
+//# sourceMappingURL=sidebar-badges.js.map

package/dist/routes/sidebar-badges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidebar-badges.js","sourceRoot":"","sources":["../../src/routes/sidebar-badges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,UAAU,kBAAkB,CAAC,EAAM;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;IAE7E,MAAM,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAe,CAAC;QACzC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,eAAe;gBACb,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB;oBACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;oBAClC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3D,eAAe,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,gBAAgB,GAAG,eAAe;YACtC,CAAC,CAAC,MAAM,EAAE;iBACP,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC;iBACxC,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;iBACtF,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC,CAAC;QAEN,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,WAAW;YAC9C,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;oBACjB,eAAe,EAAE,WAAW;oBAC5B,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAW,CAAC;aACrD,CAAC;YACF,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACb,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAAC;QACjD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;QAE/F,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE;YAC7C,YAAY,EAAE,gBAAgB;YAC9B,mBAAmB;YACnB,aAAa;SACd,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,iBAAiB,CAAC,UAAU,GAAG,CAAC,CAAC;QACvD,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE;YAClC,YAAY,EAAE,gBAAgB;YAC9B,mBAAmB;YACnB,aAAa;YACb,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/secrets/external-stub-providers.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const awsSecretsManagerProvider: SecretProviderModule;
+export declare const gcpSecretManagerProvider: SecretProviderModule;
+export declare const vaultProvider: SecretProviderModule;
+//# sourceMappingURL=external-stub-providers.d.ts.map

package/dist/secrets/external-stub-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.d.ts","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAsBvD,eAAO,MAAM,yBAAyB,sBAGrC,CAAC;AACF,eAAO,MAAM,wBAAwB,sBAGpC,CAAC;AACF,eAAO,MAAM,aAAa,sBAAkD,CAAC"}

package/dist/secrets/external-stub-providers.js

@@ -0,0 +1,21 @@
+import { unprocessable } from "../errors.js";
+function unavailableProvider(id, label) {
+    return {
+        id,
+        descriptor: {
+            id,
+            label,
+            requiresExternalRef: true,
+        },
+        async createVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+        async resolveVersion() {
+            throw unprocessable(`${id} provider is not configured in this deployment`);
+        },
+    };
+}
+export const awsSecretsManagerProvider = unavailableProvider("aws_secrets_manager", "AWS Secrets Manager");
+export const gcpSecretManagerProvider = unavailableProvider("gcp_secret_manager", "GCP Secret Manager");
+export const vaultProvider = unavailableProvider("vault", "HashiCorp Vault");
+//# sourceMappingURL=external-stub-providers.js.map

package/dist/secrets/external-stub-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-stub-providers.js","sourceRoot":"","sources":["../../src/secrets/external-stub-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,SAAS,mBAAmB,CAC1B,EAA0D,EAC1D,KAAa;IAEb,OAAO;QACL,EAAE;QACF,UAAU,EAAE;YACV,EAAE;YACF,KAAK;YACL,mBAAmB,EAAE,IAAI;SAC1B;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,aAAa,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAC1D,qBAAqB,EACrB,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CACzD,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC"}

package/dist/secrets/local-encrypted-provider.d.ts

@@ -0,0 +1,3 @@
+import type { SecretProviderModule } from "./types.js";
+export declare const localEncryptedProvider: SecretProviderModule;
+//# sourceMappingURL=local-encrypted-provider.d.ts.map

package/dist/secrets/local-encrypted-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.d.ts","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,YAAY,CAAC;AAgHpF,eAAO,MAAM,sBAAsB,EAAE,oBAmBpC,CAAC"}

package/dist/secrets/local-encrypted-provider.js

@@ -0,0 +1,116 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
+import path from "node:path";
+import { badRequest } from "../errors.js";
+function resolveMasterKeyFilePath() {
+    const fromEnv = process.env.RUDDER_SECRETS_MASTER_KEY_FILE;
+    if (fromEnv && fromEnv.trim().length > 0)
+        return path.resolve(fromEnv.trim());
+    return path.resolve(process.cwd(), "data/secrets/master.key");
+}
+function decodeMasterKey(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    if (/^[A-Fa-f0-9]{64}$/.test(trimmed)) {
+        return Buffer.from(trimmed, "hex");
+    }
+    try {
+        const decoded = Buffer.from(trimmed, "base64");
+        if (decoded.length === 32)
+            return decoded;
+    }
+    catch {
+        // ignored
+    }
+    if (Buffer.byteLength(trimmed, "utf8") === 32) {
+        return Buffer.from(trimmed, "utf8");
+    }
+    return null;
+}
+function loadOrCreateMasterKey() {
+    const envKeyRaw = process.env.RUDDER_SECRETS_MASTER_KEY;
+    if (envKeyRaw && envKeyRaw.trim().length > 0) {
+        const fromEnv = decodeMasterKey(envKeyRaw);
+        if (!fromEnv) {
+            throw badRequest("Invalid RUDDER_SECRETS_MASTER_KEY (expected 32-byte base64, 64-char hex, or raw 32-char string)");
+        }
+        return fromEnv;
+    }
+    const keyPath = resolveMasterKeyFilePath();
+    if (existsSync(keyPath)) {
+        const raw = readFileSync(keyPath, "utf8");
+        const decoded = decodeMasterKey(raw);
+        if (!decoded) {
+            throw badRequest(`Invalid secrets master key at ${keyPath}`);
+        }
+        return decoded;
+    }
+    const dir = path.dirname(keyPath);
+    mkdirSync(dir, { recursive: true });
+    const generated = randomBytes(32);
+    writeFileSync(keyPath, generated.toString("base64"), { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(keyPath, 0o600);
+    }
+    catch {
+        // best effort
+    }
+    return generated;
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function encryptValue(masterKey, value) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", masterKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        scheme: "local_encrypted_v1",
+        iv: iv.toString("base64"),
+        tag: tag.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+function decryptValue(masterKey, material) {
+    const iv = Buffer.from(material.iv, "base64");
+    const tag = Buffer.from(material.tag, "base64");
+    const ciphertext = Buffer.from(material.ciphertext, "base64");
+    const decipher = createDecipheriv("aes-256-gcm", masterKey, iv);
+    decipher.setAuthTag(tag);
+    const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return plain.toString("utf8");
+}
+function asLocalEncryptedMaterial(value) {
+    if (value &&
+        typeof value === "object" &&
+        value.scheme === "local_encrypted_v1" &&
+        typeof value.iv === "string" &&
+        typeof value.tag === "string" &&
+        typeof value.ciphertext === "string") {
+        return value;
+    }
+    throw badRequest("Invalid local_encrypted secret material");
+}
+export const localEncryptedProvider = {
+    id: "local_encrypted",
+    descriptor: {
+        id: "local_encrypted",
+        label: "Local encrypted (default)",
+        requiresExternalRef: false,
+    },
+    async createVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return {
+            material: encryptValue(masterKey, input.value),
+            valueSha256: sha256Hex(input.value),
+            externalRef: null,
+        };
+    },
+    async resolveVersion(input) {
+        const masterKey = loadOrCreateMasterKey();
+        return decryptValue(masterKey, asLocalEncryptedMaterial(input.material));
+    },
+};
+//# sourceMappingURL=local-encrypted-provider.js.map

package/dist/secrets/local-encrypted-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-encrypted-provider.js","sourceRoot":"","sources":["../../src/secrets/local-encrypted-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS1C,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACxD,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CACd,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,KAAa;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,oBAAoB;QAC5B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,QAAgC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAkC;IAClE,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,oBAAoB;QACrC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,KAA+B,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,EAAE,EAAE,iBAAiB;IACrB,UAAU,EAAE;QACV,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,2BAA2B;QAClC,mBAAmB,EAAE,KAAK;KAC3B;IACD,KAAK,CAAC,aAAa,CAAC,KAAK;QACvB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO;YACL,QAAQ,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9C,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,KAAK;QACxB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/dist/secrets/provider-registry.d.ts

@@ -0,0 +1,5 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@rudderhq/shared";
+import type { SecretProviderModule } from "./types.js";
+export declare function getSecretProvider(id: SecretProvider): SecretProviderModule;
+export declare function listSecretProviders(): SecretProviderDescriptor[];
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/secrets/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAOjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAcvD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,GAAG,oBAAoB,CAI1E;AAED,wBAAgB,mBAAmB,IAAI,wBAAwB,EAAE,CAEhE"}

package/dist/secrets/provider-registry.js

@@ -0,0 +1,20 @@
+import { localEncryptedProvider } from "./local-encrypted-provider.js";
+import { awsSecretsManagerProvider, gcpSecretManagerProvider, vaultProvider, } from "./external-stub-providers.js";
+import { unprocessable } from "../errors.js";
+const providers = [
+    localEncryptedProvider,
+    awsSecretsManagerProvider,
+    gcpSecretManagerProvider,
+    vaultProvider,
+];
+const providerById = new Map(providers.map((provider) => [provider.id, provider]));
+export function getSecretProvider(id) {
+    const provider = providerById.get(id);
+    if (!provider)
+        throw unprocessable(`Unsupported secret provider: ${id}`);
+    return provider;
+}
+export function listSecretProviders() {
+    return providers.map((provider) => provider.descriptor);
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/secrets/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../src/secrets/provider-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,SAAS,GAA2B;IACxC,sBAAsB;IACtB,yBAAyB;IACzB,wBAAwB;IACxB,aAAa;CACd,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACrD,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAkB;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,aAAa,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC1D,CAAC"}

package/dist/secrets/types.d.ts

@@ -0,0 +1,21 @@
+import type { SecretProvider, SecretProviderDescriptor } from "@rudderhq/shared";
+export interface StoredSecretVersionMaterial {
+    [key: string]: unknown;
+}
+export interface SecretProviderModule {
+    id: SecretProvider;
+    descriptor: SecretProviderDescriptor;
+    createVersion(input: {
+        value: string;
+        externalRef: string | null;
+    }): Promise<{
+        material: StoredSecretVersionMaterial;
+        valueSha256: string;
+        externalRef: string | null;
+    }>;
+    resolveVersion(input: {
+        material: StoredSecretVersionMaterial;
+        externalRef: string | null;
+    }): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secrets/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAEjF,MAAM,WAAW,2BAA2B;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAC;IACnB,UAAU,EAAE,wBAAwB,CAAC;IACrC,aAAa,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC;QACV,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,EAAE,2BAA2B,CAAC;QACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB"}

package/dist/secrets/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/secrets/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secrets/types.ts"],"names":[],"mappings":""}

package/dist/services/access.d.ts

@@ -0,0 +1,113 @@
+import type { Db } from "@rudderhq/db";
+import { organizationMemberships } from "@rudderhq/db";
+import type { PermissionKey, PrincipalType } from "@rudderhq/shared";
+type MembershipRow = typeof organizationMemberships.$inferSelect;
+type GrantInput = {
+    permissionKey: PermissionKey;
+    scope?: Record<string, unknown> | null;
+};
+export declare function accessService(db: Db): {
+    isInstanceAdmin: (userId: string | null | undefined) => Promise<boolean>;
+    canUser: (orgId: string, userId: string | null | undefined, permissionKey: PermissionKey) => Promise<boolean>;
+    hasPermission: (orgId: string, principalType: PrincipalType, principalId: string, permissionKey: PermissionKey) => Promise<boolean>;
+    getMembership: (orgId: string, principalType: PrincipalType, principalId: string) => Promise<MembershipRow | null>;
+    ensureMembership: (orgId: string, principalType: PrincipalType, principalId: string, membershipRole?: string | null, status?: "pending" | "active" | "suspended") => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }>;
+    listMembers: (orgId: string) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    listActiveUserMemberships: (orgId: string) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    copyActiveUserMemberships: (sourceCompanyId: string, targetCompanyId: string) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setMemberPermissions: (orgId: string, memberId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    } | null>;
+    promoteInstanceAdmin: (userId: string) => Promise<{
+        id: string;
+        updatedAt: Date;
+        createdAt: Date;
+        role: string;
+        userId: string;
+    }>;
+    demoteInstanceAdmin: (userId: string) => Promise<{
+        id: string;
+        updatedAt: Date;
+        createdAt: Date;
+        role: string;
+        userId: string;
+    }>;
+    listUserCompanyAccess: (userId: string) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setUserCompanyAccess: (userId: string, orgIds: string[]) => Promise<{
+        id: string;
+        status: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        principalType: string;
+        principalId: string;
+        membershipRole: string | null;
+    }[]>;
+    setPrincipalGrants: (orgId: string, principalType: PrincipalType, principalId: string, grants: GrantInput[], grantedByUserId: string | null) => Promise<void>;
+    listPrincipalGrants: (orgId: string, principalType: PrincipalType, principalId: string) => Promise<{
+        id: string;
+        updatedAt: Date;
+        orgId: string;
+        createdAt: Date;
+        permissionKey: string;
+        scope: Record<string, unknown> | null;
+        principalType: string;
+        principalId: string;
+        grantedByUserId: string | null;
+    }[]>;
+    setPrincipalPermission: (orgId: string, principalType: PrincipalType, principalId: string, permissionKey: PermissionKey, enabled: boolean, grantedByUserId: string | null, scope?: Record<string, unknown> | null) => Promise<void>;
+};
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/services/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/services/access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,uBAAuB,EAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,KAAK,aAAa,GAAG,OAAO,uBAAuB,CAAC,YAAY,CAAC;AACjE,KAAK,UAAU,GAAG;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC,CAAC;AAEF,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE;8BACK,MAAM,GAAG,IAAI,GAAG,SAAS,KAAG,OAAO,CAAC,OAAO,CAAC;qBAoD1E,MAAM,UACL,MAAM,GAAG,IAAI,GAAG,SAAS,iBAClB,aAAa,KAC3B,OAAO,CAAC,OAAO,CAAC;2BA1BV,MAAM,iBACE,aAAa,eACf,MAAM,iBACJ,aAAa,KAC3B,OAAO,CAAC,OAAO,CAAC;2BAtBV,MAAM,iBACE,aAAa,eACf,MAAM,KAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;8BA2KvB,MAAM,iBACE,aAAa,eACf,MAAM,mBACH,MAAM,GAAG,IAAI,WACrB,SAAS,GAAG,QAAQ,GAAG,WAAW;;;;;;;;;;yBAhIV,MAAM;;;;;;;;;;uCAQQ,MAAM;;;;;;;;;;iDAsLI,MAAM,mBAAmB,MAAM;;;;;;;;;;kCAvKhF,MAAM,YACH,MAAM,UACR,UAAU,EAAE,mBACH,MAAM,GAAG,IAAI;;;;;;;;;;mCAsCY,MAAM;;;;;;;kCAiBP,MAAM;;;;;;;oCAQJ,MAAM;;;;;;;;;;mCAQP,MAAM,UAAU,MAAM,EAAE;;;;;;;;;;gCA6D3D,MAAM,iBACE,aAAa,eACf,MAAM,UACX,UAAU,EAAE,mBACH,MAAM,GAAG,IAAI;iCA2CvB,MAAM,iBACE,aAAa,eACf,MAAM;;;;;;;;;;;oCAgBZ,MAAM,iBACE,aAAa,eACf,MAAM,iBACJ,aAAa,WACnB,OAAO,mBACC,MAAM,GAAG,IAAI,UACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;EAyExC"}