@selvajs/supabase-provider 0.14.2 → 0.14.4-beta.0

package/src/data/SupabaseComputeServerStore.ts

@@ -4,10 +4,23 @@ import {
 	type IComputeServerStore,
 	type ComputeConfig,
 	type ComputeServerConfig,
-	type RequestContext
+	type RequestContext,
+	type SecretVerificationFailure,
+	type SecretVerificationReport
 } from '@selvajs/platform';
-import { ProviderError } from '@selvajs/platform';
+// Secret crypto functions come from the server-only subpath (they use
+// `node:crypto`, kept out of the root barrel so client bundles don't pull it in).
+import { decryptSecret, encryptSecret, isEncryptedSecret } from '@selvajs/platform/computeServer';
 import type { ClientBundle } from './client.js';
+import { mapPostgrestError } from './errors.js';
+
+/** Explicit column list for `compute_servers` — every field `rowToServer` consumes. */
+const SERVER_COLUMNS =
+	'id, scope, owner_org_id, shared_with_all, label, server_url, api_key, timeout_ms, retry_count';
+/** Columns from the share join table read in `getConfig`. */
+const SHARE_COLUMNS = 'server_id, org_id';
+/** Columns from the per-org default table read in `getConfig`. */
+const ORG_DEFAULT_COLUMNS = 'org_id, default_server_id';
 
 /**
  * Compute-server config backed by three tables:
@@ -24,15 +37,26 @@ import type { ClientBundle } from './client.js';
  * callers (resolver, page loaders) using helpers in `@selvajs/platform`.
  */
 export class SupabaseComputeServerStore implements IComputeServerStore {
-	constructor(private readonly clients: ClientBundle) {}
+	/**
+	 * `secretKey` (from `SELVA_AT_REST_KEY`) encrypts `api_key` before it is
+	 * written to `compute_servers.api_key` and decrypts it on read, so the
+	 * Rhino.Compute credential never sits in the DB as plaintext — matching the
+	 * local provider's on-disk envelope. Optional only for legacy construction
+	 * paths (tests that never touch apiKeys); a store built without a key throws
+	 * if asked to write or read a secret. Wire it via `SupabaseDataProvider`.
+	 */
+	constructor(
+		private readonly clients: ClientBundle,
+		private readonly secretKey?: Buffer
+	) {}
 
 	async getConfig(ctx: RequestContext): Promise<ComputeConfig> {
 		const client = this.clients.forRequest(ctx);
 
 		const [serversRes, sharesRes, orgDefRes, platDefRes] = await Promise.all([
-			client.from('compute_servers').select('*'),
-			client.from('compute_server_shares').select('*'),
-			client.from('compute_server_org_defaults').select('*'),
+			client.from('compute_servers').select(SERVER_COLUMNS),
+			client.from('compute_server_shares').select(SHARE_COLUMNS),
+			client.from('compute_server_org_defaults').select(ORG_DEFAULT_COLUMNS),
 			client
 				.from('compute_server_platform_default')
 				.select('default_server_id')
@@ -40,10 +64,10 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 				.maybeSingle()
 		]);
 
-		if (serversRes.error) throw mapError(serversRes.error);
-		if (sharesRes.error) throw mapError(sharesRes.error);
-		if (orgDefRes.error) throw mapError(orgDefRes.error);
-		if (platDefRes.error) throw mapError(platDefRes.error);
+		if (serversRes.error) throw mapPostgrestError(serversRes.error);
+		if (sharesRes.error) throw mapPostgrestError(sharesRes.error);
+		if (orgDefRes.error) throw mapPostgrestError(orgDefRes.error);
+		if (platDefRes.error) throw mapPostgrestError(platDefRes.error);
 
 		// Build per-server `sharedWith` allowlists from the join table.
 		const sharedByServer = new Map<string, string[]>();
@@ -53,7 +77,9 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			sharedByServer.set(row.server_id, list);
 		}
 
-		const servers = (serversRes.data ?? []).map((row) => rowToServer(row, sharedByServer));
+		const servers = (serversRes.data ?? []).map((row) =>
+			rowToServer(this.decryptRowApiKey(row), sharedByServer)
+		);
 
 		const orgDefaults: Record<string, string> = {};
 		for (const row of orgDefRes.data ?? []) {
@@ -77,13 +103,13 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 
 		// Replace-all of platform rows.
 		const { error: delErr } = await client.from('compute_servers').delete().eq('scope', 'platform');
-		if (delErr) throw mapError(delErr);
+		if (delErr) throw mapPostgrestError(delErr);
 
 		if (platformOnly.length > 0) {
 			const { error: insErr } = await client
 				.from('compute_servers')
-				.insert(platformOnly.map(serverToRow));
-			if (insErr) throw mapError(insErr);
+				.insert(platformOnly.map((s) => serverToRow(this.encryptServerApiKey(s))));
+			if (insErr) throw mapPostgrestError(insErr);
 
 			// Rebuild the share rows for any non-`all` platform servers.
 			const shareRows = platformOnly.flatMap((s) =>
@@ -93,7 +119,7 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			);
 			if (shareRows.length > 0) {
 				const { error: shErr } = await client.from('compute_server_shares').insert(shareRows);
-				if (shErr) throw mapError(shErr);
+				if (shErr) throw mapPostgrestError(shErr);
 			}
 		}
 
@@ -101,7 +127,7 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			.from('compute_server_platform_default')
 			.update({ default_server_id: defaultServerId ?? null })
 			.eq('singleton', true);
-		if (defErr) throw mapError(defErr);
+		if (defErr) throw mapPostgrestError(defErr);
 	}
 
 	async saveOrgServers(
@@ -118,13 +144,13 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			.delete()
 			.eq('scope', 'org')
 			.eq('owner_org_id', orgId);
-		if (delErr) throw mapError(delErr);
+		if (delErr) throw mapPostgrestError(delErr);
 
 		if (orgOnly.length > 0) {
 			const { error: insErr } = await client
 				.from('compute_servers')
-				.insert(orgOnly.map(serverToRow));
-			if (insErr) throw mapError(insErr);
+				.insert(orgOnly.map((s) => serverToRow(this.encryptServerApiKey(s))));
+			if (insErr) throw mapPostgrestError(insErr);
 		}
 
 		if (defaultServerId === null) {
@@ -132,12 +158,12 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 				.from('compute_server_org_defaults')
 				.delete()
 				.eq('org_id', orgId);
-			if (error) throw mapError(error);
+			if (error) throw mapPostgrestError(error);
 		} else if (typeof defaultServerId === 'string') {
 			const { error } = await client
 				.from('compute_server_org_defaults')
 				.upsert({ org_id: orgId, default_server_id: defaultServerId });
-			if (error) throw mapError(error);
+			if (error) throw mapPostgrestError(error);
 		}
 	}
 
@@ -148,13 +174,13 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 				.from('compute_server_org_defaults')
 				.delete()
 				.eq('org_id', orgId);
-			if (error) throw mapError(error);
+			if (error) throw mapPostgrestError(error);
 			return;
 		}
 		const { error } = await client
 			.from('compute_server_org_defaults')
 			.upsert({ org_id: orgId, default_server_id: serverId });
-		if (error) throw mapError(error);
+		if (error) throw mapPostgrestError(error);
 	}
 
 	async deleteByOrg(ctx: RequestContext, orgId: string): Promise<void> {
@@ -166,7 +192,7 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			.from('compute_server_org_defaults')
 			.delete()
 			.eq('org_id', orgId);
-		if (defErr) throw mapError(defErr);
+		if (defErr) throw mapPostgrestError(defErr);
 
 		// Org-private servers owned by this org.
 		const { error: srvErr } = await client
@@ -174,14 +200,125 @@ export class SupabaseComputeServerStore implements IComputeServerStore {
 			.delete()
 			.eq('scope', 'org')
 			.eq('owner_org_id', orgId);
-		if (srvErr) throw mapError(srvErr);
+		if (srvErr) throw mapPostgrestError(srvErr);
 
 		// Strip this org from any platform server share allowlist.
 		const { error: shErr } = await client
 			.from('compute_server_shares')
 			.delete()
 			.eq('org_id', orgId);
-		if (shErr) throw mapError(shErr);
+		if (shErr) throw mapPostgrestError(shErr);
+	}
+
+	// ==========================================================================
+	// At-rest secret handling
+	// ==========================================================================
+
+	/**
+	 * Encrypt a server's `apiKey` before it is written to the DB. Idempotent —
+	 * an already-enveloped value is passed through, so a round-trip (read →
+	 * save) never double-encrypts. Throws if the store was built without a key
+	 * but a real secret needs writing, so we never silently persist plaintext.
+	 */
+	private encryptServerApiKey(s: ComputeServerConfig): ComputeServerConfig {
+		if (!s.apiKey) return s;
+		if (isEncryptedSecret(s.apiKey)) return s;
+		if (!this.secretKey) {
+			throw new Error(
+				'Cannot store a compute-server apiKey: SELVA_AT_REST_KEY is not configured. ' +
+					'Set it so secrets are encrypted at rest.'
+			);
+		}
+		return { ...s, apiKey: encryptSecret(s.apiKey, this.secretKey) };
+	}
+
+	/**
+	 * Decrypt a row's `api_key` on read. Tolerant, mirroring the local provider:
+	 * a row whose ciphertext can't be authenticated under the current key is
+	 * returned with `api_key: null` and a warning logged, so the page keeps
+	 * rendering (solves against that server fail later at Rhino.Compute). A
+	 * plaintext value that predates encryption is passed through unchanged and
+	 * surfaced by `verifySecrets()` — never silently dropped.
+	 */
+	private decryptRowApiKey(row: ServerRow): ServerRow {
+		if (!row.api_key) return row;
+		if (!isEncryptedSecret(row.api_key)) {
+			// Legacy/hand-inserted plaintext. Pass through so an existing key
+			// keeps working; verifySecrets() flags it for re-save via /admin/compute.
+			console.warn(
+				`[selva] compute_servers row "${row.label}" (${row.id}) has a plaintext api_key. ` +
+					'Re-save it via /admin/compute so it is stored encrypted.'
+			);
+			return row;
+		}
+		if (!this.secretKey) {
+			console.warn(
+				`[selva] Cannot decrypt api_key for compute server "${row.label}" (${row.id}): ` +
+					'SELVA_AT_REST_KEY is not configured. Returning without a key; solves will fail.'
+			);
+			return { ...row, api_key: null };
+		}
+		try {
+			return { ...row, api_key: decryptSecret(row.api_key, this.secretKey) };
+		} catch (cause) {
+			console.warn(
+				`[selva] Could not decrypt api_key for compute server "${row.label}" (${row.id}). ` +
+					'The stored ciphertext does not match the current SELVA_AT_REST_KEY. ' +
+					'This server will be returned without an apiKey; solves against it will fail. ' +
+					'Re-enter the key via /admin/compute, or restore the original SELVA_AT_REST_KEY.',
+				cause
+			);
+			return { ...row, api_key: null };
+		}
+	}
+
+	/**
+	 * Boot-time integrity check over every `compute_servers` row. Uses the
+	 * service client (no request context at boot) to read raw ciphertext, then
+	 * attempts to decrypt each `api_key`. Does NOT throw — returns a structured
+	 * report for boot health to drive `/api/health`.
+	 */
+	async verifySecrets(): Promise<SecretVerificationReport> {
+		const { data, error } = await this.clients.serviceClient
+			.from('compute_servers')
+			.select('id, label, api_key');
+		if (error) throw mapPostgrestError(error);
+
+		const failures: SecretVerificationFailure[] = [];
+		let plaintextFound = false;
+
+		for (const row of data ?? []) {
+			const apiKey = (row as { api_key: string | null }).api_key;
+			const id = (row as { id: string }).id;
+			const label = (row as { label: string }).label;
+			if (!apiKey) continue;
+			if (!isEncryptedSecret(apiKey)) {
+				plaintextFound = true;
+				failures.push({ serverId: id, serverLabel: label, reason: 'plaintext_on_disk' });
+				continue;
+			}
+			if (!this.secretKey) {
+				failures.push({
+					serverId: id,
+					serverLabel: label,
+					reason: 'key_mismatch',
+					cause: 'SELVA_AT_REST_KEY is not configured'
+				});
+				continue;
+			}
+			try {
+				decryptSecret(apiKey, this.secretKey);
+			} catch (cause) {
+				failures.push({
+					serverId: id,
+					serverLabel: label,
+					reason: 'key_mismatch',
+					cause: cause instanceof Error ? cause.message : String(cause)
+				});
+			}
+		}
+
+		return { ok: failures.length === 0, failures, plaintextFound };
 	}
 }
 
@@ -243,20 +380,3 @@ function serverToRow(s: ComputeServerConfig): ServerRow {
 		shared_with_all: false
 	};
 }
-
-interface PostgrestError {
-	code?: string;
-	message?: string;
-}
-
-function mapError(e: unknown): Error {
-	const pg = e as PostgrestError;
-	if (pg?.code === '23505') return new ProviderError(pg.message ?? 'Duplicate record', 409);
-	if (pg?.code === '23503') return new ProviderError(pg.message ?? 'Foreign key violation', 409);
-	if (e instanceof Error) return e;
-	if (e && typeof e === 'object') {
-		const obj = e as { message?: string; code?: string };
-		return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
-	}
-	return new Error(String(e));
-}

package/src/data/SupabaseDataProvider.ts

@@ -1,7 +1,8 @@
 import type { IDataProvider, IEventSink, IPlatformProjectGrantStore } from '@selvajs/platform';
 import { ProviderError } from '@selvajs/platform';
+import { decodeSecretKey } from '@selvajs/platform/computeServer';
 import type { ClientBundle, BuildClientOptions } from './client.js';
-import { buildClientBundle } from './client.js';
+import { buildClientBundle, clientBundleFromEnv } from './client.js';
 import { SupabaseEventSink } from './SupabaseEventSink.js';
 import { SupabaseSolveMetricSink } from './SupabaseSolveMetricSink.js';
 import { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
@@ -63,14 +64,15 @@ export class SupabaseDataProvider implements IDataProvider {
 
 	private constructor(
 		private readonly clients: ClientBundle,
-		events: IEventSink
+		events: IEventSink,
+		secretKey?: Buffer
 	) {
 		this.solveMetrics = new SupabaseSolveMetricSink(clients);
 		this.orgs = new SupabaseOrgStore(clients, events);
 		this.projects = new SupabaseProjectStore(clients, events);
 		this.definitions = new SupabaseDefinitionStore(clients, events);
 		this.invites = new SupabaseInviteStore(clients, events);
-		this.computeServer = new SupabaseComputeServerStore(clients);
+		this.computeServer = new SupabaseComputeServerStore(clients, secretKey);
 		this.shareLinks = new SupabaseShareLinkStore(clients, events);
 		this.userProfile = new SupabaseUserProfileProvider(clients);
 		this.permissions = new SupabasePlatformPermissionStore(clients);
@@ -82,27 +84,45 @@ export class SupabaseDataProvider implements IDataProvider {
 		env: Record<string, string | undefined>,
 		events?: IEventSink
 	): SupabaseDataProvider {
-		const supabaseUrl = env.SUPABASE_URL;
-		const anonKey = env.SUPABASE_ANON_KEY;
-		const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
-		if (!supabaseUrl) throw new Error('Missing required env var: SUPABASE_URL');
-		if (!anonKey) throw new Error('Missing required env var: SUPABASE_ANON_KEY');
-		if (!serviceRoleKey) throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
-		const bundle = buildClientBundle({ supabaseUrl, anonKey, serviceRoleKey });
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+		// Bundle-only env parse (URL + anon + service-role) is shared with
+		// `clientBundleFromEnv`; the full data provider additionally requires the
+		// at-rest key below.
+		const bundle = clientBundleFromEnv(env);
+		// Required so compute-server apiKeys are encrypted at rest in the DB —
+		// same guarantee (and same key) as the local provider's on-disk envelope.
+		if (!env.SELVA_AT_REST_KEY) {
+			throw new Error(
+				'Missing required env var: SELVA_AT_REST_KEY (32-byte hex or base64). ' +
+					'Required to encrypt compute-server API keys at rest. ' +
+					"Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
+			);
+		}
+		const secretKey = decodeSecretKey(env.SELVA_AT_REST_KEY);
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
 	}
 
-	static create(opts: BuildClientOptions, events?: IEventSink): SupabaseDataProvider {
+	static create(
+		opts: BuildClientOptions,
+		events?: IEventSink,
+		secretKey?: Buffer
+	): SupabaseDataProvider {
 		const bundle = buildClientBundle(opts);
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
 	}
 
 	/**
 	 * Build from a pre-existing `ClientBundle`. Useful for tests or advanced
 	 * cases that need to inject a custom event sink or share a bundle externally.
+	 * `secretKey` is optional here — omit it only when the caller never touches
+	 * compute-server apiKeys (writes without a key throw rather than persist
+	 * plaintext).
 	 */
-	static fromBundle(bundle: ClientBundle, events?: IEventSink): SupabaseDataProvider {
-		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle));
+	static fromBundle(
+		bundle: ClientBundle,
+		events?: IEventSink,
+		secretKey?: Buffer
+	): SupabaseDataProvider {
+		return new SupabaseDataProvider(bundle, events ?? new SupabaseEventSink(bundle), secretKey);
 	}
 
 	/**