@shipfox/api-secrets 2.0.0

package/dist/db/cap.js

@@ -0,0 +1,39 @@
+import { and, count, eq, notLike, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { secretValues } from './schema/values.js';
+import { secretVariables } from './schema/variables.js';
+export async function countWorkspaceEntries(workspaceId, tx) {
+    const executor = tx ?? db();
+    const valueCount = executor.select({
+        count: count().as('value_count')
+    }).from(secretValues).where(and(eq(secretValues.workspaceId, workspaceId), notLike(secretValues.namespace, 'system/%'))).as('value_count');
+    const variableCount = executor.select({
+        count: count().as('variable_count')
+    }).from(secretVariables).where(and(eq(secretVariables.workspaceId, workspaceId), notLike(secretVariables.namespace, 'system/%'))).as('variable_count');
+    const [row] = await executor.select({
+        value: sql`${valueCount.count} + ${variableCount.count}`
+    }).from(valueCount).crossJoin(variableCount);
+    return Number(row?.value ?? 0);
+}
+export async function countPublicEntriesByResource(tx) {
+    const executor = tx ?? db();
+    const [secretCount, variableCount] = await Promise.all([
+        executor.select({
+            count: count().as('secret_count')
+        }).from(secretValues).where(notLike(secretValues.namespace, 'system/%')),
+        executor.select({
+            count: count().as('variable_count')
+        }).from(secretVariables).where(notLike(secretVariables.namespace, 'system/%'))
+    ]);
+    return {
+        secrets: Number(secretCount[0]?.count ?? 0),
+        variables: Number(variableCount[0]?.count ?? 0)
+    };
+}
+export async function lockWorkspaceEntries(workspaceId, tx) {
+    await tx.execute(sql`
+    SELECT pg_advisory_xact_lock(hashtext('shipfox_secrets_workspace_cap'), hashtext(${workspaceId}))
+  `);
+}
+
+//# sourceMappingURL=cap.js.map

package/dist/db/cap.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/cap.ts"],"sourcesContent":["import {and, count, eq, notLike, sql} from 'drizzle-orm';\nimport {db, type Tx} from './db.js';\nimport {secretValues} from './schema/values.js';\nimport {secretVariables} from './schema/variables.js';\n\nexport async function countWorkspaceEntries(workspaceId: string, tx?: Tx): Promise<number> {\n  const executor = tx ?? db();\n  const valueCount = executor\n    .select({count: count().as('value_count')})\n    .from(secretValues)\n    .where(\n      and(eq(secretValues.workspaceId, workspaceId), notLike(secretValues.namespace, 'system/%')),\n    )\n    .as('value_count');\n  const variableCount = executor\n    .select({count: count().as('variable_count')})\n    .from(secretVariables)\n    .where(\n      and(\n        eq(secretVariables.workspaceId, workspaceId),\n        notLike(secretVariables.namespace, 'system/%'),\n      ),\n    )\n    .as('variable_count');\n  const [row] = await executor\n    .select({value: sql<number>`${valueCount.count} + ${variableCount.count}`})\n    .from(valueCount)\n    .crossJoin(variableCount);\n\n  return Number(row?.value ?? 0);\n}\n\nexport async function countPublicEntriesByResource(\n  tx?: Tx,\n): Promise<{secrets: number; variables: number}> {\n  const executor = tx ?? db();\n  const [secretCount, variableCount] = await Promise.all([\n    executor\n      .select({count: count().as('secret_count')})\n      .from(secretValues)\n      .where(notLike(secretValues.namespace, 'system/%')),\n    executor\n      .select({count: count().as('variable_count')})\n      .from(secretVariables)\n      .where(notLike(secretVariables.namespace, 'system/%')),\n  ]);\n\n  return {\n    secrets: Number(secretCount[0]?.count ?? 0),\n    variables: Number(variableCount[0]?.count ?? 0),\n  };\n}\n\nexport async function lockWorkspaceEntries(workspaceId: string, tx: Tx): Promise<void> {\n  await tx.execute(sql`\n    SELECT pg_advisory_xact_lock(hashtext('shipfox_secrets_workspace_cap'), hashtext(${workspaceId}))\n  `);\n}\n"],"names":["and","count","eq","notLike","sql","db","secretValues","secretVariables","countWorkspaceEntries","workspaceId","tx","executor","valueCount","select","as","from","where","namespace","variableCount","row","value","crossJoin","Number","countPublicEntriesByResource","secretCount","Promise","all","secrets","variables","lockWorkspaceEntries","execute"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,KAAK,EAAEC,EAAE,EAAEC,OAAO,EAAEC,GAAG,QAAO,cAAc;AACzD,SAAQC,EAAE,QAAgB,UAAU;AACpC,SAAQC,YAAY,QAAO,qBAAqB;AAChD,SAAQC,eAAe,QAAO,wBAAwB;AAEtD,OAAO,eAAeC,sBAAsBC,WAAmB,EAAEC,EAAO;IACtE,MAAMC,WAAWD,MAAML;IACvB,MAAMO,aAAaD,SAChBE,MAAM,CAAC;QAACZ,OAAOA,QAAQa,EAAE,CAAC;IAAc,GACxCC,IAAI,CAACT,cACLU,KAAK,CACJhB,IAAIE,GAAGI,aAAaG,WAAW,EAAEA,cAAcN,QAAQG,aAAaW,SAAS,EAAE,cAEhFH,EAAE,CAAC;IACN,MAAMI,gBAAgBP,SACnBE,MAAM,CAAC;QAACZ,OAAOA,QAAQa,EAAE,CAAC;IAAiB,GAC3CC,IAAI,CAACR,iBACLS,KAAK,CACJhB,IACEE,GAAGK,gBAAgBE,WAAW,EAAEA,cAChCN,QAAQI,gBAAgBU,SAAS,EAAE,cAGtCH,EAAE,CAAC;IACN,MAAM,CAACK,IAAI,GAAG,MAAMR,SACjBE,MAAM,CAAC;QAACO,OAAOhB,GAAW,CAAC,EAAEQ,WAAWX,KAAK,CAAC,GAAG,EAAEiB,cAAcjB,KAAK,CAAC,CAAC;IAAA,GACxEc,IAAI,CAACH,YACLS,SAAS,CAACH;IAEb,OAAOI,OAAOH,KAAKC,SAAS;AAC9B;AAEA,OAAO,eAAeG,6BACpBb,EAAO;IAEP,MAAMC,WAAWD,MAAML;IACvB,MAAM,CAACmB,aAAaN,cAAc,GAAG,MAAMO,QAAQC,GAAG,CAAC;QACrDf,SACGE,MAAM,CAAC;YAACZ,OAAOA,QAAQa,EAAE,CAAC;QAAe,GACzCC,IAAI,CAACT,cACLU,KAAK,CAACb,QAAQG,aAAaW,SAAS,EAAE;QACzCN,SACGE,MAAM,CAAC;YAACZ,OAAOA,QAAQa,EAAE,CAAC;QAAiB,GAC3CC,IAAI,CAACR,iBACLS,KAAK,CAACb,QAAQI,gBAAgBU,SAAS,EAAE;KAC7C;IAED,OAAO;QACLU,SAASL,OAAOE,WAAW,CAAC,EAAE,EAAEvB,SAAS;QACzC2B,WAAWN,OAAOJ,aAAa,CAAC,EAAE,EAAEjB,SAAS;IAC/C;AACF;AAEA,OAAO,eAAe4B,qBAAqBpB,WAAmB,EAAEC,EAAM;IACpE,MAAMA,GAAGoB,OAAO,CAAC1B,GAAG,CAAC;qFAC8D,EAAEK,YAAY;EACjG,CAAC;AACH"}

package/dist/db/data-keys.d.ts

@@ -0,0 +1,24 @@
+import { type Tx } from './db.js';
+import { type DataKey } from './schema/data-keys.js';
+export declare function getDataKey(workspaceId: string, tx?: Tx): Promise<DataKey | undefined>;
+export declare function insertDataKeyIfAbsent(dataKey: {
+    workspaceId: string;
+    wrappedDek: string;
+    kekVersion: string;
+}, tx?: Tx): Promise<boolean>;
+export declare function updateDataKeyWrapCas(params: {
+    workspaceId: string;
+    oldKekVersion: string;
+    wrappedDek: string;
+    kekVersion: string;
+}, tx?: Tx): Promise<boolean>;
+export declare function listDataKeyVersions(knownVersions: string[], params?: {
+    workspaceIds?: string[] | undefined;
+}): Promise<string[]>;
+export declare function listDataKeysPage(params: {
+    afterWorkspaceId?: string | undefined;
+    limit: number;
+    versions?: string[] | undefined;
+    workspaceIds?: string[] | undefined;
+}): Promise<DataKey[]>;
+//# sourceMappingURL=data-keys.d.ts.map

package/dist/db/data-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-keys.d.ts","sourceRoot":"","sources":["../../src/db/data-keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAK,KAAK,EAAE,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,KAAK,OAAO,EAA4B,MAAM,uBAAuB,CAAC;AAE9E,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAS3F;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,EACtE,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,EAC5F,EAAE,CAAC,EAAE,EAAE,GACN,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,GAAE;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAAM,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAenB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAqBrB"}

package/dist/db/data-keys.js

@@ -0,0 +1,61 @@
+import { and, eq, gt, inArray, notInArray, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { secretDataKeys, toDataKey } from './schema/data-keys.js';
+export async function getDataKey(workspaceId, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.select().from(secretDataKeys).where(eq(secretDataKeys.workspaceId, workspaceId)).limit(1);
+    const row = rows[0];
+    return row ? toDataKey(row) : undefined;
+}
+export async function insertDataKeyIfAbsent(dataKey, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.insert(secretDataKeys).values(dataKey).onConflictDoNothing({
+        target: secretDataKeys.workspaceId
+    }).returning({
+        workspaceId: secretDataKeys.workspaceId
+    });
+    return rows.length > 0;
+}
+export async function updateDataKeyWrapCas(params, tx) {
+    const executor = tx ?? db();
+    const rows = await executor.update(secretDataKeys).set({
+        wrappedDek: params.wrappedDek,
+        kekVersion: params.kekVersion,
+        rotatedAt: sql`NOW()`
+    }).where(and(eq(secretDataKeys.workspaceId, params.workspaceId), eq(secretDataKeys.kekVersion, params.oldKekVersion))).returning({
+        workspaceId: secretDataKeys.workspaceId
+    });
+    return rows.length > 0;
+}
+export async function listDataKeyVersions(knownVersions, params = {}) {
+    if (params.workspaceIds?.length === 0) return [];
+    const filters = [];
+    if (knownVersions.length > 0) {
+        filters.push(notInArray(secretDataKeys.kekVersion, knownVersions));
+    }
+    if (params.workspaceIds) {
+        filters.push(inArray(secretDataKeys.workspaceId, params.workspaceIds));
+    }
+    const rows = await db().selectDistinct({
+        kekVersion: secretDataKeys.kekVersion
+    }).from(secretDataKeys).where(filters.length > 0 ? and(...filters) : undefined);
+    return rows.map((row)=>row.kekVersion);
+}
+export async function listDataKeysPage(params) {
+    if (params.versions && params.versions.length === 0) return [];
+    if (params.workspaceIds?.length === 0) return [];
+    const filters = [];
+    if (params.afterWorkspaceId) {
+        filters.push(gt(secretDataKeys.workspaceId, params.afterWorkspaceId));
+    }
+    if (params.versions) {
+        filters.push(inArray(secretDataKeys.kekVersion, params.versions));
+    }
+    if (params.workspaceIds) {
+        filters.push(inArray(secretDataKeys.workspaceId, params.workspaceIds));
+    }
+    const rows = await db().select().from(secretDataKeys).where(filters.length > 0 ? and(...filters) : undefined).orderBy(secretDataKeys.workspaceId).limit(params.limit);
+    return rows.map(toDataKey);
+}
+
+//# sourceMappingURL=data-keys.js.map

package/dist/db/data-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/data-keys.ts"],"sourcesContent":["import {and, eq, gt, inArray, notInArray, type SQL, sql} from 'drizzle-orm';\nimport {db, type Tx} from './db.js';\nimport {type DataKey, secretDataKeys, toDataKey} from './schema/data-keys.js';\n\nexport async function getDataKey(workspaceId: string, tx?: Tx): Promise<DataKey | undefined> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .select()\n    .from(secretDataKeys)\n    .where(eq(secretDataKeys.workspaceId, workspaceId))\n    .limit(1);\n  const row = rows[0];\n  return row ? toDataKey(row) : undefined;\n}\n\nexport async function insertDataKeyIfAbsent(\n  dataKey: {workspaceId: string; wrappedDek: string; kekVersion: string},\n  tx?: Tx,\n): Promise<boolean> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .insert(secretDataKeys)\n    .values(dataKey)\n    .onConflictDoNothing({\n      target: secretDataKeys.workspaceId,\n    })\n    .returning({workspaceId: secretDataKeys.workspaceId});\n  return rows.length > 0;\n}\n\nexport async function updateDataKeyWrapCas(\n  params: {workspaceId: string; oldKekVersion: string; wrappedDek: string; kekVersion: string},\n  tx?: Tx,\n): Promise<boolean> {\n  const executor = tx ?? db();\n  const rows = await executor\n    .update(secretDataKeys)\n    .set({\n      wrappedDek: params.wrappedDek,\n      kekVersion: params.kekVersion,\n      rotatedAt: sql`NOW()`,\n    })\n    .where(\n      and(\n        eq(secretDataKeys.workspaceId, params.workspaceId),\n        eq(secretDataKeys.kekVersion, params.oldKekVersion),\n      ),\n    )\n    .returning({workspaceId: secretDataKeys.workspaceId});\n  return rows.length > 0;\n}\n\nexport async function listDataKeyVersions(\n  knownVersions: string[],\n  params: {workspaceIds?: string[] | undefined} = {},\n): Promise<string[]> {\n  if (params.workspaceIds?.length === 0) return [];\n\n  const filters: SQL[] = [];\n  if (knownVersions.length > 0) {\n    filters.push(notInArray(secretDataKeys.kekVersion, knownVersions));\n  }\n  if (params.workspaceIds) {\n    filters.push(inArray(secretDataKeys.workspaceId, params.workspaceIds));\n  }\n  const rows = await db()\n    .selectDistinct({kekVersion: secretDataKeys.kekVersion})\n    .from(secretDataKeys)\n    .where(filters.length > 0 ? and(...filters) : undefined);\n  return rows.map((row) => row.kekVersion);\n}\n\nexport async function listDataKeysPage(params: {\n  afterWorkspaceId?: string | undefined;\n  limit: number;\n  versions?: string[] | undefined;\n  workspaceIds?: string[] | undefined;\n}): Promise<DataKey[]> {\n  if (params.versions && params.versions.length === 0) return [];\n  if (params.workspaceIds?.length === 0) return [];\n\n  const filters: SQL[] = [];\n  if (params.afterWorkspaceId) {\n    filters.push(gt(secretDataKeys.workspaceId, params.afterWorkspaceId));\n  }\n  if (params.versions) {\n    filters.push(inArray(secretDataKeys.kekVersion, params.versions));\n  }\n  if (params.workspaceIds) {\n    filters.push(inArray(secretDataKeys.workspaceId, params.workspaceIds));\n  }\n  const rows = await db()\n    .select()\n    .from(secretDataKeys)\n    .where(filters.length > 0 ? and(...filters) : undefined)\n    .orderBy(secretDataKeys.workspaceId)\n    .limit(params.limit);\n  return rows.map(toDataKey);\n}\n"],"names":["and","eq","gt","inArray","notInArray","sql","db","secretDataKeys","toDataKey","getDataKey","workspaceId","tx","executor","rows","select","from","where","limit","row","undefined","insertDataKeyIfAbsent","dataKey","insert","values","onConflictDoNothing","target","returning","length","updateDataKeyWrapCas","params","update","set","wrappedDek","kekVersion","rotatedAt","oldKekVersion","listDataKeyVersions","knownVersions","workspaceIds","filters","push","selectDistinct","map","listDataKeysPage","versions","afterWorkspaceId","orderBy"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,UAAU,EAAYC,GAAG,QAAO,cAAc;AAC5E,SAAQC,EAAE,QAAgB,UAAU;AACpC,SAAsBC,cAAc,EAAEC,SAAS,QAAO,wBAAwB;AAE9E,OAAO,eAAeC,WAAWC,WAAmB,EAAEC,EAAO;IAC3D,MAAMC,WAAWD,MAAML;IACvB,MAAMO,OAAO,MAAMD,SAChBE,MAAM,GACNC,IAAI,CAACR,gBACLS,KAAK,CAACf,GAAGM,eAAeG,WAAW,EAAEA,cACrCO,KAAK,CAAC;IACT,MAAMC,MAAML,IAAI,CAAC,EAAE;IACnB,OAAOK,MAAMV,UAAUU,OAAOC;AAChC;AAEA,OAAO,eAAeC,sBACpBC,OAAsE,EACtEV,EAAO;IAEP,MAAMC,WAAWD,MAAML;IACvB,MAAMO,OAAO,MAAMD,SAChBU,MAAM,CAACf,gBACPgB,MAAM,CAACF,SACPG,mBAAmB,CAAC;QACnBC,QAAQlB,eAAeG,WAAW;IACpC,GACCgB,SAAS,CAAC;QAAChB,aAAaH,eAAeG,WAAW;IAAA;IACrD,OAAOG,KAAKc,MAAM,GAAG;AACvB;AAEA,OAAO,eAAeC,qBACpBC,MAA4F,EAC5FlB,EAAO;IAEP,MAAMC,WAAWD,MAAML;IACvB,MAAMO,OAAO,MAAMD,SAChBkB,MAAM,CAACvB,gBACPwB,GAAG,CAAC;QACHC,YAAYH,OAAOG,UAAU;QAC7BC,YAAYJ,OAAOI,UAAU;QAC7BC,WAAW7B,GAAG,CAAC,KAAK,CAAC;IACvB,GACCW,KAAK,CACJhB,IACEC,GAAGM,eAAeG,WAAW,EAAEmB,OAAOnB,WAAW,GACjDT,GAAGM,eAAe0B,UAAU,EAAEJ,OAAOM,aAAa,IAGrDT,SAAS,CAAC;QAAChB,aAAaH,eAAeG,WAAW;IAAA;IACrD,OAAOG,KAAKc,MAAM,GAAG;AACvB;AAEA,OAAO,eAAeS,oBACpBC,aAAuB,EACvBR,SAAgD,CAAC,CAAC;IAElD,IAAIA,OAAOS,YAAY,EAAEX,WAAW,GAAG,OAAO,EAAE;IAEhD,MAAMY,UAAiB,EAAE;IACzB,IAAIF,cAAcV,MAAM,GAAG,GAAG;QAC5BY,QAAQC,IAAI,CAACpC,WAAWG,eAAe0B,UAAU,EAAEI;IACrD;IACA,IAAIR,OAAOS,YAAY,EAAE;QACvBC,QAAQC,IAAI,CAACrC,QAAQI,eAAeG,WAAW,EAAEmB,OAAOS,YAAY;IACtE;IACA,MAAMzB,OAAO,MAAMP,KAChBmC,cAAc,CAAC;QAACR,YAAY1B,eAAe0B,UAAU;IAAA,GACrDlB,IAAI,CAACR,gBACLS,KAAK,CAACuB,QAAQZ,MAAM,GAAG,IAAI3B,OAAOuC,WAAWpB;IAChD,OAAON,KAAK6B,GAAG,CAAC,CAACxB,MAAQA,IAAIe,UAAU;AACzC;AAEA,OAAO,eAAeU,iBAAiBd,MAKtC;IACC,IAAIA,OAAOe,QAAQ,IAAIf,OAAOe,QAAQ,CAACjB,MAAM,KAAK,GAAG,OAAO,EAAE;IAC9D,IAAIE,OAAOS,YAAY,EAAEX,WAAW,GAAG,OAAO,EAAE;IAEhD,MAAMY,UAAiB,EAAE;IACzB,IAAIV,OAAOgB,gBAAgB,EAAE;QAC3BN,QAAQC,IAAI,CAACtC,GAAGK,eAAeG,WAAW,EAAEmB,OAAOgB,gBAAgB;IACrE;IACA,IAAIhB,OAAOe,QAAQ,EAAE;QACnBL,QAAQC,IAAI,CAACrC,QAAQI,eAAe0B,UAAU,EAAEJ,OAAOe,QAAQ;IACjE;IACA,IAAIf,OAAOS,YAAY,EAAE;QACvBC,QAAQC,IAAI,CAACrC,QAAQI,eAAeG,WAAW,EAAEmB,OAAOS,YAAY;IACtE;IACA,MAAMzB,OAAO,MAAMP,KAChBQ,MAAM,GACNC,IAAI,CAACR,gBACLS,KAAK,CAACuB,QAAQZ,MAAM,GAAG,IAAI3B,OAAOuC,WAAWpB,WAC7C2B,OAAO,CAACvC,eAAeG,WAAW,EAClCO,KAAK,CAACY,OAAOZ,KAAK;IACrB,OAAOJ,KAAK6B,GAAG,CAAClC;AAClB"}