@shipfox/api-secrets 4.0.0 → 6.0.0

package/src/presentation/routes/index.ts

@@ -1,5 +1,7 @@
 import {AUTH_USER} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import type {RouteGroup} from '@shipfox/node-fastify';
+import {createManagementAccess} from './auth.js';
 import {batchSecretsRoute} from './batch-secrets.js';
 import {batchVariablesRoute} from './batch-variables.js';
 import {deleteSecretRoute} from './delete-secret.js';
@@ -10,20 +12,23 @@ import {listVariablesRoute} from './list-variables.js';
 import {putSecretRoute} from './put-secret.js';
 import {putVariableRoute} from './put-variable.js';
 
-export const secretsRoutes: RouteGroup[] = [
-  {
-    prefix: '/workspaces/:workspaceId',
-    auth: AUTH_USER,
-    routes: [
-      listSecretsRoute,
-      putSecretRoute,
-      batchSecretsRoute,
-      deleteSecretRoute,
-      listVariablesRoute,
-      getVariableRoute,
-      putVariableRoute,
-      batchVariablesRoute,
-      deleteVariableRoute,
-    ],
-  },
-];
+export function createSecretsRoutes(projects: ProjectsModuleClient): RouteGroup[] {
+  const access = createManagementAccess(projects);
+  return [
+    {
+      prefix: '/workspaces/:workspaceId',
+      auth: AUTH_USER,
+      routes: [
+        listSecretsRoute(access),
+        putSecretRoute(access),
+        batchSecretsRoute(access),
+        deleteSecretRoute(access),
+        listVariablesRoute(access),
+        getVariableRoute(access),
+        putVariableRoute(access),
+        batchVariablesRoute(access),
+        deleteVariableRoute(access),
+      ],
+    },
+  ];
+}

package/src/presentation/routes/list-secrets.ts

@@ -3,39 +3,41 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {listManagedSecrets} from '#core/index.js';
 import {toSecretDto} from '#presentation/dto/index.js';
-import {requireManagementRead} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {decodeManagementCursor, encodeManagementCursor} from './cursor.js';
 import {translateManagementError} from './errors.js';
 
-export const listSecretsRoute = defineRoute({
-  method: 'GET',
-  path: '/secrets',
-  description: 'List user-managed secrets for a workspace or project scope.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    querystring: listSecretsQuerySchema,
-    response: {200: listSecretsResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    const {project_id: projectId, limit, cursor} = request.query;
-    const decodedCursor = decodeManagementCursor(cursor);
-    if (cursor && !decodedCursor) {
-      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
-    }
+export function listSecretsRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'GET',
+    path: '/secrets',
+    description: 'List user-managed secrets for a workspace or project scope.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      querystring: listSecretsQuerySchema,
+      response: {200: listSecretsResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      const {project_id: projectId, limit, cursor} = request.query;
+      const decodedCursor = decodeManagementCursor(cursor);
+      if (cursor && !decodedCursor) {
+        throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
+      }
 
-    await requireManagementRead({request, workspaceId, projectId});
-    const result = await listManagedSecrets({
-      workspaceId,
-      projectId,
-      limit,
-      cursor: decodedCursor ?? undefined,
-    });
+      await accessControl.requireManagementRead({request, workspaceId, projectId});
+      const result = await listManagedSecrets({
+        workspaceId,
+        projectId,
+        limit,
+        cursor: decodedCursor ?? undefined,
+      });
 
-    return {
-      secrets: result.secrets.map(toSecretDto),
-      next_cursor: result.nextCursor ? encodeManagementCursor(result.nextCursor) : null,
-    };
-  },
-});
+      return {
+        secrets: result.secrets.map(toSecretDto),
+        next_cursor: result.nextCursor ? encodeManagementCursor(result.nextCursor) : null,
+      };
+    },
+  });
+}

package/src/presentation/routes/list-variables.ts

@@ -3,39 +3,41 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {listManagedVariables} from '#core/index.js';
 import {toVariableListItemDto} from '#presentation/dto/index.js';
-import {requireManagementRead} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {decodeManagementCursor, encodeManagementCursor} from './cursor.js';
 import {translateManagementError} from './errors.js';
 
-export const listVariablesRoute = defineRoute({
-  method: 'GET',
-  path: '/variables',
-  description: 'List user-managed variables for a workspace or project scope.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    querystring: listVariablesQuerySchema,
-    response: {200: listVariablesResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    const {project_id: projectId, limit, cursor} = request.query;
-    const decodedCursor = decodeManagementCursor(cursor);
-    if (cursor && !decodedCursor) {
-      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
-    }
+export function listVariablesRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'GET',
+    path: '/variables',
+    description: 'List user-managed variables for a workspace or project scope.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      querystring: listVariablesQuerySchema,
+      response: {200: listVariablesResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      const {project_id: projectId, limit, cursor} = request.query;
+      const decodedCursor = decodeManagementCursor(cursor);
+      if (cursor && !decodedCursor) {
+        throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
+      }
 
-    await requireManagementRead({request, workspaceId, projectId});
-    const result = await listManagedVariables({
-      workspaceId,
-      projectId,
-      limit,
-      cursor: decodedCursor ?? undefined,
-    });
+      await accessControl.requireManagementRead({request, workspaceId, projectId});
+      const result = await listManagedVariables({
+        workspaceId,
+        projectId,
+        limit,
+        cursor: decodedCursor ?? undefined,
+      });
 
-    return {
-      variables: result.variables.map(toVariableListItemDto),
-      next_cursor: result.nextCursor ? encodeManagementCursor(result.nextCursor) : null,
-    };
-  },
-});
+      return {
+        variables: result.variables.map(toVariableListItemDto),
+        next_cursor: result.nextCursor ? encodeManagementCursor(result.nextCursor) : null,
+      };
+    },
+  });
+}

package/src/presentation/routes/management.test.ts

@@ -4,7 +4,7 @@ import {
   setUserContext,
   type UserContextMembership,
 } from '@shipfox/api-auth-context';
-import {ProjectNotFoundError, requireProjectForWorkspace} from '@shipfox/api-projects';
+import {projectsInterModuleContract} from '@shipfox/api-projects-dto';
 import {
   SECRET_CREATED,
   SECRET_DELETED,
@@ -12,17 +12,22 @@ import {
   VARIABLE_CREATED,
   VARIABLE_DELETED,
 } from '@shipfox/api-secrets-dto';
+import {createInterModuleKnownError, defineInterModulePresentation} from '@shipfox/inter-module';
 import type {AuthMethod, FastifyRequest} from '@shipfox/node-fastify';
 import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import {createFakeInterModuleClients} from '@shipfox/node-module/inter-module/testing';
 import {and, eq, isNull, sql} from 'drizzle-orm';
 import {setSecrets} from '#core/index.js';
 import {db, secretsOutbox, secretValues, secretVariables} from '#db/index.js';
-import {secretsRoutes} from './index.js';
+import {createSecretsRoutes} from './index.js';
 
-vi.mock('@shipfox/api-projects', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('@shipfox/api-projects')>();
-  return {...actual, requireProjectForWorkspace: vi.fn()};
-});
+const requireProjectForWorkspace = vi.fn();
+const projects = createFakeInterModuleClients({
+  projects: defineInterModulePresentation(projectsInterModuleContract, {
+    getProjectById: () => ({project: null}),
+    requireProjectForWorkspace: async (input) => await requireProjectForWorkspace(input),
+  }),
+}).projects;
 
 const USER_ID = '11111111-1111-4111-8111-111111111111';
 let authenticatedMemberships: UserContextMembership[] = [];
@@ -56,16 +61,21 @@ describe('secrets management routes', () => {
     workspaceId = crypto.randomUUID();
     projectId = crypto.randomUUID();
     authenticatedMemberships = [{workspaceId, role: 'admin'}];
-    vi.mocked(requireProjectForWorkspace).mockResolvedValue({
-      id: projectId,
-      workspaceId,
-      name: 'Project',
-      sourceConnectionId: crypto.randomUUID(),
-      sourceExternalRepositoryId: 'repo-1',
-      createdAt: new Date(),
-      updatedAt: new Date(),
+    requireProjectForWorkspace.mockResolvedValue({
+      project: {
+        id: projectId,
+        workspaceId,
+        name: 'Project',
+        sourceConnectionId: crypto.randomUUID(),
+        sourceExternalRepositoryId: 'repo-1',
+        createdAt: new Date(),
+      },
+    });
+    app = await createApp({
+      auth: [fakeUserAuth],
+      routes: createSecretsRoutes(projects),
+      swagger: false,
     });
-    app = await createApp({auth: [fakeUserAuth], routes: secretsRoutes, swagger: false});
     await app.ready();
   });
 
@@ -76,7 +86,7 @@ describe('secrets management routes', () => {
   });
 
   it('registers management routes under user auth', () => {
-    expect(secretsRoutes[0]?.auth).toBe(AUTH_USER);
+    expect(createSecretsRoutes(projects)[0]?.auth).toBe(AUTH_USER);
   });
 
   it('returns 401 unauthenticated and 403 for non-members', async () => {
@@ -423,8 +433,12 @@ describe('secrets management routes', () => {
   });
 
   it('returns 404 when project_id does not belong to the workspace', async () => {
-    vi.mocked(requireProjectForWorkspace).mockRejectedValueOnce(
-      new ProjectNotFoundError(projectId),
+    requireProjectForWorkspace.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        projectsInterModuleContract.methods.requireProjectForWorkspace,
+        'project-not-found',
+        {projectId},
+      ),
     );
 
     const res = await app.inject({

package/src/presentation/routes/put-secret.ts

@@ -7,33 +7,35 @@ import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {setManagedSecrets} from '#core/index.js';
 import {toSecretDto} from '#presentation/dto/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 import {secretWarnings} from './warnings.js';
 
-export const putSecretRoute = defineRoute({
-  method: 'PUT',
-  path: '/secrets/:key',
-  description: 'Create or update a user-managed secret.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
-    body: putSecretBodySchema,
-    response: {200: putSecretResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId, key} = request.params;
-    const {project_id: projectId, value} = request.body;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
-    const entries = [{key, value}];
-    const [secret] = await setManagedSecrets({
-      workspaceId,
-      projectId,
-      actorId: access.userId,
-      entries,
-    });
-    if (!secret) throw new Error('Secret write returned no row');
+export function putSecretRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'PUT',
+    path: '/secrets/:key',
+    description: 'Create or update a user-managed secret.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
+      body: putSecretBodySchema,
+      response: {200: putSecretResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId, key} = request.params;
+      const {project_id: projectId, value} = request.body;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
+      const entries = [{key, value}];
+      const [secret] = await setManagedSecrets({
+        workspaceId,
+        projectId,
+        actorId: access.userId,
+        entries,
+      });
+      if (!secret) throw new Error('Secret write returned no row');
 
-    return {secret: toSecretDto(secret), warnings: secretWarnings(entries)};
-  },
-});
+      return {secret: toSecretDto(secret), warnings: secretWarnings(entries)};
+    },
+  });
+}

package/src/presentation/routes/put-variable.ts

@@ -7,33 +7,35 @@ import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {setManagedVariables} from '#core/index.js';
 import {toVariableDto} from '#presentation/dto/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 import {variableWarnings} from './warnings.js';
 
-export const putVariableRoute = defineRoute({
-  method: 'PUT',
-  path: '/variables/:key',
-  description: 'Create or update a user-managed variable.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
-    body: putVariableBodySchema,
-    response: {200: putVariableResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId, key} = request.params;
-    const {project_id: projectId, value} = request.body;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
-    const entries = [{key, value}];
-    const [variable] = await setManagedVariables({
-      workspaceId,
-      projectId,
-      actorId: access.userId,
-      entries,
-    });
-    if (!variable) throw new Error('Variable write returned no row');
+export function putVariableRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'PUT',
+    path: '/variables/:key',
+    description: 'Create or update a user-managed variable.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
+      body: putVariableBodySchema,
+      response: {200: putVariableResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId, key} = request.params;
+      const {project_id: projectId, value} = request.body;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
+      const entries = [{key, value}];
+      const [variable] = await setManagedVariables({
+        workspaceId,
+        projectId,
+        actorId: access.userId,
+        entries,
+      });
+      if (!variable) throw new Error('Variable write returned no row');
 
-    return {variable: toVariableDto(variable), warnings: variableWarnings(entries)};
-  },
-});
+      return {variable: toVariableDto(variable), warnings: variableWarnings(entries)};
+    },
+  });
+}