@shipfox/api-secrets 5.0.0 → 6.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-secrets",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -28,15 +28,16 @@
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "5.0.0",
-    "@shipfox/api-projects": "5.0.0",
-    "@shipfox/api-secrets-dto": "5.0.0",
+    "@shipfox/api-auth-context": "6.0.0",
+    "@shipfox/api-projects-dto": "6.0.0",
+    "@shipfox/api-secrets-dto": "6.0.0",
     "@shipfox/config": "1.2.2",
-    "@shipfox/node-drizzle": "0.3.1",
-    "@shipfox/node-fastify": "0.2.3",
-    "@shipfox/node-module": "0.3.2",
+    "@shipfox/inter-module": "0.2.0",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-fastify": "0.2.4",
+    "@shipfox/node-module": "0.4.0",
     "@shipfox/node-opentelemetry": "0.5.2",
-    "@shipfox/node-outbox": "0.2.3",
+    "@shipfox/node-outbox": "0.2.4",
     "@shipfox/node-postgres": "0.4.2"
   },
   "devDependencies": {
@@ -44,6 +45,7 @@
     "drizzle-kit": "^0.31.10",
     "fastify": "^5.3.3",
     "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
     "@shipfox/swc": "1.2.6",
     "@shipfox/ts-config": "1.3.8",
     "@shipfox/typescript": "1.1.7",
@@ -53,6 +55,7 @@
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/index.ts

@@ -1,9 +1,11 @@
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {secretsEventSchemas} from '@shipfox/api-secrets-dto';
 import type {ShipfoxModule} from '@shipfox/node-module';
 import {db, migrationsPath, secretsOutbox} from '#db/index.js';
 import {registerSecretsServiceMetrics} from '#metrics/index.js';
 import {secretsE2eRoutes} from '#presentation/e2eRoutes/index.js';
-import {secretsRoutes} from '#presentation/routes/index.js';
+import {createSecretsInterModulePresentation} from '#presentation/inter-module.js';
+import {createSecretsRoutes} from '#presentation/routes/index.js';
 
 export {
   BUILTIN_LOCAL_STORE,
@@ -40,11 +42,20 @@ export {
   WorkspaceSecretCapExceededError,
 } from '#core/index.js';
 
+export function createSecretsModule(projects: ProjectsModuleClient): ShipfoxModule {
+  return {
+    name: 'secrets',
+    database: {db, migrationsPath},
+    routes: createSecretsRoutes(projects),
+    e2eRoutes: [secretsE2eRoutes],
+    metrics: registerSecretsServiceMetrics,
+    publishers: [{name: 'secrets', table: secretsOutbox, db, eventSchemas: secretsEventSchemas}],
+    interModulePresentations: [createSecretsInterModulePresentation()],
+  };
+}
+
+// Migration setup imports this declaration only for the owned database metadata.
 export const secretsModule: ShipfoxModule = {
   name: 'secrets',
   database: {db, migrationsPath},
-  routes: secretsRoutes,
-  e2eRoutes: [secretsE2eRoutes],
-  metrics: registerSecretsServiceMetrics,
-  publishers: [{name: 'secrets', table: secretsOutbox, db, eventSchemas: secretsEventSchemas}],
 };

package/src/presentation/inter-module.test.ts

@@ -0,0 +1,32 @@
+import crypto from 'node:crypto';
+import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
+import {createInMemoryInterModuleTransport} from '@shipfox/node-module/inter-module';
+import {setVariables} from '#core/index.js';
+import {createSecretsInterModulePresentation} from './inter-module.js';
+
+describe('Secrets inter-module presentation', () => {
+  test('persists and reads scoped secret and variable values through the transport', async () => {
+    const workspaceId = crypto.randomUUID();
+    const projectId = crypto.randomUUID();
+    const transport = createInMemoryInterModuleTransport();
+    const client = transport.createClient(secretsInterModuleContract);
+    transport.register(createSecretsInterModulePresentation());
+    transport.seal();
+
+    await client.setSecrets({
+      workspaceId,
+      projectId,
+      values: {TOKEN: 'project-value'},
+    });
+    const secret = await client.getSecret({workspaceId, projectId, key: 'TOKEN'});
+    await setVariables({workspaceId, projectId, values: {REGION: 'eu-west-3'}});
+    const namespace = await client.getSecretsByNamespace({workspaceId, projectId});
+    const variables = await client.getVariablesByNamespace({workspaceId, projectId});
+    const deleted = await client.deleteSecrets({workspaceId, projectId, keys: ['TOKEN']});
+
+    expect(secret).toEqual({value: 'project-value'});
+    expect(namespace).toEqual({values: {TOKEN: 'project-value'}});
+    expect(variables).toEqual({values: {REGION: 'eu-west-3'}});
+    expect(deleted).toEqual({deleted: 1});
+  });
+});

package/src/presentation/inter-module.ts

@@ -0,0 +1,78 @@
+import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
+import {
+  createInterModuleKnownError,
+  defineInterModulePresentation,
+  type InterModulePresentation,
+} from '@shipfox/inter-module';
+import {
+  deleteSecrets,
+  getSecret,
+  getSecretsByNamespace,
+  getVariablesByNamespace,
+  SecretDecryptionError,
+  SecretValueTooLargeError,
+  setSecrets,
+  WorkspaceSecretCapExceededError,
+} from '#core/index.js';
+
+export function createSecretsInterModulePresentation(): InterModulePresentation<
+  typeof secretsInterModuleContract
+> {
+  return defineInterModulePresentation(secretsInterModuleContract, {
+    getSecret: async (input) => {
+      try {
+        const {store, ...params} = input;
+        return {value: await getSecret({...params, ...(store === undefined ? {} : {store})})};
+      } catch (error) {
+        throw toGetKnownError('getSecret', error);
+      }
+    },
+    getSecretsByNamespace: async (input) => {
+      try {
+        const {store, ...params} = input;
+        return {
+          values: await getSecretsByNamespace({...params, ...(store === undefined ? {} : {store})}),
+        };
+      } catch (error) {
+        throw toGetKnownError('getSecretsByNamespace', error);
+      }
+    },
+    getVariablesByNamespace: async (input) => ({
+      values: await getVariablesByNamespace(input),
+    }),
+    setSecrets: async (input) => {
+      try {
+        await setSecrets(input);
+        return {};
+      } catch (error) {
+        throw toSetKnownError(error);
+      }
+    },
+    deleteSecrets: async (input) => ({deleted: await deleteSecrets(input)}),
+  });
+}
+
+function toGetKnownError(
+  methodName: 'getSecret' | 'getSecretsByNamespace',
+  error: unknown,
+): unknown {
+  if (error instanceof SecretDecryptionError) {
+    return createInterModuleKnownError(
+      secretsInterModuleContract.methods[methodName],
+      'secret-decryption-failed',
+      {},
+    );
+  }
+  return error;
+}
+
+function toSetKnownError(error: unknown): unknown {
+  const method = secretsInterModuleContract.methods.setSecrets;
+  if (error instanceof SecretValueTooLargeError) {
+    return createInterModuleKnownError(method, 'value-too-large', {maxBytes: error.maxBytes});
+  }
+  if (error instanceof WorkspaceSecretCapExceededError) {
+    return createInterModuleKnownError(method, 'workspace-secret-cap-exceeded', {cap: error.cap});
+  }
+  return error;
+}

package/src/presentation/routes/auth.ts

@@ -1,5 +1,6 @@
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
-import {requireProjectForWorkspace} from '@shipfox/api-projects';
+import {type ProjectsModuleClient, projectsInterModuleContract} from '@shipfox/api-projects-dto';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 
@@ -8,30 +9,61 @@ export interface ManagementAccess {
   userId: string;
 }
 
-export async function requireManagementRead(params: {
-  request: FastifyRequest;
-  workspaceId: string;
-  projectId?: string | undefined;
-}): Promise<ManagementAccess> {
+export interface ManagementAccessHelpers {
+  requireManagementRead(params: {
+    request: FastifyRequest;
+    workspaceId: string;
+    projectId?: string | undefined;
+  }): Promise<ManagementAccess>;
+  requireManagementWrite(params: {
+    request: FastifyRequest;
+    workspaceId: string;
+    projectId?: string | undefined;
+  }): Promise<ManagementAccess>;
+}
+
+export function createManagementAccess(projects: ProjectsModuleClient): ManagementAccessHelpers {
+  return {
+    requireManagementRead: (params: {
+      request: FastifyRequest;
+      workspaceId: string;
+      projectId?: string | undefined;
+    }) => requireManagementRead(params, projects),
+    requireManagementWrite: (params: {
+      request: FastifyRequest;
+      workspaceId: string;
+      projectId?: string | undefined;
+    }) => requireManagementWrite(params, projects),
+  };
+}
+
+async function requireManagementRead(
+  params: {
+    request: FastifyRequest;
+    workspaceId: string;
+    projectId?: string | undefined;
+  },
+  projects: ProjectsModuleClient,
+): Promise<ManagementAccess> {
   const membership = requireWorkspaceAccess({
     request: params.request,
     workspaceId: params.workspaceId,
   });
   if (params.projectId) {
-    await requireProjectForWorkspace({
-      workspaceId: params.workspaceId,
-      projectId: params.projectId,
-    });
+    await requireProjectForWorkspace(params.workspaceId, params.projectId, projects);
   }
 
   return {workspaceId: params.workspaceId, userId: membership.userId};
 }
 
-export async function requireManagementWrite(params: {
-  request: FastifyRequest;
-  workspaceId: string;
-  projectId?: string | undefined;
-}): Promise<ManagementAccess> {
+async function requireManagementWrite(
+  params: {
+    request: FastifyRequest;
+    workspaceId: string;
+    projectId?: string | undefined;
+  },
+  projects: ProjectsModuleClient,
+): Promise<ManagementAccess> {
   const membership = requireWorkspaceAccess({
     request: params.request,
     workspaceId: params.workspaceId,
@@ -40,11 +72,25 @@ export async function requireManagementWrite(params: {
     throw new ClientError('Workspace admin role required', 'forbidden', {status: 403});
   }
   if (params.projectId) {
-    await requireProjectForWorkspace({
-      workspaceId: params.workspaceId,
-      projectId: params.projectId,
-    });
+    await requireProjectForWorkspace(params.workspaceId, params.projectId, projects);
   }
 
   return {workspaceId: params.workspaceId, userId: membership.userId};
 }
+
+async function requireProjectForWorkspace(
+  workspaceId: string,
+  projectId: string,
+  projects: ProjectsModuleClient,
+): Promise<void> {
+  try {
+    await projects.requireProjectForWorkspace({workspaceId, projectId});
+  } catch (error) {
+    if (
+      isInterModuleKnownError(projectsInterModuleContract.methods.requireProjectForWorkspace, error)
+    ) {
+      throw new ClientError('Project not found', 'project-not-found', {status: 404});
+    }
+    throw error;
+  }
+}

package/src/presentation/routes/batch-secrets.ts

@@ -3,31 +3,33 @@ import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {setManagedSecrets} from '#core/index.js';
 import {toSecretDto} from '#presentation/dto/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 import {secretWarnings} from './warnings.js';
 
-export const batchSecretsRoute = defineRoute({
-  method: 'POST',
-  path: '/secrets::batch',
-  description: 'Create or update multiple user-managed secrets in one scope.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    body: batchSecretsBodySchema,
-    response: {200: batchSecretsResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    const {project_id: projectId, entries} = request.body;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
-    const secrets = await setManagedSecrets({
-      workspaceId,
-      projectId,
-      actorId: access.userId,
-      entries,
-    });
+export function batchSecretsRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'POST',
+    path: '/secrets::batch',
+    description: 'Create or update multiple user-managed secrets in one scope.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      body: batchSecretsBodySchema,
+      response: {200: batchSecretsResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      const {project_id: projectId, entries} = request.body;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
+      const secrets = await setManagedSecrets({
+        workspaceId,
+        projectId,
+        actorId: access.userId,
+        entries,
+      });
 
-    return {secrets: secrets.map(toSecretDto), warnings: secretWarnings(entries)};
-  },
-});
+      return {secrets: secrets.map(toSecretDto), warnings: secretWarnings(entries)};
+    },
+  });
+}

package/src/presentation/routes/batch-variables.ts

@@ -3,31 +3,33 @@ import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {setManagedVariables} from '#core/index.js';
 import {toVariableDto} from '#presentation/dto/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 import {variableWarnings} from './warnings.js';
 
-export const batchVariablesRoute = defineRoute({
-  method: 'POST',
-  path: '/variables::batch',
-  description: 'Create or update multiple user-managed variables in one scope.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    body: batchVariablesBodySchema,
-    response: {200: batchVariablesResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    const {project_id: projectId, entries} = request.body;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
-    const variables = await setManagedVariables({
-      workspaceId,
-      projectId,
-      actorId: access.userId,
-      entries,
-    });
+export function batchVariablesRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'POST',
+    path: '/variables::batch',
+    description: 'Create or update multiple user-managed variables in one scope.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      body: batchVariablesBodySchema,
+      response: {200: batchVariablesResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      const {project_id: projectId, entries} = request.body;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
+      const variables = await setManagedVariables({
+        workspaceId,
+        projectId,
+        actorId: access.userId,
+        entries,
+      });
 
-    return {variables: variables.map(toVariableDto), warnings: variableWarnings(entries)};
-  },
-});
+      return {variables: variables.map(toVariableDto), warnings: variableWarnings(entries)};
+    },
+  });
+}

package/src/presentation/routes/delete-secret.ts

@@ -2,25 +2,27 @@ import {secretKeySchema, secretScopeQuerySchema} from '@shipfox/api-secrets-dto'
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {deleteManagedSecret} from '#core/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 
-export const deleteSecretRoute = defineRoute({
-  method: 'DELETE',
-  path: '/secrets/:key',
-  description: 'Delete a user-managed secret.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
-    querystring: secretScopeQuerySchema,
-    response: {204: z.void()},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request, reply) => {
-    const {workspaceId, key} = request.params;
-    const {project_id: projectId} = request.query;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
+export function deleteSecretRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'DELETE',
+    path: '/secrets/:key',
+    description: 'Delete a user-managed secret.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
+      querystring: secretScopeQuerySchema,
+      response: {204: z.void()},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request, reply) => {
+      const {workspaceId, key} = request.params;
+      const {project_id: projectId} = request.query;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
 
-    await deleteManagedSecret({workspaceId, projectId, key, actorId: access.userId});
-    return reply.status(204).send();
-  },
-});
+      await deleteManagedSecret({workspaceId, projectId, key, actorId: access.userId});
+      return reply.status(204).send();
+    },
+  });
+}

package/src/presentation/routes/delete-variable.ts

@@ -2,25 +2,27 @@ import {secretKeySchema, secretScopeQuerySchema} from '@shipfox/api-secrets-dto'
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {deleteManagedVariable} from '#core/index.js';
-import {requireManagementWrite} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 
-export const deleteVariableRoute = defineRoute({
-  method: 'DELETE',
-  path: '/variables/:key',
-  description: 'Delete a user-managed variable.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
-    querystring: secretScopeQuerySchema,
-    response: {204: z.void()},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request, reply) => {
-    const {workspaceId, key} = request.params;
-    const {project_id: projectId} = request.query;
-    const access = await requireManagementWrite({request, workspaceId, projectId});
+export function deleteVariableRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'DELETE',
+    path: '/variables/:key',
+    description: 'Delete a user-managed variable.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
+      querystring: secretScopeQuerySchema,
+      response: {204: z.void()},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request, reply) => {
+      const {workspaceId, key} = request.params;
+      const {project_id: projectId} = request.query;
+      const access = await accessControl.requireManagementWrite({request, workspaceId, projectId});
 
-    await deleteManagedVariable({workspaceId, projectId, key, actorId: access.userId});
-    return reply.status(204).send();
-  },
-});
+      await deleteManagedVariable({workspaceId, projectId, key, actorId: access.userId});
+      return reply.status(204).send();
+    },
+  });
+}

package/src/presentation/routes/errors.ts

@@ -1,4 +1,3 @@
-import {ProjectNotFoundError} from '@shipfox/api-projects';
 import {ClientError} from '@shipfox/node-fastify';
 import {
   NamespaceValidationError,
@@ -55,9 +54,5 @@ export function translateManagementError(error: unknown): never {
   if (error instanceof UnknownSecretStoreError) {
     throw new ClientError('Unknown secret store', 'unknown-secret-store', {status: 400});
   }
-  if (error instanceof ProjectNotFoundError) {
-    throw new ClientError('Project not found', 'project-not-found', {status: 404});
-  }
-
   throw error;
 }

package/src/presentation/routes/get-variable.ts

@@ -7,26 +7,28 @@ import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {getManagedVariable} from '#core/index.js';
 import {toVariableDto} from '#presentation/dto/index.js';
-import {requireManagementRead} from './auth.js';
+import type {ManagementAccessHelpers} from './auth.js';
 import {translateManagementError} from './errors.js';
 
-export const getVariableRoute = defineRoute({
-  method: 'GET',
-  path: '/variables/:key',
-  description: 'Read a user-managed variable.',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
-    querystring: secretScopeQuerySchema,
-    response: {200: getVariableResponseSchema},
-  },
-  errorHandler: translateManagementError,
-  handler: async (request) => {
-    const {workspaceId, key} = request.params;
-    const {project_id: projectId} = request.query;
+export function getVariableRoute(accessControl: ManagementAccessHelpers) {
+  return defineRoute({
+    method: 'GET',
+    path: '/variables/:key',
+    description: 'Read a user-managed variable.',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid(), key: secretKeySchema}),
+      querystring: secretScopeQuerySchema,
+      response: {200: getVariableResponseSchema},
+    },
+    errorHandler: translateManagementError,
+    handler: async (request) => {
+      const {workspaceId, key} = request.params;
+      const {project_id: projectId} = request.query;
 
-    await requireManagementRead({request, workspaceId, projectId});
-    const variable = await getManagedVariable({workspaceId, projectId, key});
+      await accessControl.requireManagementRead({request, workspaceId, projectId});
+      const variable = await getManagedVariable({workspaceId, projectId, key});
 
-    return {variable: toVariableDto(variable)};
-  },
-});
+      return {variable: toVariableDto(variable)};
+    },
+  });
+}

package/src/presentation/routes/index.ts

@@ -1,5 +1,7 @@
 import {AUTH_USER} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import type {RouteGroup} from '@shipfox/node-fastify';
+import {createManagementAccess} from './auth.js';
 import {batchSecretsRoute} from './batch-secrets.js';
 import {batchVariablesRoute} from './batch-variables.js';
 import {deleteSecretRoute} from './delete-secret.js';
@@ -10,20 +12,23 @@ import {listVariablesRoute} from './list-variables.js';
 import {putSecretRoute} from './put-secret.js';
 import {putVariableRoute} from './put-variable.js';
 
-export const secretsRoutes: RouteGroup[] = [
-  {
-    prefix: '/workspaces/:workspaceId',
-    auth: AUTH_USER,
-    routes: [
-      listSecretsRoute,
-      putSecretRoute,
-      batchSecretsRoute,
-      deleteSecretRoute,
-      listVariablesRoute,
-      getVariableRoute,
-      putVariableRoute,
-      batchVariablesRoute,
-      deleteVariableRoute,
-    ],
-  },
-];
+export function createSecretsRoutes(projects: ProjectsModuleClient): RouteGroup[] {
+  const access = createManagementAccess(projects);
+  return [
+    {
+      prefix: '/workspaces/:workspaceId',
+      auth: AUTH_USER,
+      routes: [
+        listSecretsRoute(access),
+        putSecretRoute(access),
+        batchSecretsRoute(access),
+        deleteSecretRoute(access),
+        listVariablesRoute(access),
+        getVariableRoute(access),
+        putVariableRoute(access),
+        batchVariablesRoute(access),
+        deleteVariableRoute(access),
+      ],
+    },
+  ];
+}