@shipfox/api-secrets 8.0.0 → 9.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-secrets",
   "license": "MIT",
-  "version": "8.0.0",
+  "version": "9.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -11,10 +11,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#test/*": "./test/*",
-    "#*": "./dist/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -28,17 +24,20 @@
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "7.1.0",
-    "@shipfox/api-projects-dto": "8.0.0",
-    "@shipfox/api-secrets-dto": "6.0.0",
-    "@shipfox/config": "1.2.2",
-    "@shipfox/inter-module": "0.2.0",
-    "@shipfox/node-drizzle": "0.3.2",
-    "@shipfox/node-fastify": "0.3.0",
-    "@shipfox/node-module": "0.5.0",
-    "@shipfox/node-opentelemetry": "0.6.0",
-    "@shipfox/node-outbox": "0.2.4",
-    "@shipfox/node-postgres": "0.4.2"
+    "@shipfox/api-auth-context": "9.0.1",
+    "@shipfox/api-projects-dto": "9.0.1",
+    "@shipfox/api-secrets-dto": "9.0.1",
+    "@shipfox/config": "1.2.3",
+    "@shipfox/inter-module": "0.2.1",
+    "@shipfox/node-drizzle": "0.3.3",
+    "@shipfox/node-fastify": "0.3.1",
+    "@shipfox/node-module": "1.0.0",
+    "@shipfox/node-opentelemetry": "0.6.1",
+    "@shipfox/node-outbox": "0.2.5",
+    "@shipfox/node-postgres": "0.4.3"
+  },
+  "imports": {
+    "#*": "./dist/*"
   },
   "scripts": {
     "build": "shipfox-swc",

package/src/core/identifier-policy.test.ts

@@ -0,0 +1,25 @@
+import {describe, expect, it} from '@shipfox/vitest/vi';
+import {isSensitiveSecretName, isShortSecretValue, isSystemNamespace} from './identifier-policy.js';
+
+describe('isSystemNamespace', () => {
+  it('classifies system and user namespaces', () => {
+    expect(isSystemNamespace('system/agent/x')).toBe(true);
+    expect(isSystemNamespace('')).toBe(false);
+    expect(isSystemNamespace('REGION')).toBe(false);
+  });
+});
+
+describe('isSensitiveSecretName', () => {
+  it('classifies sensitive names', () => {
+    expect(isSensitiveSecretName('API_TOKEN')).toBe(true);
+    expect(isSensitiveSecretName('PASSWORD')).toBe(true);
+    expect(isSensitiveSecretName('REGION')).toBe(false);
+  });
+});
+
+describe('isShortSecretValue', () => {
+  it('classifies short secret values', () => {
+    expect(isShortSecretValue('short', 12)).toBe(true);
+    expect(isShortSecretValue('long-enough-value', 12)).toBe(false);
+  });
+});

package/src/core/identifier-policy.ts

@@ -0,0 +1,13 @@
+import {SENSITIVE_NAME_PATTERNS, SYSTEM_NAMESPACE_PREFIX} from '@shipfox/api-secrets-dto';
+
+export function isSystemNamespace(namespace: string): boolean {
+  return namespace.startsWith(SYSTEM_NAMESPACE_PREFIX);
+}
+
+export function isSensitiveSecretName(key: string): boolean {
+  return SENSITIVE_NAME_PATTERNS.some((pattern) => key.includes(pattern));
+}
+
+export function isShortSecretValue(value: string, threshold: number): boolean {
+  return value.length > 0 && value.length < threshold;
+}

package/src/core/store-validation.ts

@@ -1,4 +1,4 @@
-import {isSystemNamespace, namespaceSchema, secretKeySchema} from '@shipfox/api-secrets-dto';
+import {namespaceSchema, secretKeySchema} from '@shipfox/api-secrets-dto';
 import {config, MAX_VALUE_BYTES} from '#config.js';
 import {countWorkspaceEntries, type Tx} from '#db/index.js';
 import {
@@ -7,6 +7,7 @@ import {
   SecretValueTooLargeError,
   WorkspaceSecretCapExceededError,
 } from './errors.js';
+import {isSystemNamespace} from './identifier-policy.js';
 
 export function validateNamespace(namespace: string): void {
   if (namespaceSchema.safeParse(namespace).success) return;

package/src/index.ts

@@ -45,7 +45,7 @@ export {
 export function createSecretsModule(projects: ProjectsModuleClient): ShipfoxModule {
   return {
     name: 'secrets',
-    database: {db, migrationsPath},
+    database: {db, migrationsPath, databaseNamespace: 'secrets'},
     routes: createSecretsRoutes(projects),
     e2eRoutes: [secretsE2eRoutes],
     metrics: registerSecretsServiceMetrics,
@@ -57,5 +57,5 @@ export function createSecretsModule(projects: ProjectsModuleClient): ShipfoxModu
 // Migration setup imports this declaration only for the owned database metadata.
 export const secretsModule: ShipfoxModule = {
   name: 'secrets',
-  database: {db, migrationsPath},
+  database: {db, migrationsPath, databaseNamespace: 'secrets'},
 };

package/src/presentation/routes/warnings.ts

@@ -2,22 +2,19 @@ import {
   SENSITIVE_VARIABLE_NAME_WARNING,
   type SecretWriteWarningDto,
   SHORT_SECRET_VALUE_WARNING,
-  shouldWarnSensitiveVariableName,
-  shouldWarnShortSecretValue,
 } from '@shipfox/api-secrets-dto';
 import {config} from '#config.js';
+import {isSensitiveSecretName, isShortSecretValue} from '#core/identifier-policy.js';
 import type {ManagementEntry} from '#core/index.js';
 
 export function secretWarnings(entries: ManagementEntry[]): SecretWriteWarningDto[] {
   return entries
-    .filter((entry) =>
-      shouldWarnShortSecretValue(entry.value, config.SECRETS_SHORT_VALUE_WARN_LENGTH),
-    )
+    .filter((entry) => isShortSecretValue(entry.value, config.SECRETS_SHORT_VALUE_WARN_LENGTH))
     .map((entry) => ({code: SHORT_SECRET_VALUE_WARNING, key: entry.key}));
 }
 
 export function variableWarnings(entries: ManagementEntry[]): SecretWriteWarningDto[] {
   return entries
-    .filter((entry) => shouldWarnSensitiveVariableName(entry.key))
+    .filter((entry) => isSensitiveSecretName(entry.key))
     .map((entry) => ({code: SENSITIVE_VARIABLE_NAME_WARNING, key: entry.key}));
 }