@sockethub/data-layer 1.0.0-alpha.13 → 1.0.0-alpha.14

package/dist/credentials-store.d.ts

@@ -11,13 +11,43 @@ import type { RedisConfig } from "./types.js";
  * @returns Shared Redis connection instance
  */
 export declare function createCredentialsRedisConnection(config: RedisConfig): Redis;
+/**
+ * Creates or returns a dedicated shared Redis connection for HTTP idempotency.
+ */
+export declare function createIdempotencyRedisConnection(config: RedisConfig): Redis;
+/**
+ * Creates or returns a dedicated shared Redis connection for rate limiting.
+ * A dedicated connection keeps rate-limit traffic off the credentials and
+ * idempotency connections and lets a Redis-backed limiter share request budgets
+ * across instances.
+ */
+export declare function createRateLimitRedisConnection(config: RedisConfig): Redis;
 /**
  * Resets the shared credentials Redis connection. Used primarily for testing.
  */
 export declare function resetSharedCredentialsRedisConnection(): Promise<void>;
+export declare function resetSharedIdempotencyRedisConnection(): Promise<void>;
+export declare function resetSharedRateLimitRedisConnection(): Promise<void>;
 export interface CredentialsStoreInterface {
     get(actor: string, credentialsHash?: string, options?: CredentialsValidationOptions): Promise<CredentialsObject | undefined>;
     save(actor: string, creds: CredentialsObject): Promise<number>;
+    /**
+     * Delete this session's entire credential namespace from Redis. Used by
+     * single-use sessions (e.g. HTTP actions requests) whose credentials are
+     * never read again once the request completes. Optional: long-lived socket
+     * sessions do not implement it.
+     */
+    teardown?(): Promise<void>;
+}
+export interface CredentialsStoreOptions {
+    /**
+     * Sliding time-to-live in milliseconds applied to this session's
+     * credential key in Redis, refreshed on every save and read. A backstop
+     * against keys orphaned by crashes or ungraceful shutdowns where explicit
+     * teardown never runs — size it generously (idle sessions do not refresh
+     * it). Omit or 0 to disable expiry.
+     */
+    ttlMs?: number;
 }
 export interface CredentialsValidationOptions {
     /**
@@ -69,9 +99,9 @@ export declare class CredentialsStore implements CredentialsStoreInterface {
      * @param redisConfig - Redis connection configuration
      * @throws Error if secret is not exactly 32 characters
      */
-    constructor(parentId: string, sessionId: string, secret: string, redisConfig: RedisConfig);
+    constructor(parentId: string, sessionId: string, secret: string, redisConfig: RedisConfig, options?: CredentialsStoreOptions);
     initCrypto(): void;
-    initSecureStore(secret: string, redisConfig: RedisConfig): void;
+    initSecureStore(secret: string, redisConfig: RedisConfig, ttlMs?: number): void;
     /**
      * Gets the credentials for a given actor ID.
      * @param actor
@@ -85,4 +115,26 @@ export declare class CredentialsStore implements CredentialsStoreInterface {
      * @param creds
      */
     save(actor: string, creds: CredentialsObject): Promise<number>;
+    /**
+     * Delete this session's entire credential hash from Redis, promptly
+     * reclaiming the key instead of waiting for its TTL (if any) to lapse.
+     * Called when the session ends (socket disconnect, HTTP actions request
+     * cleanup). Best-effort and safe to call when nothing was stored — a
+     * missing key is a no-op.
+     */
+    teardown(): Promise<void>;
 }
+/**
+ * Delete every credential-store key belonging to `parentId`. Called from
+ * server shutdown so an instance reclaims its own keys instead of stranding
+ * them under a parentId that no future boot will ever reference (each boot
+ * randomizes its parentId). Scoped strictly to the given parentId: Redis may
+ * be shared by multiple running instances, so keys under other parentIds are
+ * never touched. Returns the number of keys removed.
+ */
+export declare function purgeCredentialsStoreKeys(client: Redis, parentId: string): Promise<number>;
+/**
+ * Convenience wrapper over {@link purgeCredentialsStoreKeys} using the shared
+ * credentials Redis connection.
+ */
+export declare function purgeCredentialsStores(parentId: string, config: RedisConfig): Promise<number>;

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { CredentialsMismatchError, CredentialsNotShareableError, CredentialsStore, type CredentialsStoreInterface, type CredentialsValidationOptions, resetSharedCredentialsRedisConnection } from "./credentials-store.js";
+import { CredentialsMismatchError, CredentialsNotShareableError, CredentialsStore, type CredentialsStoreInterface, type CredentialsStoreOptions, type CredentialsValidationOptions, createCredentialsRedisConnection, createIdempotencyRedisConnection, createRateLimitRedisConnection, purgeCredentialsStoreKeys, purgeCredentialsStores, resetSharedCredentialsRedisConnection, resetSharedIdempotencyRedisConnection, resetSharedRateLimitRedisConnection } from "./credentials-store.js";
 import { getRedisConnectionCount, resetSharedRedisConnection } from "./job-base.js";
 import { JobQueue } from "./job-queue.js";
 import { JobWorker, type JobWorkerOptions } from "./job-worker.js";
 export * from "./types.js";
 import type { RedisConfig } from "./types.js";
 declare function redisCheck(config: RedisConfig): Promise<void>;
-export { redisCheck, JobQueue, JobWorker, type JobWorkerOptions, CredentialsStore, CredentialsMismatchError, CredentialsNotShareableError, getRedisConnectionCount, resetSharedRedisConnection, resetSharedCredentialsRedisConnection, type CredentialsValidationOptions, type CredentialsStoreInterface, };
+export { CredentialsMismatchError, CredentialsNotShareableError, CredentialsStore, type CredentialsStoreInterface, type CredentialsStoreOptions, type CredentialsValidationOptions, createCredentialsRedisConnection, createIdempotencyRedisConnection, createRateLimitRedisConnection, getRedisConnectionCount, JobQueue, purgeCredentialsStoreKeys, purgeCredentialsStores, JobWorker, type JobWorkerOptions, redisCheck, resetSharedCredentialsRedisConnection, resetSharedIdempotencyRedisConnection, resetSharedRateLimitRedisConnection, resetSharedRedisConnection, };