@toa.io/extensions.exposition 1.0.0-alpha.273 → 1.0.0-alpha.274

package/components/identity.tokens/source/authenticate.test.ts

@@ -1,6 +1,7 @@
 import { generate } from 'randomstring'
 import { Computation as Authenticate } from './authenticate'
 import type { Configuration, Context, DecryptOutput, Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -13,8 +14,8 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 2592000,
     refresh: 600,
@@ -68,3 +69,7 @@ it.each([true, false])('should return stale: %s',
 
     expect(result).toEqual({ identity, refresh })
   })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/decrypt.test.ts

@@ -3,6 +3,7 @@ import { V3 } from 'paseto'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Configuration, type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -15,10 +16,11 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'key1', key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' },
-      { id: 'legacy1', key: 'k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      // keys are secrets, and a secret is an object
+      { id: 'key1', key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' },
+      { id: 'legacy1', key: secret('k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA'), format: 'paseto' }
     ],
     lifetime: 1000,
     refresh: 500,
@@ -77,7 +79,7 @@ it('should decrypt with key1', async () => {
 it('should decrypt legacy PASETO and require refresh', async () => {
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'legacy0' }
   })
 
@@ -96,7 +98,7 @@ it('should separate JWE and PASETO keys with the same id by format', async () =>
 
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'key0' }
   })
 
@@ -125,7 +127,7 @@ it('should reject JWE with an unknown key', async () => {
   const token = await encrypt.execute({
     authority,
     identity: { id: generate(), roles: [] },
-    key: { id: 'missing', key: configuration.keys[0].key, label: 'missing' }
+    key: { id: 'missing', key: configuration.keys[0].key.unwrap(), label: 'missing' }
   })
 
   if (token instanceof Error)
@@ -133,3 +135,7 @@ it('should reject JWE with an unknown key', async () => {
 
   await expect(decrypt.execute(token)).resolves.toMatchObject({ code: 'INVALID_KEY' })
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/decrypt.ts

@@ -27,7 +27,7 @@ export class Computation implements Operation {
     for (const { id, key, format } of context.configuration.keys) {
       const branch = format === 'paseto' ? this.legacy : this.keys
 
-      branch[id] = { key }
+      branch[id] = { key: key.unwrap() }
     }
   }
 

package/components/identity.tokens/source/encrypt.test.ts

@@ -4,6 +4,7 @@ import { timeout } from '@toa.io/generic'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let encrypt: Encrypt
 let decrypt: Decrypt
@@ -18,8 +19,8 @@ const authority = generate()
 beforeEach(() => {
   context.configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 1,
     refresh: 2,
@@ -39,12 +40,12 @@ beforeEach(() => {
 it('should use the first encryption key as active and expose its id as kid', async () => {
   context.configuration.keys.unshift({
     id: 'legacy-first',
-    key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog',
+    key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
     format: 'paseto'
   })
   context.configuration.keys.push({
     id: 'key1',
-    key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0'
+    key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0')
   })
 
   encrypt.mount(context)
@@ -119,3 +120,7 @@ it('should encrypt without lifetime INSECURE', async () => {
 
   expect(decrypted.identity).toMatchObject(identity)
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/encrypt.ts

@@ -13,7 +13,7 @@ export class Effect implements Operation {
     if (key === undefined)
       throw new TypeError('At least one JWE key must be configured')
 
-    this.key = key
+    this.key = { id: key.id, key: key.key.unwrap() }
     this.lifetime = context.configuration.lifetime * 1000
   }
 

package/components/identity.tokens/source/lib/types.ts

@@ -1,4 +1,4 @@
-import type { Call, Maybe, Observation, telemetry } from '@toa.io/types'
+import type { Call, Maybe, Observation, Secret, telemetry } from '@toa.io/types'
 
 export interface Context {
   local: {
@@ -31,7 +31,8 @@ export interface Configuration {
   }
 }
 
-export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+export interface ConfiguredKey extends Pick<Key, 'id'> {
+  key: Secret
   format?: 'jwe' | 'paseto'
 }
 

package/context.toa.yaml

@@ -10,9 +10,9 @@ configuration:
   identity.tokens:
     keys:
       - id: key0
-        key: sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs
+        key: $IDENTITY_TOKENS_ENCRYPTION_KEY0
       - id: legacy0
-        key: k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA
+        key: $IDENTITY_TOKENS_KEY0
         format: paseto
 
   identity.federation:

package/documentation/components.md

@@ -23,7 +23,7 @@ and pepper.
 configuration:
   identity.basic:
     rounds: 10 # salt rounds
-    pepper: '' # hashing pepper
+    pepper: $IDENTITY_BASIC_PEPPER # hashing pepper, a secret
 ```
 
 ### Credentials constraints

package/features/configuration.feature

@@ -0,0 +1,207 @@
+@security
+Feature: Configuration values
+
+  The values component declares how it is exposed in its own manifest, and that manifest
+  is what this mounts. Reading takes `system:configuration:get`, creating takes
+  `system:configuration:create`, and the one who creates is recorded as the originator.
+
+  Background:
+    # developer:secret, user:12345
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                     |
+      | 1c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | efe3a65ebbee47ed95a73edd911ea328 | system:configuration     |
+      | 2c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | e8e4f9c2a68d419b861403d71fabc915 | system:configuration:get |
+    And the `identity.bans` database is empty
+    And the `configuration.values` database is empty
+    And the configuration values are deployed:
+      """yaml
+      dummies.dummy:
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        defaults:
+          foo: deployed
+      """
+    And the configuration values are running
+
+  Scenario: Reading the deployed configuration
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: deployed
+      schema:
+        type: object
+        properties:
+          foo:
+            type: string
+          bar:
+            type: string
+            default: world
+      epoch: e1
+      """
+
+  Scenario: Listing the configurations
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      - component: dummies.dummy
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        configuration:
+          foo: deployed
+      """
+
+  Scenario: Listing without the role
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading without the role
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading the configuration of an unknown component
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Creating configuration
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      epoch: e1
+      """
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+        bar: world
+      epoch: e1
+      """
+
+  Scenario: Creating configuration without the role
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Creating configuration not fitting the schema
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration:
+        foo:
+          nested: true
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Creating configuration for an unknown component
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration: {}
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """

package/features/identity.federation.feature

@@ -335,7 +335,11 @@ Feature: Identity Federation
       trust:
         - iss: http://localhost:44444
           aud: nex
-          secret: secret
+          secret: $IDP_SECRET
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_SECRET: secret
       """
     And auth code for Alice is issued for https://web.toa.io/callback/
     When the following request is received:
@@ -362,12 +366,16 @@ Feature: Identity Federation
           signature:
             iss: io.toa.nex.id
             kid: key-id
-            key: |
-              -----BEGIN PRIVATE KEY-----
-              MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
-              TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
-              HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
-              -----END PRIVATE KEY-----
+            key: $IDP_KEY
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_KEY: |
+        -----BEGIN PRIVATE KEY-----
+        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
+        TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
+        HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
+        -----END PRIVATE KEY-----
       """
     And auth code for Bob is issued for https://web.toa.io/callback/
     When the following request is received:

package/features/introspection.map.feature

@@ -90,3 +90,19 @@ Feature: Reading the introspection map
       """
       403 Forbidden
       """
+
+  Scenario: The map does not take the application's root directives
+    Given the annotation of the introspection map under:
+      """yaml
+      /:
+        auth:anonymous: true
+      """
+    When the following request is received:
+      """
+      GET /introspection/nodes/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/steps/Components.ts

@@ -1,4 +1,5 @@
 import * as assert from 'node:assert'
+import { dirname, join } from 'node:path'
 import { after, binding, given } from 'cucumber-tsflow'
 import * as boot from '@toa.io/boot'
 import { timeout } from '@toa.io/generic'
@@ -9,6 +10,7 @@ import { Workspace } from './Workspace'
 import { components as map } from './map'
 
 const MAP = 'introspection'
+const VALUES = 'configuration'
 
 @binding([Workspace, Gateway])
 export class Components {
@@ -44,6 +46,25 @@ export class Components {
     await timeout(50) // discovery
   }
 
+  /** The values component, as the configuration extension ships it; the service hosts it alone. */
+  @given('the configuration values are running')
+  public async runValues (): Promise<void> {
+    assert.ok(!(VALUES in this.compositions), `Composition '${VALUES}' is already running`)
+
+    await this.gateway.start()
+
+    this.compositions[VALUES] = await boot.composition([values()])
+
+    await this.compositions[VALUES].connect()
+    await timeout(50) // discovery
+  }
+
+  /** What the deployment would tell the values service, as the scenario needs it. */
+  @given('the configuration values are deployed:')
+  public deployValues (yaml: string): void {
+    process.env.TOA_CONFIGURATION_VALUES = JSON.stringify(parse(yaml))
+  }
+
   @given('the `{word}` is stopped')
   public async stop (name: string): Promise<void> {
     assert.ok(name in this.compositions, `Composition '${name}' is not running`)
@@ -57,6 +78,8 @@ export class Components {
     const promises = Object.values(this.compositions).map((composition) => composition.disconnect())
 
     await Promise.all(promises)
+
+    delete process.env.TOA_CONFIGURATION_VALUES
   }
 
   private async runComponent (name: string, manifest?: object): Promise<void> {
@@ -75,3 +98,9 @@ export class Components {
     await timeout(50) // discovery
   }
 }
+
+function values (): string {
+  const root = dirname(require.resolve('@toa.io/extensions.configuration/package.json'))
+
+  return join(root, 'components', 'configuration.values')
+}

package/features/steps/Gateway.ts

@@ -14,6 +14,7 @@ let instance: Connector | null = null
 @binding()
 export class Gateway {
   private default: boolean = true
+  private written: string[] = []
 
   @given('the annotation:')
   public async annotate (yaml: string): Promise<void> {
@@ -47,7 +48,15 @@ export class Gateway {
    */
   @given('the annotation of the introspection map')
   public async annotateMap (): Promise<void> {
-    const tree: syntax.Node = { routes: [], methods: [], directives: [] }
+    await this.annotateMapUnder()
+  }
+
+  /** The same routes under a root of the scenario's own: what an application declares around the map. */
+  @given('the annotation of the introspection map under:')
+  public async annotateMapUnder (yaml?: string): Promise<void> {
+    const tree: syntax.Node = yaml === undefined
+      ? { routes: [], methods: [], directives: [] }
+      : syntax.parse((parse(yaml) as { '/': object })['/'], shortcuts)
 
     for (const manifest of await manifests()) {
       const node = manifest.extensions?.[EXPOSITION] as syntax.Node | undefined
@@ -81,6 +90,21 @@ export class Gateway {
     this.default = false
   }
 
+  /** The secrets a scenario's configuration refers to. */
+  @given('the configuration secrets:')
+  public async secrets (yaml: string): Promise<void> {
+    const secrets = parse(yaml) as Record<string, string>
+
+    for (const [name, value] of Object.entries(secrets)) {
+      this.written.push(SECRET + name)
+      process.env[SECRET + name] = value
+    }
+
+    await Gateway.stop()
+
+    this.default = false
+  }
+
   @given('the branch TTL is {float} second(s)')
   public async setBranchTTL (seconds: number): Promise<void> {
     process.env.__TESTING_EXPOSITION_BRANCH_TTL = String(seconds * 1000)
@@ -116,6 +140,11 @@ export class Gateway {
   public async cleanup (): Promise<void> {
     delete process.env.__TESTING_EXPOSITION_BRANCH_TTL
 
+    for (const key of this.written)
+      delete process.env[key]
+
+    this.written = []
+
     if (this.default)
       return
 
@@ -138,10 +167,14 @@ export class Gateway {
 
       process.env[key] ??= JSON.stringify(configuration)
     }
+
+    for (const [name, value] of Object.entries(DEFAULT_SECRETS))
+      process.env[SECRET + name] ??= value
   }
 }
 
 const EXPOSITION = '@toa.io/extensions.exposition'
+const SECRET = 'TOA_CONFIGURATION__'
 
 const DEFAULT_TREE = JSON.stringify({
   routes: [],
@@ -161,18 +194,23 @@ const DEFAULT_PROPERTIES: Partial<http.Options> = {
   }
 }
 
+// the identity components boot inside the gateway, and without a variable each would wait
+// for the values service, which these features do not run
 const DEFAULT_CONFIGURATION: Record<string, object> = {
+  'identity.basic': {},
+  'identity.federation': {},
+  'identity.otp': {},
+  'identity.passkeys': {},
   'identity.tokens': {
     keys: [
-      {
-        id: 'key0',
-        key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs'
-      },
-      {
-        id: 'legacy0',
-        key: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA',
-        format: 'paseto'
-      }
+      { id: 'key0', key: '$IDENTITY_TOKENS_KEY0' },
+      { id: 'legacy0', key: '$IDENTITY_TOKENS_LEGACY0', format: 'paseto' }
     ]
   }
 }
+
+// a secret is given as a reference, and comes to the component as an object
+const DEFAULT_SECRETS: Record<string, string> = {
+  IDENTITY_TOKENS_KEY0: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs',
+  IDENTITY_TOKENS_LEGACY0: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA'
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.273",
+  "version": "1.0.0-alpha.274",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -20,7 +20,7 @@
     "@simplewebauthn/server": "13.3.3",
     "@toa.io/core": "1.0.0-alpha.273",
     "@toa.io/generic": "1.0.0-alpha.273",
-    "@toa.io/schemas": "1.0.0-alpha.273",
+    "@toa.io/schemas": "1.0.0-alpha.274",
     "bcryptjs": "3.0.3",
     "content-type": "2.1.0",
     "jose": "6.2.10",
@@ -61,5 +61,5 @@
     },
     "testEnvironment": "node"
   },
-  "gitHead": "ad3284850ece95ffd5325fd0995707fc144c9c3d"
+  "gitHead": "7df32eb2872155c45681c299036b1efbeefd6518"
 }

package/source/HTTP/formats/yaml.test.ts

@@ -9,3 +9,9 @@ it('encodes error values as their public properties', () => {
   expect(encode(value).toString())
     .toBe('code: INVALID_USERNAME\nmessage: Username is not meeting the requirements\n')
 })
+
+it('writes a value the way its toJSON says', () => {
+  const secret = { unwrap: () => 's3cret', toJSON: () => '<REDACTED>' }
+
+  expect(encode({ a: 1, b: secret }).toString()).toBe('a: 1\nb: <REDACTED>\n')
+})

package/source/HTTP/formats/yaml.ts

@@ -10,8 +10,28 @@ export function decode (buffer: Buffer, charset = 'utf-8'): any {
 }
 
 export function encode (value: any): Buffer {
-  const serializable = value instanceof Error ? Object.assign({}, value) : value
+  const serializable = value instanceof Error ? Object.assign({}, value) : represent(value)
   const text = yaml.dump(serializable, { lineWidth: -1, noRefs: true })
 
   return Buffer.from(text)
 }
+
+/** What says how it is to be written — a redacted secret — is written that way, as in JSON. */
+function represent (value: unknown): unknown {
+  if (typeof value !== 'object' || value === null || value instanceof Date || Buffer.isBuffer(value))
+    return value
+
+  if ('toJSON' in value && typeof value.toJSON === 'function')
+    return value.toJSON()
+
+  if (Array.isArray(value))
+    return value.map(represent)
+
+  const object = value as Record<string, unknown>
+  const represented: Record<string, unknown> = {}
+
+  for (const key of Object.keys(object))
+    represented[key] = represent(object[key])
+
+  return represented
+}