@veducio/keja 0.2.3 → 0.4.0

package/src/project/config.ts

@@ -63,6 +63,39 @@ export type VaultConfig =
   | { enabled: false }
   | ({ enabled: true } & VaultSettings);
 
+export type GrantsConfigInput = {
+  enabled: boolean;
+  mode?: "transit" | "secret";
+  max_exp?: number;
+  transit_key?: string;
+  transit_mount?: string;
+  secret?: string;
+  secret_vault?: string;
+  secret_field?: string;
+};
+
+export type GrantsConfig =
+  | { enabled: false }
+  | {
+      enabled: true;
+      mode: "transit";
+      max_exp: number;
+      transit_key: string;
+      transit_mount: string;
+    }
+  | {
+      enabled: true;
+      mode: "secret";
+      max_exp: number;
+      secret: string | null;
+      secret_vault: string | null;
+      secret_field: string;
+    };
+
+export type BatchConfigInput = boolean | { enabled: boolean };
+
+export type BatchConfig = { enabled: boolean };
+
 export type KejaConfigInput = {
   name?: string;
   versioning?: string;
@@ -71,6 +104,8 @@ export type KejaConfigInput = {
   argus?: ArgusConfigInput;
   db?: DatabaseConfigInput;
   vault?: VaultConfigInput;
+  grants?: GrantsConfigInput;
+  batch?: BatchConfigInput;
 };
 
 export type KejaConfig = {
@@ -81,6 +116,8 @@ export type KejaConfig = {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function defineConfig(input: KejaConfigInput = {}) {
@@ -104,6 +141,8 @@ export function defineConfig(input: KejaConfigInput = {}) {
     argus: configArgus(input.argus),
     database: configDatabase(input.db),
     vault: configVault(input.vault),
+    grants: configGrants(input.grants),
+    batch: configBatch(input.batch),
   };
   return Object.assign(config, { [configBrand]: true as const });
 }
@@ -120,7 +159,9 @@ export function isConfig(value: unknown): value is KejaConfig {
     hasName(value) &&
     hasArgus(value) &&
     hasDatabase(value) &&
-    hasVault(value)
+    hasVault(value) &&
+    hasGrants(value) &&
+    hasBatch(value)
   );
 }
 
@@ -136,6 +177,8 @@ export type LoadedConfig = ProjectPaths & {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function resolveProjectPaths(root: string, config: KejaConfig) {
@@ -192,6 +235,8 @@ function loadedConfig(
     argus: config.argus,
     database: resolvedDatabase(root, config.database),
     vault: config.vault,
+    grants: config.grants,
+    batch: config.batch,
   };
 }
 
@@ -292,6 +337,87 @@ function configVault(value: VaultConfigInput | undefined): VaultConfig {
   };
 }
 
+function configGrants(value: GrantsConfigInput | undefined): GrantsConfig {
+  if (value === undefined) {
+    return { enabled: false };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants must be an object with enabled",
+    );
+  }
+  if (!value.enabled) {
+    return { enabled: false };
+  }
+  const mode = value.mode ?? "transit";
+  if (mode !== "transit" && mode !== "secret") {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.mode must be transit or secret",
+    );
+  }
+  const max_exp = grantMaxExp(value.max_exp);
+  if (mode === "transit") {
+    return {
+      enabled: true,
+      mode: "transit",
+      max_exp,
+      transit_key: vaultName(
+        requiredText(value.transit_key, "grants.transit_key", "key name"),
+        "grants.transit_key",
+      ),
+      transit_mount: vaultName(
+        value.transit_mount ?? "transit",
+        "grants.transit_mount",
+      ),
+    };
+  }
+  const secret =
+    value.secret === undefined
+      ? (configEnv("GRANT_SECRET") ?? null)
+      : requiredText(value.secret, "grants.secret", "secret");
+  const secret_vault =
+    value.secret_vault === undefined
+      ? null
+      : secretVaultPath(
+          requiredText(value.secret_vault, "grants.secret_vault", "path"),
+        );
+  if (secret === null && secret_vault === null) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret, GRANT_SECRET, or grants.secret_vault is required",
+    );
+  }
+  return {
+    enabled: true,
+    mode: "secret",
+    max_exp,
+    secret,
+    secret_vault,
+    secret_field: vaultName(
+      value.secret_field ?? "secret",
+      "grants.secret_field",
+    ),
+  };
+}
+
+function configBatch(value: BatchConfigInput | undefined): BatchConfig {
+  if (value === undefined) {
+    return { enabled: true };
+  }
+  if (typeof value === "boolean") {
+    return { enabled: value };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts batch must be a boolean or an object with enabled",
+    );
+  }
+  return { enabled: value.enabled };
+}
+
 function isEnabledObject(value: unknown): value is { enabled: boolean } {
   return (
     typeof value === "object" &&
@@ -325,14 +451,51 @@ function absoluteHttpUrl(value: unknown, field: string) {
 }
 
 function vaultMount(value: string) {
-  const mount = value.trim().replace(/^\/+|\/+$/g, "");
-  if (!/^[A-Za-z0-9_-]+$/.test(mount)) {
+  return vaultName(value, "vault.mount");
+}
+
+function vaultName(value: string, field: string) {
+  const name = value.trim().replace(/^\/+|\/+$/g, "");
+  if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+    throw projectError(
+      "invalidConfigFile",
+      `keja.config.ts ${field} must be a name`,
+    );
+  }
+  return name;
+}
+
+function secretVaultPath(value: string) {
+  const cleaned = value.trim().replace(/^\/+|\/+$/g, "");
+  const parts = cleaned.split("/");
+  if (
+    !cleaned ||
+    parts.some((part) => part.length === 0 || part === "." || part === "..")
+  ) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret_vault must be a Vault secret path",
+    );
+  }
+  return cleaned;
+}
+
+function grantMaxExp(value: number | undefined) {
+  if (value === undefined) {
+    return 900;
+  }
+  if (
+    typeof value !== "number" ||
+    !Number.isInteger(value) ||
+    value < 1 ||
+    value > 86400
+  ) {
     throw projectError(
       "invalidConfigFile",
-      `keja.config.ts vault.mount must be a mount name`,
+      "keja.config.ts grants.max_exp must be a whole number of seconds from 1 to 86400",
     );
   }
-  return mount;
+  return value;
 }
 
 function configEnv(name: string) {
@@ -398,6 +561,27 @@ function hasVault(value: object) {
   );
 }
 
+function hasGrants(value: object) {
+  const grants = (value as KejaConfig).grants;
+  return (
+    typeof grants === "object" &&
+    grants !== null &&
+    (grants.enabled === false ||
+      (grants.enabled === true &&
+        (grants.mode === "transit" || grants.mode === "secret") &&
+        typeof grants.max_exp === "number"))
+  );
+}
+
+function hasBatch(value: object) {
+  const batch = (value as KejaConfig).batch;
+  return (
+    typeof batch === "object" &&
+    batch !== null &&
+    typeof batch.enabled === "boolean"
+  );
+}
+
 function hasDatabase(value: object) {
   const database = (value as KejaConfig).database;
   return (

package/src/project/load.ts

@@ -11,7 +11,9 @@ import {
 import { isVersions, type VersionDefinition } from "../versioning/define.ts";
 import {
   type ArgusConfig,
+  type BatchConfig,
   type DatabaseConfig,
+  type GrantsConfig,
   loadConfig,
   type ProjectPaths,
   type VaultConfig,
@@ -23,6 +25,8 @@ export type LoadedProject = {
   name: string | null;
   argus: ArgusConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
   database: DatabaseConfig;
   versions: VersionDefinition[];
   publicRoutes: RouteDefinition[];
@@ -58,6 +62,8 @@ export async function loadProject(
     name: loaded.name,
     argus: loaded.argus,
     vault: loaded.vault,
+    grants: loaded.grants,
+    batch: loaded.batch,
     database: loaded.database,
     versions: versioning.default.versions,
     publicRoutes: await loadRoutes(publicDirectory, generation),

package/src/route/define.ts

@@ -78,6 +78,7 @@ export type RouteDefinition = {
   method: HttpMethod;
   path: string;
   version: string;
+  name: string | null;
   request: RequestSchemas;
   responses: RouteResponse[];
   middleware: readonly MiddlewareDefinition<object>[];
@@ -124,6 +125,7 @@ export function defineRoute<
 >(definition: {
   method: HttpMethod;
   path: string;
+  name?: string;
   version: VersionId<Version> extends never
     ? "Version must use the form v1, v2, v3"
     : Version;
@@ -150,6 +152,17 @@ export function defineRoute<
       `Path ${String(definition.path)} must start with /`,
     );
   }
+  const name =
+    definition.name === undefined
+      ? null
+      : typeof definition.name === "string" && definition.name.trim() !== ""
+        ? definition.name.trim()
+        : (() => {
+            throw projectError(
+              "invalidRoute",
+              `${definition.method.toUpperCase()} ${definition.path} name must be a non-empty string`,
+            );
+          })();
   const request = definition.request as RequestSchemas | undefined;
   if (request) {
     for (const key of ["params", "query", "body"] as const) {
@@ -229,6 +242,7 @@ export function defineRoute<
     method: definition.method,
     path: definition.path,
     version: definition.version,
+    name,
     request: definition.request ?? {},
     responses,
     middleware,

package/src/server/index.ts

@@ -4,7 +4,8 @@ import { startArgusHeartbeat } from "../argus/heartbeat.ts";
 import { argusRegistrations, publishArgus } from "../argus/register.ts";
 import { connectDatabase } from "../db/postgres.ts";
 import { readOpenApiServers, readRequiredEnv } from "../env/required-env.ts";
-import { projectError } from "../errors/framework-errors.ts";
+import { DependencyNotMet, projectError } from "../errors/framework-errors.ts";
+import { connectGrants, setGrants } from "../grant/settings.ts";
 import { createHttpApp } from "../http/create-app.ts";
 import { type LoadedProject, loadProject } from "../project/load.ts";
 import { formatSelfTest, runSelfTest } from "../self-test/run.ts";
@@ -24,6 +25,8 @@ export {
   DependencyNotMet,
   frameworkErrors,
 } from "../errors/framework-errors.ts";
+export type { Grant } from "../grant/grant.ts";
+export { grant, verifyGrant } from "../grant/grant.ts";
 export { defineConfig } from "../project/config.ts";
 export { defineRepositories } from "../repository/define.ts";
 export { repository } from "../repository/runtime.ts";
@@ -73,6 +76,21 @@ export async function listen(
   } else {
     setVault(null);
   }
+  if (project.grants.enabled) {
+    if (project.grants.mode === "transit" && !project.vault.enabled) {
+      throw new DependencyNotMet("grant transit", "vault");
+    }
+    if (
+      project.grants.mode === "secret" &&
+      project.grants.secret_vault &&
+      !project.vault.enabled
+    ) {
+      throw new DependencyNotMet("grant secret_vault", "vault");
+    }
+    await connectGrants(project.grants);
+  } else {
+    setGrants(null);
+  }
   const mounted = mountProject(root, project, env, openApiServers);
   const identity = mounted.identity;
   if (project.argus.enabled) {
@@ -155,6 +173,7 @@ function mountProject(
       middleware: project.publicMiddleware,
       server: openApiServers.openapiServer,
       identity,
+      batch: project.batch.enabled,
     }),
     serviceApp: createHttpApp({
       title: "Service",
@@ -164,6 +183,7 @@ function mountProject(
       server: openApiServers.openapiServiceServer,
       identity,
       postOnly: true,
+      batch: project.batch.enabled,
     }),
   };
 }

package/src/vault/client.ts

@@ -62,6 +62,7 @@ export function createVault(options: VaultClientOptions = {}) {
     options.mount ?? envValue("VAULT_KV_MOUNT") ?? "secret",
   );
   const fetchImpl = options.fetch ?? fetch;
+  const headers = () => vaultHeaders(token, namespace);
   return {
     async secret<
       Data extends Record<string, unknown> = Record<string, unknown>,
@@ -70,7 +71,7 @@ export function createVault(options: VaultClientOptions = {}) {
       const response = await fetchImpl(
         `${address}/v1/${mount}/data/${secretPath}`,
         {
-          headers: vaultHeaders(token, namespace),
+          headers: headers(),
         },
       );
       if (!response.ok) {
@@ -84,9 +85,76 @@ export function createVault(options: VaultClientOptions = {}) {
       }
       return body.data.data;
     },
+    transitKey(mountName: string, key: string) {
+      const transit = secretMount(mountName);
+      const name = secretMount(key);
+      return vaultSend<{ type?: unknown; latest_version?: unknown }>(
+        fetchImpl,
+        `${address}/v1/${transit}/keys/${name}`,
+        { headers: headers() },
+        `${transit}/keys/${name}`,
+      );
+    },
+    transitSign(mountName: string, key: string, body: TransitSignBody) {
+      const transit = secretMount(mountName);
+      const name = secretMount(key);
+      return vaultSend<{ signature?: unknown }>(
+        fetchImpl,
+        `${address}/v1/${transit}/sign/${name}`,
+        {
+          method: "POST",
+          headers: jsonHeaders(headers()),
+          body: JSON.stringify(body),
+        },
+        `${transit}/sign/${name}`,
+      );
+    },
+    transitVerify(mountName: string, key: string, body: TransitVerifyBody) {
+      const transit = secretMount(mountName);
+      const name = secretMount(key);
+      return vaultSend<{ valid?: unknown }>(
+        fetchImpl,
+        `${address}/v1/${transit}/verify/${name}`,
+        {
+          method: "POST",
+          headers: jsonHeaders(headers()),
+          body: JSON.stringify(body),
+        },
+        `${transit}/verify/${name}`,
+      );
+    },
   };
 }
 
+export function openVault(feature: string) {
+  const settings = requireVaultSettings(feature);
+  return createVault({
+    address: settings.address,
+    token: settings.token,
+    namespace: settings.namespace ?? undefined,
+    mount: settings.mount,
+    fetch: state.fetch,
+  });
+}
+
+export function requireVaultSettings(feature: string) {
+  if (!state.active) {
+    throw new DependencyNotMet(feature, "vault");
+  }
+  return state.active;
+}
+
+type TransitSignBody = {
+  input: string;
+  hash_algorithm?: string;
+  marshaling_algorithm?: string;
+  signature_algorithm?: string;
+};
+
+type TransitVerifyBody = TransitSignBody & {
+  signature: string;
+};
+
 export function vaultSecret<
   Data extends Record<string, unknown> = Record<string, unknown>,
 >(path: string, options?: VaultClientOptions) {
@@ -141,6 +209,29 @@ function normalizePath(path: string) {
   return parts.map((part) => encodeURIComponent(part)).join("/");
 }
 
+async function vaultSend<Data>(
+  fetchImpl: VaultClientOptions["fetch"],
+  url: string,
+  init: RequestInit,
+  path: string,
+) {
+  const fetch = fetchImpl ?? globalThis.fetch;
+  const response = await fetch(url, init);
+  if (!response.ok) {
+    throw await vaultFailure(response, path);
+  }
+  const body = (await response.json()) as { data?: Data };
+  if (!body.data || typeof body.data !== "object") {
+    throw new VaultError(`Vault ${path} has no data`);
+  }
+  return body.data;
+}
+
+function jsonHeaders(headers: Headers) {
+  headers.set("Content-Type", "application/json");
+  return headers;
+}
+
 function vaultHeaders(token: string, namespace: string | null) {
   const headers = new Headers({ "X-Vault-Token": token });
   if (namespace) {