@veducio/keja 0.3.0 → 0.4.0

package/src/project/config.test.ts

@@ -100,12 +100,46 @@ describe("defineConfig", () => {
       token: "s.token",
       namespace: "apps",
       mount: "kv",
-      transit_key: null,
-      transit_mount: "transit",
-      grant_max_exp: 900,
     });
     expect(defineConfig().vault).toEqual({ enabled: false });
   });
+
+  it("reads grants and batch settings from config", () => {
+    expect(
+      defineConfig({
+        grants: {
+          enabled: true,
+          mode: "transit",
+          transit_key: "keja-grants",
+        },
+      }).grants,
+    ).toEqual({
+      enabled: true,
+      mode: "transit",
+      max_exp: 900,
+      transit_key: "keja-grants",
+      transit_mount: "transit",
+    });
+    expect(
+      defineConfig({
+        grants: {
+          enabled: true,
+          mode: "secret",
+          secret: "test-secret",
+        },
+      }).grants,
+    ).toEqual({
+      enabled: true,
+      mode: "secret",
+      max_exp: 900,
+      secret: "test-secret",
+      secret_vault: null,
+      secret_field: "secret",
+    });
+    expect(defineConfig({ batch: false }).batch).toEqual({ enabled: false });
+    expect(defineConfig().grants).toEqual({ enabled: false });
+    expect(defineConfig().batch).toEqual({ enabled: true });
+  });
 });
 
 describe("loadConfig", () => {
@@ -117,6 +151,8 @@ describe("loadConfig", () => {
       argus: { enabled: false },
       database: { enabled: false },
       vault: { enabled: false },
+      grants: { enabled: false },
+      batch: { enabled: true },
       versioning: path.resolve(root, "keja.versioning.ts"),
       public: path.resolve(root, "src/public"),
       service: path.resolve(root, "src/service"),

package/src/project/config.ts

@@ -49,9 +49,6 @@ export type VaultSettings = {
   token: string;
   namespace: string | null;
   mount: string;
-  transit_key: string | null;
-  transit_mount: string;
-  grant_max_exp: number;
 };
 
 export type VaultConfigInput = {
@@ -60,15 +57,45 @@ export type VaultConfigInput = {
   token?: string;
   namespace?: string;
   mount?: string;
-  transit_key?: string;
-  transit_mount?: string;
-  grant_max_exp?: number;
 };
 
 export type VaultConfig =
   | { enabled: false }
   | ({ enabled: true } & VaultSettings);
 
+export type GrantsConfigInput = {
+  enabled: boolean;
+  mode?: "transit" | "secret";
+  max_exp?: number;
+  transit_key?: string;
+  transit_mount?: string;
+  secret?: string;
+  secret_vault?: string;
+  secret_field?: string;
+};
+
+export type GrantsConfig =
+  | { enabled: false }
+  | {
+      enabled: true;
+      mode: "transit";
+      max_exp: number;
+      transit_key: string;
+      transit_mount: string;
+    }
+  | {
+      enabled: true;
+      mode: "secret";
+      max_exp: number;
+      secret: string | null;
+      secret_vault: string | null;
+      secret_field: string;
+    };
+
+export type BatchConfigInput = boolean | { enabled: boolean };
+
+export type BatchConfig = { enabled: boolean };
+
 export type KejaConfigInput = {
   name?: string;
   versioning?: string;
@@ -77,6 +104,8 @@ export type KejaConfigInput = {
   argus?: ArgusConfigInput;
   db?: DatabaseConfigInput;
   vault?: VaultConfigInput;
+  grants?: GrantsConfigInput;
+  batch?: BatchConfigInput;
 };
 
 export type KejaConfig = {
@@ -87,6 +116,8 @@ export type KejaConfig = {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function defineConfig(input: KejaConfigInput = {}) {
@@ -110,6 +141,8 @@ export function defineConfig(input: KejaConfigInput = {}) {
     argus: configArgus(input.argus),
     database: configDatabase(input.db),
     vault: configVault(input.vault),
+    grants: configGrants(input.grants),
+    batch: configBatch(input.batch),
   };
   return Object.assign(config, { [configBrand]: true as const });
 }
@@ -126,7 +159,9 @@ export function isConfig(value: unknown): value is KejaConfig {
     hasName(value) &&
     hasArgus(value) &&
     hasDatabase(value) &&
-    hasVault(value)
+    hasVault(value) &&
+    hasGrants(value) &&
+    hasBatch(value)
   );
 }
 
@@ -142,6 +177,8 @@ export type LoadedConfig = ProjectPaths & {
   argus: ArgusConfig;
   database: DatabaseConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
 };
 
 export function resolveProjectPaths(root: string, config: KejaConfig) {
@@ -198,6 +235,8 @@ function loadedConfig(
     argus: config.argus,
     database: resolvedDatabase(root, config.database),
     vault: config.vault,
+    grants: config.grants,
+    batch: config.batch,
   };
 }
 
@@ -295,18 +334,90 @@ function configVault(value: VaultConfigInput | undefined): VaultConfig {
     ),
     namespace: optionalText(namespace, "vault.namespace", "namespace"),
     mount: vaultMount(value.mount ?? configEnv("VAULT_KV_MOUNT") ?? "secret"),
-    transit_key:
-      value.transit_key === undefined
-        ? null
-        : vaultName(value.transit_key, "vault.transit_key"),
-    transit_mount: vaultName(
-      value.transit_mount ?? "transit",
-      "vault.transit_mount",
+  };
+}
+
+function configGrants(value: GrantsConfigInput | undefined): GrantsConfig {
+  if (value === undefined) {
+    return { enabled: false };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants must be an object with enabled",
+    );
+  }
+  if (!value.enabled) {
+    return { enabled: false };
+  }
+  const mode = value.mode ?? "transit";
+  if (mode !== "transit" && mode !== "secret") {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.mode must be transit or secret",
+    );
+  }
+  const max_exp = grantMaxExp(value.max_exp);
+  if (mode === "transit") {
+    return {
+      enabled: true,
+      mode: "transit",
+      max_exp,
+      transit_key: vaultName(
+        requiredText(value.transit_key, "grants.transit_key", "key name"),
+        "grants.transit_key",
+      ),
+      transit_mount: vaultName(
+        value.transit_mount ?? "transit",
+        "grants.transit_mount",
+      ),
+    };
+  }
+  const secret =
+    value.secret === undefined
+      ? (configEnv("GRANT_SECRET") ?? null)
+      : requiredText(value.secret, "grants.secret", "secret");
+  const secret_vault =
+    value.secret_vault === undefined
+      ? null
+      : secretVaultPath(
+          requiredText(value.secret_vault, "grants.secret_vault", "path"),
+        );
+  if (secret === null && secret_vault === null) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret, GRANT_SECRET, or grants.secret_vault is required",
+    );
+  }
+  return {
+    enabled: true,
+    mode: "secret",
+    max_exp,
+    secret,
+    secret_vault,
+    secret_field: vaultName(
+      value.secret_field ?? "secret",
+      "grants.secret_field",
     ),
-    grant_max_exp: grantMaxExp(value.grant_max_exp),
   };
 }
 
+function configBatch(value: BatchConfigInput | undefined): BatchConfig {
+  if (value === undefined) {
+    return { enabled: true };
+  }
+  if (typeof value === "boolean") {
+    return { enabled: value };
+  }
+  if (!isEnabledObject(value)) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts batch must be a boolean or an object with enabled",
+    );
+  }
+  return { enabled: value.enabled };
+}
+
 function isEnabledObject(value: unknown): value is { enabled: boolean } {
   return (
     typeof value === "object" &&
@@ -354,6 +465,21 @@ function vaultName(value: string, field: string) {
   return name;
 }
 
+function secretVaultPath(value: string) {
+  const cleaned = value.trim().replace(/^\/+|\/+$/g, "");
+  const parts = cleaned.split("/");
+  if (
+    !cleaned ||
+    parts.some((part) => part.length === 0 || part === "." || part === "..")
+  ) {
+    throw projectError(
+      "invalidConfigFile",
+      "keja.config.ts grants.secret_vault must be a Vault secret path",
+    );
+  }
+  return cleaned;
+}
+
 function grantMaxExp(value: number | undefined) {
   if (value === undefined) {
     return 900;
@@ -366,7 +492,7 @@ function grantMaxExp(value: number | undefined) {
   ) {
     throw projectError(
       "invalidConfigFile",
-      "keja.config.ts vault.grant_max_exp must be a whole number of seconds from 1 to 86400",
+      "keja.config.ts grants.max_exp must be a whole number of seconds from 1 to 86400",
     );
   }
   return value;
@@ -435,6 +561,27 @@ function hasVault(value: object) {
   );
 }
 
+function hasGrants(value: object) {
+  const grants = (value as KejaConfig).grants;
+  return (
+    typeof grants === "object" &&
+    grants !== null &&
+    (grants.enabled === false ||
+      (grants.enabled === true &&
+        (grants.mode === "transit" || grants.mode === "secret") &&
+        typeof grants.max_exp === "number"))
+  );
+}
+
+function hasBatch(value: object) {
+  const batch = (value as KejaConfig).batch;
+  return (
+    typeof batch === "object" &&
+    batch !== null &&
+    typeof batch.enabled === "boolean"
+  );
+}
+
 function hasDatabase(value: object) {
   const database = (value as KejaConfig).database;
   return (

package/src/project/load.ts

@@ -11,7 +11,9 @@ import {
 import { isVersions, type VersionDefinition } from "../versioning/define.ts";
 import {
   type ArgusConfig,
+  type BatchConfig,
   type DatabaseConfig,
+  type GrantsConfig,
   loadConfig,
   type ProjectPaths,
   type VaultConfig,
@@ -23,6 +25,8 @@ export type LoadedProject = {
   name: string | null;
   argus: ArgusConfig;
   vault: VaultConfig;
+  grants: GrantsConfig;
+  batch: BatchConfig;
   database: DatabaseConfig;
   versions: VersionDefinition[];
   publicRoutes: RouteDefinition[];
@@ -58,6 +62,8 @@ export async function loadProject(
     name: loaded.name,
     argus: loaded.argus,
     vault: loaded.vault,
+    grants: loaded.grants,
+    batch: loaded.batch,
     database: loaded.database,
     versions: versioning.default.versions,
     publicRoutes: await loadRoutes(publicDirectory, generation),

package/src/route/define.ts

@@ -78,6 +78,7 @@ export type RouteDefinition = {
   method: HttpMethod;
   path: string;
   version: string;
+  name: string | null;
   request: RequestSchemas;
   responses: RouteResponse[];
   middleware: readonly MiddlewareDefinition<object>[];
@@ -124,6 +125,7 @@ export function defineRoute<
 >(definition: {
   method: HttpMethod;
   path: string;
+  name?: string;
   version: VersionId<Version> extends never
     ? "Version must use the form v1, v2, v3"
     : Version;
@@ -150,6 +152,17 @@ export function defineRoute<
       `Path ${String(definition.path)} must start with /`,
     );
   }
+  const name =
+    definition.name === undefined
+      ? null
+      : typeof definition.name === "string" && definition.name.trim() !== ""
+        ? definition.name.trim()
+        : (() => {
+            throw projectError(
+              "invalidRoute",
+              `${definition.method.toUpperCase()} ${definition.path} name must be a non-empty string`,
+            );
+          })();
   const request = definition.request as RequestSchemas | undefined;
   if (request) {
     for (const key of ["params", "query", "body"] as const) {
@@ -229,6 +242,7 @@ export function defineRoute<
     method: definition.method,
     path: definition.path,
     version: definition.version,
+    name,
     request: definition.request ?? {},
     responses,
     middleware,

package/src/server/index.ts

@@ -4,7 +4,8 @@ import { startArgusHeartbeat } from "../argus/heartbeat.ts";
 import { argusRegistrations, publishArgus } from "../argus/register.ts";
 import { connectDatabase } from "../db/postgres.ts";
 import { readOpenApiServers, readRequiredEnv } from "../env/required-env.ts";
-import { projectError } from "../errors/framework-errors.ts";
+import { DependencyNotMet, projectError } from "../errors/framework-errors.ts";
+import { connectGrants, setGrants } from "../grant/settings.ts";
 import { createHttpApp } from "../http/create-app.ts";
 import { type LoadedProject, loadProject } from "../project/load.ts";
 import { formatSelfTest, runSelfTest } from "../self-test/run.ts";
@@ -75,6 +76,21 @@ export async function listen(
   } else {
     setVault(null);
   }
+  if (project.grants.enabled) {
+    if (project.grants.mode === "transit" && !project.vault.enabled) {
+      throw new DependencyNotMet("grant transit", "vault");
+    }
+    if (
+      project.grants.mode === "secret" &&
+      project.grants.secret_vault &&
+      !project.vault.enabled
+    ) {
+      throw new DependencyNotMet("grant secret_vault", "vault");
+    }
+    await connectGrants(project.grants);
+  } else {
+    setGrants(null);
+  }
   const mounted = mountProject(root, project, env, openApiServers);
   const identity = mounted.identity;
   if (project.argus.enabled) {
@@ -157,6 +173,7 @@ function mountProject(
       middleware: project.publicMiddleware,
       server: openApiServers.openapiServer,
       identity,
+      batch: project.batch.enabled,
     }),
     serviceApp: createHttpApp({
       title: "Service",
@@ -166,6 +183,7 @@ function mountProject(
       server: openApiServers.openapiServiceServer,
       identity,
       postOnly: true,
+      batch: project.batch.enabled,
     }),
   };
 }

package/src/vault/client.test.ts

@@ -85,9 +85,6 @@ describe("createVault", () => {
         token: "s.token",
         namespace: null,
         mount: "secret",
-        transit_key: null,
-        transit_mount: "transit",
-        grant_max_exp: 900,
       },
       async (url) => {
         urls.push(url);
@@ -111,9 +108,6 @@ describe("createVault", () => {
           token: "s.token",
           namespace: null,
           mount: "secret",
-          transit_key: null,
-          transit_mount: "transit",
-          grant_max_exp: 900,
         },
         async () =>
           Response.json({ errors: ["permission denied"] }, { status: 403 }),