@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/js/src/feature/secrets/SecretsFeature.js

@@ -174,18 +174,25 @@ class SecretsFeature extends BaseFeature {
   // the op — sekreto's miss-vs-error rule: never fall through to an
   // unauthenticated request because a store was broken.
   //
-  // The promise is cleared on REJECTION, and after success when caching is
-  // off. Holding a settled promise forever would mean a transient vault
-  // outage poisoned the client permanently — every later operation failing
-  // with the original error long after the vault recovered — and it would
-  // make the documented `cache: false` a lie, since the chain would never
-  // be asked a second time.
+  // The promise is cleared on REJECTION, after success when caching is off,
+  // and after a MISS however caching is set. Holding a settled promise
+  // forever would mean a transient vault outage poisoned the client
+  // permanently — every later operation failing with the original error long
+  // after the vault recovered — and it would make the documented
+  // `cache: false` a lie, since the chain would never be asked a second time.
+  //
+  // The MISS rule is sekreto's, not this feature's: `A miss is never cached:
+  // the next read asks again`, in sekreto's own source. Retaining a settled
+  // miss here would override that from the layer above, and a secret
+  // provisioned after startup — a mounted file, a policy granted a minute
+  // late — would never be picked up for the life of the client. `cache` is
+  // about caching a HIT; it was never a promise to keep saying no.
   resolve() {
     if (null == this._resolving) {
       const inflight = this._resolveonce()
         .then(
-          () => {
-            if (!this._cache) {
+          (hit) => {
+            if (!this._cache || !hit) {
               this._resolving = undefined
             }
           },
@@ -201,9 +208,12 @@ class SecretsFeature extends BaseFeature {
   }
 
 
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not retain.
   async _resolveonce() {
     if (null == this._sekreto) {
-      return
+      return false
     }
 
     const found = await this._sekreto.try(this._secretname)
@@ -215,7 +225,7 @@ class SecretsFeature extends BaseFeature {
         // resolved value lands where the sync auth path already looks.
         this._client._options.apikey = found
       }
-      return
+      return undefined !== found
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -229,10 +239,23 @@ class SecretsFeature extends BaseFeature {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers 401 and the transport wrapper buys another, which is
       // the same path expiry takes anyway.
-      return
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. _withRefresh honours suppression
+    // for the RETRY, but it runs after this — by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this._client.options().auth) {
+      return false
     }
 
     this._client._options.apikey = await this._buy()
+
+    return true
   }
 
 

package/project/.sdk/tm/js/test/feature/secrets/Secrets.test.js

@@ -379,6 +379,71 @@ describe('secrets', () => {
   })
 
 
+  // A MISS IS NOT A CACHEABLE ANSWER — sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // Default caching here, deliberately: `cache: true` is about holding a
+  // HIT, and holding the settled promise after a miss meant the chain was
+  // never asked again for the life of the client. A secret provisioned
+  // after startup (a mounted file, a vault policy granted a minute late)
+  // was invisible forever, and the only workaround was giving up hit
+  // caching entirely.
+  test('active: a MISS is re-asked, so a late secret is picked up',
+    async () => {
+      let calls = 0
+      const sdk = SDK.test({}, {
+        feature: {
+          secrets: {
+            active: true,
+            providers: [{
+              lookup(_name) {
+                calls++
+                // Absent on the first ask, present on the second.
+                return 1 < calls ? 'LATEKEY' : undefined
+              },
+              describe() { return 'late:test' },
+            }],
+          },
+        },
+      })
+
+      const first = await sdk.prepare({ path: '/' })
+      assert.equal(first.headers['authorization'], undefined,
+        'the first resolve missed, so no credential should go out')
+
+      const second = await sdk.prepare({ path: '/' })
+      credentialIs(second.headers['authorization'], 'LATEKEY')
+
+      assert.ok(1 < calls,
+        'the chain was asked once and the MISS cached: a secret that ' +
+        'appears later can never be picked up')
+    })
+
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  test('active: a HIT is still cached by default', async () => {
+    let calls = 0
+    const sdk = SDK.test({}, {
+      feature: {
+        secrets: {
+          active: true,
+          providers: [{
+            lookup(_name) { calls++; return 'KEY' + calls },
+            describe() { return 'counting:test' },
+          }],
+        },
+      },
+    })
+
+    await sdk.prepare({ path: '/' })
+    await sdk.prepare({ path: '/' })
+
+    assert.equal(calls, 1,
+      'a hit must be cached under the default cache: true')
+  })
+
+
   test('active: secret name is configurable', async () => {
     process.env[ENVPREFIX + 'API_TOKEN'] = 'TOKKEY01'
     try {
@@ -861,6 +926,14 @@ describe('secrets exchange', () => {
     assert.equal(stub.api().length, 1, 'a suppressed request must not be retried')
     assert.equal(stub.api()[0].auth, undefined,
       'no credential may be sent when auth is suppressed')
+
+    // AND NO PURCHASE. This is the half the API-call assertions cannot see:
+    // resolve() runs before _withRefresh's suppression check, so the
+    // refresh token used to go to the token endpoint in a request body
+    // even here. Stopping the retry does not unsend it.
+    assert.equal(stub.token().length, 0,
+      'auth: null suppressed the credential but the refresh token was ' +
+      'still POSTed to the exchange endpoint')
   })
 
 

package/project/.sdk/tm/kotlin/feature/SecretsFeature.kt

@@ -270,11 +270,19 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     ctx.utility!!.fetcher = { ctx2, url, fetchdef -> transport(ctx2, url, fetchdef, inner) }
   }
 
-  // One resolution, shared by every concurrent caller. A settled SUCCESS is
+  // One resolution, shared by every concurrent caller. A settled HIT is
   // kept only when caching is on (`cache: false` means every resolve asks
   // the chain again); a FAILURE is always cleared, so a transient vault
   // outage never poisons the client permanently - the next operation asks
   // the chain again.
+  //
+  // A MISS is cleared too, however caching is set. That rule is sekreto's,
+  // not this feature's: `A miss is never cached: the next read asks again`,
+  // in sekreto's own source. Keeping a settled miss here would override
+  // that from the layer above, and a secret provisioned after startup - a
+  // mounted file, a policy granted a minute late - would never be picked up
+  // for the life of the client. `cache` is about caching a HIT; it was
+  // never a promise to keep saying no.
   fun resolve() {
     val ie = this.initerr
     if (null != ie) {
@@ -311,8 +319,9 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
 
     val call = mine!!
     var err: RuntimeException? = null
+    var hit = false
     try {
-      resolveonce()
+      hit = resolveonce()
     } catch (e: RuntimeException) {
       err = e
     } catch (e: Exception) {
@@ -325,7 +334,7 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     this.lock.withLock {
       call.err = err
       call.done = true
-      if (null != err || !this.cache) {
+      if (null != err || !this.cache || !hit) {
         this.resolving = null
       }
       this.settled.signalAll()
@@ -336,8 +345,11 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
     }
   }
 
-  private fun resolveonce() {
-    val s = this.sek ?: return
+  // Resolve once, reporting whether a credential came out of it. That
+  // boolean is the whole of what resolve() needs to tell a cacheable HIT
+  // from a miss it must not keep.
+  private fun resolveonce(): Boolean {
+    val s = this.sek ?: return false
 
     // A provider ERROR throws out of here and fails the op (via the
     // transport gate); only a MISS (null) falls through.
@@ -353,7 +365,7 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
         // unreachable.)
         this.cred = found ?: ""
       }
-      return
+      return null != found
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -376,10 +388,23 @@ class SecretsFeature : BaseFeature("secrets", "0.1.0", true) {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers with an expiry status and the transport wrapper buys
       // another, which is the same path expiry takes anyway.
-      return
+      return true
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. withrefresh honours suppression
+    // for the RETRY, but it runs after this - by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (null == this.liveopts["auth"]) {
+      return false
     }
 
     buy()
+
+    return true
   }
 
   // transport wraps whatever transport was current at init.

package/project/.sdk/tm/kotlin/test/feature/secrets/SecretsTest.kt

@@ -449,6 +449,67 @@ class SecretsTest {
       "a chain MISS must leave the header off, got \"" + w.api()[0].auth + "\"")
   }
 
+  // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // DEFAULT caching here, which is the whole point: `cache: true` is about
+  // holding a HIT, and keeping the settled resolution after a miss meant
+  // the chain was never asked again for the life of the client. A secret
+  // provisioned after startup (a mounted file, a vault policy granted a
+  // minute late) was invisible forever, and the only workaround was giving
+  // up hit caching entirely.
+  @Test
+  fun aCachedMissIsReasked() {
+    var present = false
+    var calls = 0
+    val w = Wire()
+    val client = secretsClient(w, map(
+      "feature" to chainOpts(TestProvider({ _ ->
+        synchronized(this) {
+          calls++
+          if (present) "LATEKEY01" else null
+        }
+      }, "late:test")),
+    ))
+
+    driveEntityOp(client, w)
+    val first = w.api()[0]
+    assertFalse(first.hasAuth && "" != first.auth,
+      "the chain has nothing yet, so no credential should go out")
+
+    val asked = synchronized(this) { calls }
+    assertTrue(0 < asked)
+
+    // The secret is provisioned while the client is live.
+    synchronized(this) { present = true }
+
+    driveEntityOp(client, w)
+    credentialIs(w.api().last().auth, "LATEKEY01")
+
+    assertTrue(asked < synchronized(this) { calls },
+      "the MISS was cached: a secret that appears later can never be picked up")
+  }
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  @Test
+  fun aCachedHitIsKept() {
+    var calls = 0
+    val w = Wire()
+    val client = secretsClient(w, map(
+      "feature" to chainOpts(TestProvider({ _ ->
+        synchronized(this) { calls++ }
+        "STABLEKEY01"
+      }, "counting:test")),
+    ))
+
+    driveEntityOp(client, w)
+    driveEntityOp(client, w)
+
+    assertEquals(1, synchronized(this) { calls },
+      "a hit must be cached under the default cache: true")
+  }
+
   @Test
   fun authNullSuppressesTheCredentialChainOrNoChain() {
     val w = Wire()
@@ -1114,6 +1175,14 @@ class SecretsTest {
     assertFalse(w.api()[0].hasAuth,
       "no credential may be sent when auth is suppressed, got \"" +
         w.api()[0].auth + "\"")
+
+    // AND NO PURCHASE. resolve() runs before withrefresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assertEquals(0, w.token().size,
+      "auth null suppressed the credential but the refresh token was still " +
+        "POSTed to the exchange endpoint")
   }
 
   @Test

package/project/.sdk/tm/lua/Makefile

@@ -1,13 +1,24 @@
 .PHONY: test build clean publish
 
-test:
+# NATIVE is the list of compiled artefacts this SDK needs, and it is EMPTY
+# unless a feature says otherwise. A feature that needs a compile step
+# ships a `native.mk` fragment in its own folder, generated by the target's
+# Main component ONLY when the model's choice of that feature's options
+# calls for it, and it adds its artefact to NATIVE and the rule that builds
+# it. No fragment means nothing is compiled and nothing beyond Lua is
+# linked - which is the common case, and why the include is a wildcard
+# rather than a name: this file names no feature.
+NATIVE ?=
+-include $(wildcard feature/*/native.mk)
+
+test: build
 	busted -p _test test/
 
-build:
-	@echo "No build step for Lua"
+build: $(NATIVE)
+	@echo "lua: build complete$(if $(NATIVE), ($(NATIVE)),: no compile step)"
 
 clean:
-	@echo "No clean step for Lua"
+	@if [ -n "$(NATIVE)" ]; then rm -f $(NATIVE); echo "removed $(NATIVE)"; else echo "No clean step for Lua"; fi
 
 # --- Release: publish to LuaRocks -----------------------------------------
 # Upload the rockspec to LuaRocks, then tag lua/vX.Y.Z. LuaRocks has no boru