@workos-inc/node 7.41.0 → 7.43.0

package/lib/vault/interfaces/secret/update-secret.interface.d.ts

@@ -0,0 +1,9 @@
+export interface UpdateSecretEntity {
+    value: string;
+    version_check?: string;
+}
+export interface UpdateSecretOptions {
+    id: string;
+    value: string;
+    versionCheck?: string;
+}

package/lib/vault/interfaces/secret/update-secret.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/vault/interfaces/secret.interface.d.ts

@@ -0,0 +1,32 @@
+export interface SecretContext {
+    [key: string]: any;
+}
+export interface SecretDigest {
+    id: string;
+    name: string;
+    updatedAt: Date;
+}
+export interface SecretUpdateBy {
+    id: string;
+    name: string;
+}
+export interface SecretMetadata {
+    context: SecretContext;
+    environmentId: string;
+    id: string;
+    keyId: string;
+    updatedAt: Date;
+    updatedBy: SecretUpdateBy;
+    versionId: string;
+}
+export interface VaultSecret {
+    id: string;
+    metadata: SecretMetadata;
+    name: string;
+    value?: string;
+}
+export interface SecretVersion {
+    createdAt: Date;
+    currentVersion: boolean;
+    id: string;
+}

package/lib/vault/interfaces/secret.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/vault/serializers/vault-key.serializer.d.ts

@@ -0,0 +1,5 @@
+import { CreateDataKeyResponse } from '../interfaces/key/create-data-key.interface';
+import { DecryptDataKeyResponse } from '../interfaces/key/decrypt-data-key.interface';
+import { DataKey, DataKeyPair } from '../interfaces/key.interface';
+export declare const deserializeCreateDataKeyResponse: (key: CreateDataKeyResponse) => DataKeyPair;
+export declare const deserializeDecryptDataKeyResponse: (key: DecryptDataKeyResponse) => DataKey;

package/lib/vault/serializers/vault-key.serializer.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deserializeDecryptDataKeyResponse = exports.deserializeCreateDataKeyResponse = void 0;
+const deserializeCreateDataKeyResponse = (key) => ({
+    context: key.context,
+    dataKey: {
+        key: key.data_key,
+        id: key.id,
+    },
+    encryptedKeys: key.encrypted_keys,
+});
+exports.deserializeCreateDataKeyResponse = deserializeCreateDataKeyResponse;
+const deserializeDecryptDataKeyResponse = (key) => ({
+    key: key.data_key,
+    id: key.id,
+});
+exports.deserializeDecryptDataKeyResponse = deserializeDecryptDataKeyResponse;

package/lib/vault/serializers/vault-secret.serializer.d.ts

@@ -0,0 +1,8 @@
+import { List, ListResponse } from '../../common/interfaces';
+import { ReadSecretMetadataResponse, ReadSecretResponse, UpdateSecretOptions, UpdateSecretEntity, SecretMetadata, VaultSecret, SecretVersion, CreateSecretOptions, CreateSecretEntity, SecretDigestResponse, SecretDigest, ListSecretVersionsResponse } from '../interfaces';
+export declare const deserializeSecretMetadata: (metadata: ReadSecretMetadataResponse) => SecretMetadata;
+export declare const deserializeSecret: (secret: ReadSecretResponse) => VaultSecret;
+export declare const deserializeListSecrets: (list: ListResponse<SecretDigestResponse>) => List<SecretDigest>;
+export declare const desrializeListSecretVersions: (list: ListSecretVersionsResponse) => SecretVersion[];
+export declare const serializeCreateSecretEntity: (options: CreateSecretOptions) => CreateSecretEntity;
+export declare const serializeUpdateSecretEntity: (options: UpdateSecretOptions) => UpdateSecretEntity;

package/lib/vault/serializers/vault-secret.serializer.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeUpdateSecretEntity = exports.serializeCreateSecretEntity = exports.desrializeListSecretVersions = exports.deserializeListSecrets = exports.deserializeSecret = exports.deserializeSecretMetadata = void 0;
+const deserializeSecretMetadata = (metadata) => ({
+    context: metadata.context,
+    environmentId: metadata.environment_id,
+    id: metadata.id,
+    keyId: metadata.key_id,
+    updatedAt: new Date(Date.parse(metadata.updated_at)),
+    updatedBy: metadata.updated_by,
+    versionId: metadata.version_id,
+});
+exports.deserializeSecretMetadata = deserializeSecretMetadata;
+const deserializeSecret = (secret) => ({
+    id: secret.id,
+    name: secret.name,
+    value: secret.value,
+    metadata: (0, exports.deserializeSecretMetadata)(secret.metadata),
+});
+exports.deserializeSecret = deserializeSecret;
+const deserializeSecretDigest = (digest) => ({
+    id: digest.id,
+    name: digest.name,
+    updatedAt: new Date(Date.parse(digest.updated_at)),
+});
+const deserializeListSecrets = (list) => {
+    var _a, _b;
+    return ({
+        object: 'list',
+        data: list.data.map(deserializeSecretDigest),
+        listMetadata: {
+            after: (_a = list.list_metadata.after) !== null && _a !== void 0 ? _a : undefined,
+            before: (_b = list.list_metadata.before) !== null && _b !== void 0 ? _b : undefined,
+        },
+    });
+};
+exports.deserializeListSecrets = deserializeListSecrets;
+const desrializeListSecretVersions = (list) => list.data.map(deserializeSecretVersion);
+exports.desrializeListSecretVersions = desrializeListSecretVersions;
+const deserializeSecretVersion = (version) => ({
+    createdAt: new Date(Date.parse(version.created_at)),
+    currentVersion: version.current_version,
+    id: version.id,
+});
+const serializeCreateSecretEntity = (options) => ({
+    name: options.name,
+    value: options.value,
+    key_context: options.context,
+});
+exports.serializeCreateSecretEntity = serializeCreateSecretEntity;
+const serializeUpdateSecretEntity = (options) => ({
+    value: options.value,
+    version_check: options.versionCheck,
+});
+exports.serializeUpdateSecretEntity = serializeUpdateSecretEntity;

package/lib/vault/vault-live-test.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/vault/vault-live-test.spec.js

@@ -0,0 +1,245 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const jest_fetch_mock_1 = require("jest-fetch-mock");
+const workos_1 = require("../workos");
+const crypto_1 = require("crypto");
+const index_worker_1 = require("../index.worker");
+const conflict_exception_1 = require("../common/exceptions/conflict.exception");
+describe.skip('Vault Live Test', () => {
+    let workos;
+    const secretPrefix = (0, crypto_1.randomUUID)();
+    beforeAll(() => {
+        (0, jest_fetch_mock_1.disableFetchMocks)();
+        workos = new workos_1.WorkOS('API_KEY');
+    });
+    afterAll(() => {
+        (0, jest_fetch_mock_1.enableFetchMocks)();
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        let listLimit = 0;
+        let before;
+        do {
+            const allSecrets = yield workos.vault.listSecrets({ after: before });
+            for (const secret of allSecrets.data) {
+                if (secret.name.startsWith(secretPrefix)) {
+                    yield workos.vault.deleteSecret({ id: secret.id });
+                }
+            }
+            before = allSecrets.listMetadata.before;
+            listLimit++;
+        } while (listLimit < 100 && before !== undefined);
+    }));
+    describe('CRUD secrets', () => {
+        it('Creates secrets', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-lima`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Huacaya 27.7 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            const expectedMetadata = {
+                id: expect.any(String),
+                context: {
+                    fiber: 'Alpalca',
+                },
+                environmentId: expect.any(String),
+                keyId: expect.any(String),
+                updatedAt: expect.any(Date),
+                updatedBy: {
+                    id: expect.any(String),
+                    name: expect.any(String),
+                },
+                versionId: expect.any(String),
+            };
+            expect(newSecret).toStrictEqual(expectedMetadata);
+            const secretValue = yield workos.vault.readSecret({ id: newSecret.id });
+            expect(secretValue).toStrictEqual({
+                id: newSecret.id,
+                name: secretName,
+                value: 'Huacaya 27.7 micron',
+                metadata: expectedMetadata,
+            });
+        }));
+        it('Fails to create secrets with the same name', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-lima`;
+            yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Huacaya 27.7 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            yield expect(workos.vault.createSecret({
+                name: secretName,
+                value: 'Huacaya 27.7 micron',
+                context: { fiber: 'Alpalca' },
+            })).rejects.toThrow(conflict_exception_1.ConflictException);
+        }));
+        it('Updates secrets', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-cusco`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Tapada 20-30 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            const updatedSecret = yield workos.vault.updateSecret({
+                id: newSecret.id,
+                value: 'Ccara 30-40 micron',
+            });
+            const expectedMetadata = {
+                id: expect.any(String),
+                context: {
+                    fiber: 'Alpalca',
+                },
+                environmentId: expect.any(String),
+                keyId: expect.any(String),
+                updatedAt: expect.any(Date),
+                updatedBy: {
+                    id: expect.any(String),
+                    name: expect.any(String),
+                },
+                versionId: expect.any(String),
+            };
+            expect(updatedSecret).toStrictEqual({
+                id: newSecret.id,
+                name: secretName,
+                value: undefined,
+                metadata: expectedMetadata,
+            });
+            const secretValue = yield workos.vault.readSecret({ id: newSecret.id });
+            expect(secretValue).toStrictEqual({
+                id: newSecret.id,
+                name: secretName,
+                value: 'Ccara 30-40 micron',
+                metadata: expectedMetadata,
+            });
+        }));
+        it('Fails to update secrets with wrong version check', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-cusco`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Tapada 20-30 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            yield workos.vault.updateSecret({
+                id: newSecret.id,
+                value: 'Ccara 30-40 micron',
+            });
+            yield expect(workos.vault.updateSecret({
+                id: newSecret.id,
+                value: 'Ccara 30-40 micron',
+                versionCheck: newSecret.versionId,
+            })).rejects.toThrow(conflict_exception_1.ConflictException);
+        }));
+        it('Deletes secrets', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-machu`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Tapada 20-30 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            yield workos.vault.deleteSecret({ id: newSecret.id });
+            yield expect(workos.vault.readSecret({ id: newSecret.id })).rejects.toThrow(index_worker_1.NotFoundException);
+        }));
+        it('Describes secrets', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${(0, crypto_1.randomUUID)()}-trujillo`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Qiviut 11-13 micron',
+                context: { fiber: 'Musk Ox' },
+            });
+            const secretDescription = yield workos.vault.describeSecret({
+                id: newSecret.id,
+            });
+            const expectedMetadata = {
+                id: expect.any(String),
+                context: {
+                    fiber: 'Musk Ox',
+                },
+                environmentId: expect.any(String),
+                keyId: expect.any(String),
+                updatedAt: expect.any(Date),
+                updatedBy: {
+                    id: expect.any(String),
+                    name: expect.any(String),
+                },
+                versionId: expect.any(String),
+            };
+            expect(secretDescription).toStrictEqual({
+                id: newSecret.id,
+                name: secretName,
+                metadata: expectedMetadata,
+                value: undefined,
+            });
+        }));
+        it('Lists secrets with pagination', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretNames = [];
+            const numSecrets = 6;
+            const listPrefix = `${secretPrefix}-${(0, crypto_1.randomUUID)()}`;
+            for (let i = 0; i < numSecrets; i++) {
+                const secretName = `${listPrefix}-${i}`;
+                yield workos.vault.createSecret({
+                    name: secretName,
+                    value: 'Qiviut 11-13 micron',
+                    context: { fiber: 'Musk Ox' },
+                });
+                secretNames.push(secretName);
+            }
+            const allSecretNames = [];
+            let before;
+            do {
+                const list = yield workos.vault.listSecrets({
+                    limit: 2,
+                    after: before,
+                });
+                for (const secret of list.data) {
+                    if (secret.name.startsWith(listPrefix)) {
+                        allSecretNames.push(secret.name);
+                    }
+                }
+                before = list.listMetadata.before;
+            } while (before !== undefined);
+            const missingSecrets = secretNames.filter((name) => !allSecretNames.includes(name));
+            expect(allSecretNames.length).toEqual(numSecrets);
+            expect(missingSecrets).toStrictEqual([]);
+        }));
+        it('Lists secret versions', () => __awaiter(void 0, void 0, void 0, function* () {
+            const secretName = `${secretPrefix}-arequipa`;
+            const newSecret = yield workos.vault.createSecret({
+                name: secretName,
+                value: 'Tapada 20-30 micron',
+                context: { fiber: 'Alpalca' },
+            });
+            const updatedSecret = yield workos.vault.updateSecret({
+                id: newSecret.id,
+                value: 'Ccara 30-40 micron',
+            });
+            const versions = yield workos.vault.listSecretVersions({
+                id: newSecret.id,
+            });
+            expect(versions.length).toBe(2);
+            const currentVersion = versions.find((v) => v.currentVersion);
+            expect(currentVersion === null || currentVersion === void 0 ? void 0 : currentVersion.id).toBe(updatedSecret.metadata.versionId);
+            const firstVersion = versions.find((v) => v.id === newSecret.versionId);
+            expect(firstVersion === null || firstVersion === void 0 ? void 0 : firstVersion.currentVersion).toBe(false);
+        }));
+    });
+    describe('encrypt and decrypt', () => {
+        it('encrypts and decrypts data', () => __awaiter(void 0, void 0, void 0, function* () {
+            const superSecret = 'hot water freezes faster than cold water';
+            const keyContext = {
+                everything: 'everywhere',
+            };
+            const encrypted = yield workos.vault.encrypt(superSecret, keyContext);
+            const decrypted = yield workos.vault.decrypt(encrypted);
+            expect(decrypted).toBe(superSecret);
+        }));
+    });
+});

package/lib/vault/vault.d.ts

@@ -0,0 +1,19 @@
+import { PaginationOptions } from '../index.worker';
+import { WorkOS } from '../workos';
+import { CreateDataKeyOptions, CreateSecretOptions, DataKey, DataKeyPair, DecryptDataKeyOptions, DeleteSecretOptions, ReadSecretOptions, SecretContext, SecretDigest, SecretMetadata, SecretVersion, UpdateSecretOptions, VaultSecret } from './interfaces';
+import { List } from '../common/interfaces';
+export declare class Vault {
+    private readonly workos;
+    constructor(workos: WorkOS);
+    createSecret(options: CreateSecretOptions): Promise<SecretMetadata>;
+    listSecrets(options?: PaginationOptions | undefined): Promise<List<SecretDigest>>;
+    listSecretVersions(options: ReadSecretOptions): Promise<SecretVersion[]>;
+    readSecret(options: ReadSecretOptions): Promise<VaultSecret>;
+    describeSecret(options: ReadSecretOptions): Promise<VaultSecret>;
+    updateSecret(options: UpdateSecretOptions): Promise<VaultSecret>;
+    deleteSecret(options: DeleteSecretOptions): Promise<void>;
+    createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
+    decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
+    encrypt(data: string, context: SecretContext): Promise<string>;
+    decrypt(encryptedData: string): Promise<string>;
+}

package/lib/vault/vault.js

@@ -0,0 +1,97 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Vault = void 0;
+const decrypt_1 = require("./cryptography/decrypt");
+const encrypt_1 = require("./cryptography/encrypt");
+const vault_key_serializer_1 = require("./serializers/vault-key.serializer");
+const vault_secret_serializer_1 = require("./serializers/vault-secret.serializer");
+class Vault {
+    constructor(workos) {
+        this.workos = workos;
+    }
+    createSecret(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/kv`, (0, vault_secret_serializer_1.serializeCreateSecretEntity)(options));
+            return (0, vault_secret_serializer_1.deserializeSecretMetadata)(data);
+        });
+    }
+    listSecrets(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const url = new URL('/vault/v1/kv', this.workos.baseURL);
+            if (options === null || options === void 0 ? void 0 : options.after) {
+                url.searchParams.set('after', options.after);
+            }
+            if (options === null || options === void 0 ? void 0 : options.limit) {
+                url.searchParams.set('limit', options.limit.toString());
+            }
+            const { data } = yield this.workos.get(url.toString());
+            return (0, vault_secret_serializer_1.deserializeListSecrets)(data);
+        });
+    }
+    listSecretVersions(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/versions`);
+            return (0, vault_secret_serializer_1.desrializeListSecretVersions)(data);
+        });
+    }
+    readSecret(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+            return (0, vault_secret_serializer_1.deserializeSecret)(data);
+        });
+    }
+    describeSecret(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.get(`/vault/v1/kv/${encodeURIComponent(options.id)}/metadata`);
+            return (0, vault_secret_serializer_1.deserializeSecret)(data);
+        });
+    }
+    updateSecret(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.put(`/vault/v1/kv/${encodeURIComponent(options.id)}`, (0, vault_secret_serializer_1.serializeUpdateSecretEntity)(options));
+            return (0, vault_secret_serializer_1.deserializeSecret)(data);
+        });
+    }
+    deleteSecret(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.workos.delete(`/vault/v1/kv/${encodeURIComponent(options.id)}`);
+        });
+    }
+    createDataKey(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/keys/data-key`, options);
+            return (0, vault_key_serializer_1.deserializeCreateDataKeyResponse)(data);
+        });
+    }
+    decryptDataKey(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { data } = yield this.workos.post(`/vault/v1/keys/decrypt`, options);
+            return (0, vault_key_serializer_1.deserializeDecryptDataKeyResponse)(data);
+        });
+    }
+    encrypt(data, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataKey, encryptedKeys } = yield this.createDataKey({
+                context,
+            });
+            return (0, encrypt_1.encrypt)(data, dataKey.key, encryptedKeys);
+        });
+    }
+    decrypt(encryptedData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decoded = (0, decrypt_1.decode)(encryptedData);
+            const dataKey = yield this.decryptDataKey({ keys: decoded.keys });
+            return (0, decrypt_1.decrypt)(decoded, dataKey.key);
+        });
+    }
+}
+exports.Vault = Vault;

package/lib/vault/vault.spec.d.ts

@@ -0,0 +1 @@
+export {};