@zincapp/zn-vault-agent 1.4.0 → 1.6.0

package/dist/services/managed-key-renewal.js

@@ -0,0 +1,212 @@
+// Path: src/services/managed-key-renewal.ts
+// Automatic managed API key renewal service
+// Schedules key refresh based on rotation metadata from the vault server
+import { loadConfig, updateManagedKey, isManagedKeyMode } from '../lib/config.js';
+import { bindManagedApiKey } from '../lib/api.js';
+import { createLogger } from '../lib/logger.js';
+const log = createLogger({ module: 'managed-key-renewal' });
+// How early before rotation to refresh (30 seconds default)
+const DEFAULT_REFRESH_BEFORE_MS = 30 * 1000;
+// Minimum refresh interval (don't refresh more than once per minute)
+const MIN_REFRESH_INTERVAL_MS = 60 * 1000;
+// Fallback interval if no rotation time is known (5 minutes)
+const FALLBACK_REFRESH_INTERVAL_MS = 5 * 60 * 1000;
+let refreshTimer = null;
+let isRunning = false;
+let currentKey = null;
+// Callback for when key changes (used to notify other parts of the system)
+let onKeyChangedCallback = null;
+/**
+ * Set callback for when the API key changes
+ * This allows other parts of the system (e.g., WebSocket) to be notified
+ */
+export function onKeyChanged(callback) {
+    onKeyChangedCallback = callback;
+}
+/**
+ * Perform a managed key bind and update config
+ */
+async function refreshManagedKey() {
+    const config = loadConfig();
+    if (!config.managedKey?.name) {
+        log.debug('No managed key configured, skipping refresh');
+        return null;
+    }
+    if (!config.auth.apiKey) {
+        log.error('No API key available to perform bind');
+        return null;
+    }
+    try {
+        log.debug({ name: config.managedKey.name }, 'Binding to managed key');
+        const bindResponse = await bindManagedApiKey(config.managedKey.name);
+        const oldKey = currentKey;
+        currentKey = bindResponse.key;
+        // Update config with new key and metadata
+        updateManagedKey(bindResponse.key, {
+            nextRotationAt: bindResponse.nextRotationAt,
+            graceExpiresAt: bindResponse.graceExpiresAt,
+            rotationMode: bindResponse.rotationMode,
+        });
+        // Notify if key changed
+        if (oldKey && oldKey !== bindResponse.key) {
+            log.info({
+                oldPrefix: oldKey.substring(0, 8),
+                newPrefix: bindResponse.key.substring(0, 8),
+                nextRotationAt: bindResponse.nextRotationAt,
+            }, 'Managed key rotated');
+            if (onKeyChangedCallback) {
+                onKeyChangedCallback(bindResponse.key);
+            }
+        }
+        else {
+            log.debug({
+                prefix: bindResponse.key.substring(0, 8),
+                nextRotationAt: bindResponse.nextRotationAt,
+            }, 'Managed key refreshed (no change)');
+        }
+        return bindResponse;
+    }
+    catch (err) {
+        log.error({ err, name: config.managedKey.name }, 'Failed to bind managed key');
+        return null;
+    }
+}
+/**
+ * Calculate when to next refresh the key
+ */
+function calculateNextRefreshMs(bindResponse) {
+    const config = loadConfig();
+    const now = Date.now();
+    // Priority 1: Use nextRotationAt from bind response or config
+    const nextRotationAt = bindResponse?.nextRotationAt || config.managedKey?.nextRotationAt;
+    if (nextRotationAt) {
+        const rotationTime = new Date(nextRotationAt).getTime();
+        const refreshTime = rotationTime - DEFAULT_REFRESH_BEFORE_MS;
+        const delay = Math.max(refreshTime - now, MIN_REFRESH_INTERVAL_MS);
+        log.debug({
+            nextRotationAt,
+            refreshInMs: delay,
+            refreshInMinutes: Math.round(delay / 60000),
+        }, 'Scheduled refresh based on nextRotationAt');
+        return delay;
+    }
+    // Priority 2: Use graceExpiresAt (refresh well before grace ends)
+    const graceExpiresAt = bindResponse?.graceExpiresAt || config.managedKey?.graceExpiresAt;
+    if (graceExpiresAt) {
+        const graceEndTime = new Date(graceExpiresAt).getTime();
+        // Refresh at 50% of remaining grace period
+        const refreshTime = now + (graceEndTime - now) / 2;
+        const delay = Math.max(refreshTime - now, MIN_REFRESH_INTERVAL_MS);
+        log.debug({
+            graceExpiresAt,
+            refreshInMs: delay,
+            refreshInMinutes: Math.round(delay / 60000),
+        }, 'Scheduled refresh based on graceExpiresAt');
+        return delay;
+    }
+    // Fallback: use default interval
+    log.debug({
+        refreshInMs: FALLBACK_REFRESH_INTERVAL_MS,
+        refreshInMinutes: FALLBACK_REFRESH_INTERVAL_MS / 60000,
+    }, 'Using fallback refresh interval (no rotation time available)');
+    return FALLBACK_REFRESH_INTERVAL_MS;
+}
+/**
+ * Schedule the next key refresh
+ */
+function scheduleNextRefresh(bindResponse) {
+    // Clear any existing timer
+    if (refreshTimer) {
+        clearTimeout(refreshTimer);
+        refreshTimer = null;
+    }
+    if (!isRunning) {
+        return;
+    }
+    const delay = calculateNextRefreshMs(bindResponse);
+    refreshTimer = setTimeout(async () => {
+        if (!isRunning)
+            return;
+        try {
+            const response = await refreshManagedKey();
+            scheduleNextRefresh(response);
+        }
+        catch (err) {
+            log.error({ err }, 'Managed key refresh failed, retrying in 1 minute');
+            // On error, retry in 1 minute
+            scheduleNextRefresh(null);
+        }
+    }, delay);
+    log.info({
+        refreshInMinutes: Math.round(delay / 60000),
+        refreshAt: new Date(Date.now() + delay).toISOString(),
+    }, 'Managed key refresh scheduled');
+}
+/**
+ * Start the managed key renewal service
+ * Returns the initial bind response or null if not in managed key mode
+ */
+export async function startManagedKeyRenewal() {
+    if (isRunning) {
+        log.warn('Managed key renewal service already running');
+        return null;
+    }
+    if (!isManagedKeyMode()) {
+        log.debug('Not in managed key mode, service not started');
+        return null;
+    }
+    const config = loadConfig();
+    isRunning = true;
+    currentKey = config.auth.apiKey || null;
+    log.info({
+        managedKeyName: config.managedKey?.name,
+        rotationMode: config.managedKey?.rotationMode,
+    }, 'Starting managed key renewal service');
+    // Perform initial bind
+    const bindResponse = await refreshManagedKey();
+    // Schedule next refresh
+    scheduleNextRefresh(bindResponse);
+    return bindResponse;
+}
+/**
+ * Stop the managed key renewal service
+ */
+export function stopManagedKeyRenewal() {
+    if (refreshTimer) {
+        clearTimeout(refreshTimer);
+        refreshTimer = null;
+    }
+    isRunning = false;
+    currentKey = null;
+    onKeyChangedCallback = null;
+    log.debug('Managed key renewal service stopped');
+}
+/**
+ * Force an immediate key refresh
+ */
+export async function forceRefresh() {
+    if (!isManagedKeyMode()) {
+        log.warn('Cannot force refresh - not in managed key mode');
+        return null;
+    }
+    const response = await refreshManagedKey();
+    if (isRunning) {
+        scheduleNextRefresh(response);
+    }
+    return response;
+}
+/**
+ * Get current managed key status
+ */
+export function getManagedKeyStatus() {
+    const config = loadConfig();
+    return {
+        isRunning,
+        isManagedMode: isManagedKeyMode(),
+        managedKeyName: config.managedKey?.name,
+        currentKeyPrefix: currentKey ? currentKey.substring(0, 8) + '...' : undefined,
+        nextRotationAt: config.managedKey?.nextRotationAt,
+        graceExpiresAt: config.managedKey?.graceExpiresAt,
+    };
+}
+//# sourceMappingURL=managed-key-renewal.js.map

package/dist/services/managed-key-renewal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-key-renewal.js","sourceRoot":"","sources":["../../src/services/managed-key-renewal.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,4CAA4C;AAC5C,yEAAyE;AAEzE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAkC,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE5D,4DAA4D;AAC5D,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,qEAAqE;AACrE,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,IAAI,YAAY,GAA0B,IAAI,CAAC;AAC/C,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC,2EAA2E;AAC3E,IAAI,oBAAoB,GAAsC,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkC;IAC7D,oBAAoB,GAAG,QAAQ,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAEtE,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,UAAU,CAAC;QAC1B,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC;QAE9B,0CAA0C;QAC1C,gBAAgB,CAAC,YAAY,CAAC,GAAG,EAAE;YACjC,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,YAAY,EAAE,YAAY,CAAC,YAAY;SACxC,CAAC,CAAC;QAEH,wBAAwB;QACxB,IAAI,MAAM,IAAI,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3C,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C,EAAE,qBAAqB,CAAC,CAAC;YAE1B,IAAI,oBAAoB,EAAE,CAAC;gBACzB,oBAAoB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC;gBACR,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxC,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C,EAAE,mCAAmC,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,YAA8C;IAC5E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,8DAA8D;IAC9D,MAAM,cAAc,GAAG,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC;IACzF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,YAAY,GAAG,yBAAyB,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAEnE,GAAG,CAAC,KAAK,CAAC;YACR,cAAc;YACd,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;SAC5C,EAAE,2CAA2C,CAAC,CAAC;QAEhD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,YAAY,EAAE,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC;IACzF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,2CAA2C;QAC3C,MAAM,WAAW,GAAG,GAAG,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAEnE,GAAG,CAAC,KAAK,CAAC;YACR,cAAc;YACd,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;SAC5C,EAAE,2CAA2C,CAAC,CAAC;QAEhD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iCAAiC;IACjC,GAAG,CAAC,KAAK,CAAC;QACR,WAAW,EAAE,4BAA4B;QACzC,gBAAgB,EAAE,4BAA4B,GAAG,KAAK;KACvD,EAAE,8DAA8D,CAAC,CAAC;IAEnE,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,YAA8C;IACzE,2BAA2B;IAC3B,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3B,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAEnD,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC3C,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;YACvE,8BAA8B;YAC9B,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;IAEV,GAAG,CAAC,IAAI,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAC3C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;KACtD,EAAE,+BAA+B,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,SAAS,GAAG,IAAI,CAAC;IACjB,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAExC,GAAG,CAAC,IAAI,CAAC;QACP,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI;QACvC,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY;KAC9C,EAAE,sCAAsC,CAAC,CAAC;IAE3C,uBAAuB;IACvB,MAAM,YAAY,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAE/C,wBAAwB;IACxB,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAElC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3B,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;IAClB,UAAU,GAAG,IAAI,CAAC;IAClB,oBAAoB,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IAQjC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,OAAO;QACL,SAAS;QACT,aAAa,EAAE,gBAAgB,EAAE;QACjC,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI;QACvC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;QAC7E,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc;QACjD,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,cAAc;KAClD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/zn-vault-agent",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "ZN-Vault Certificate Agent - Real-time certificate and secret distribution",
   "type": "module",
   "main": "dist/index.js",