biz-a-cli 2.3.80-15270 → 2.3.80-15271

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "biz-a-cli",
-	"version": "2.3.80-15270",
+	"version": "2.3.80-15271",
 	"description": "",
 	"main": "bin/index.js",
 	"type": "module",
@@ -17,6 +17,7 @@
 		"message-broker/**/*",
 		"migrations/**/*",
 		"scheduler/**/*",
+		"security/**/*",
 		"worker/**/*",
 		"callbackController.js",
 		"mailController.js",

package/security/secretProvider.js

@@ -0,0 +1,61 @@
+// Platform-level secret provider. Application-agnostic: resolves keys by NAME only —
+// it knows nothing about "ledger", "supertail", or any app. The backing store is
+// swappable (restricted-ACL file -> Windows DPAPI -> Vault/KMS) behind this same API
+// without touching any application. Fails CLOSED: an unprovisioned name throws.
+import fs from "node:fs";
+import path from "node:path";
+
+// Platform config knob (NOT an app secret): where the secrets store lives.
+const STORE_PATH =
+	process.env.BIZA_SECRETS_FILE ||
+	path.join(process.cwd(), "config", "secrets.json");
+
+let _cache = null;
+
+function loadStore() {
+	if (_cache) return _cache;
+	try {
+		_cache = JSON.parse(fs.readFileSync(STORE_PATH, "utf8"));
+	} catch {
+		_cache = {}; // missing / corrupt store -> every resolve fails closed
+	}
+	return _cache;
+}
+
+/* Store shape (rotation-aware):
+     {
+       "supertail.ledger": { "currentKeyId": "st_ledger_v1",
+                             "keys": { "st_ledger_v1": "<base64 key>" } }
+     }
+   Shorthand single-key form is also accepted (keyId = "default"):
+     { "supertail.session": "<base64 key>" }
+   Key material is base64; decoded to bytes for HMAC. */
+function resolve(name, keyId /* optional; used by verify to pin a past key */) {
+	const entry = loadStore()[name];
+	if (entry == null) {
+		throw new Error(`secret '${name}' is not provisioned (fail-closed)`);
+	}
+	if (typeof entry === "string") {
+		if (keyId && keyId !== "default") {
+			throw new Error(`secret '${name}' has no key '${keyId}'`);
+		}
+		return { keyId: "default", key: Buffer.from(entry, "base64") };
+	}
+	const id = keyId || entry.currentKeyId;
+	const b64 = entry.keys && entry.keys[id];
+	if (!b64) {
+		throw new Error(`secret '${name}' has no key '${id}'`);
+	}
+	return { keyId: id, key: Buffer.from(b64, "base64") };
+}
+
+export const secretProvider = {
+	// sign with the current key for `name`
+	resolveForSign: (name) => resolve(name),
+	// verify against the key that produced a row (pinned by its stored keyId)
+	resolveForVerify: (name, keyId) => resolve(name, keyId),
+	// test hook — drop the cache so a re-provisioned store is re-read
+	_reset: () => {
+		_cache = null;
+	},
+};