noodleseed-cli 0.1.5 → 0.1.7

package/node_modules/@noodle-borg/service/dist/service.js

@@ -7,7 +7,7 @@ import { InMemoryConnectorRegistry, MapServiceBroker, SecretBox, staticMasterKey
 import { applySecurityHeaders, createMcpRouter, effectiveProto, enforceHttps, mintCallerKey, noopLogger, verifyCallerKey, } from '@noodle-borg/transport-http';
 import { allowAllGate, GoogleControlPlaneGate, } from './auth/deploy-gate.js';
 import { isAuthServerPath } from './oauth/paths.js';
-import { InMemoryControlPlaneStore, JsonFileArtifactStore, validateOrgRole, validateSlug, validateTenantRef, } from './store.js';
+import { InMemoryConfigStore, InMemoryControlPlaneStore, JsonFileArtifactStore, resolveConfigScope, scopeChain, validateConfigName, validateConfigScope, validateOrgRole, validateSlug, validateTenantRef, } from './store.js';
 const DEFAULT_MAX_BODY = 1 << 20;
 /** Well-known prefix for OAuth 2.0 Protected Resource Metadata (RFC 9728); the resource path follows it. */
 const PRM_PREFIX = '/.well-known/oauth-protected-resource';
@@ -30,7 +30,7 @@ export class ServerRegistry {
     #records = new Map();
     #activeTenants = new Map();
     #store;
-    #secretBox;
+    #configStore;
     /** Single-flight: concurrent first-hits for an uncached id share one in-flight lazy compile (ADR 0036). */
     #inflight = new Map();
     /**
@@ -40,11 +40,11 @@ export class ServerRegistry {
      *   envelope. `serveService` enforces this (a `dataDir` fails closed without a master key); a caller that
      *   constructs this directly is responsible for the same pairing.
      */
-    constructor(store, secretBox) {
+    constructor(store, _secretBox, configStore) {
         this.#store = store;
-        this.#secretBox = secretBox;
+        this.#configStore = configStore ?? new InMemoryConfigStore();
     }
-    async deploy(tenant, manifest, connectors, secrets, actor, accessMode = 'caller-key', 
+    async deploy(tenant, manifest, connectors, actor, accessMode = 'caller-key', 
     /**
      * When true and a prior active deployment exists for this tenant, reuse its caller-key **hash** instead
      * of minting a new key (the plaintext is unrecoverable, so none is returned). Used by `noodle dev`
@@ -67,7 +67,7 @@ export class ServerRegistry {
                 ],
             };
         }
-        const built = this.#compileTarget(manifest, connectors, secrets ?? {});
+        const built = await this.#compileTarget(safeTenant, manifest, connectors);
         if (!built.ok)
             return { ok: false, errors: built.errors };
         const deploymentId = mintDeploymentId(built.served.artifact.server.name);
@@ -99,7 +99,7 @@ export class ServerRegistry {
                 ...(callerKeyHash ? { callerKeyHash } : {}),
                 manifest,
                 ...(connectors !== undefined ? { connectors } : {}),
-                secrets: await sealSecrets(secrets ?? {}, this.#secretBox),
+                secrets: emptySecretEnvelope(),
             };
             await this.#store.append(record);
             this.#records.set(record.deploymentId, record);
@@ -128,7 +128,7 @@ export class ServerRegistry {
                 ...(callerKeyHash ? { callerKeyHash } : {}),
                 manifest,
                 ...(connectors !== undefined ? { connectors } : {}),
-                secrets: { enc: 'none', values: secrets ?? {} },
+                secrets: emptySecretEnvelope(),
             });
         }
         this.#servers.set(deploymentId, {
@@ -177,23 +177,7 @@ export class ServerRegistry {
         const failed = [];
         let recovered = 0;
         for (const record of records) {
-            // Decrypt the persisted secrets first; a wrong/missing master key (or tampered ciphertext) must be
-            // fail-soft (skip + report this server), not crash the whole recovery. The error message carries no
-            // secret material (SecretDecryptError is deliberately opaque).
-            let secrets;
-            try {
-                secrets = await secretsOf(record.secrets, this.#secretBox);
-            }
-            catch (error) {
-                failed.push({
-                    deploymentId: record.deploymentId,
-                    errors: [
-                        { code: 'secret_decrypt_failed', path: 'secrets', message: error.message },
-                    ],
-                });
-                continue;
-            }
-            const built = this.#compileTarget(record.manifest, record.connectors, secrets);
+            const built = await this.#compileTarget(recordTenant(record), record.manifest, record.connectors);
             if (!built.ok) {
                 failed.push({ deploymentId: record.deploymentId, errors: built.errors });
                 continue;
@@ -213,7 +197,7 @@ export class ServerRegistry {
      * {@link recover}. Fails closed when a referenced secret has no value; the error names only the
      * reference, never a value.
      */
-    #compileTarget(manifest, connectors, secrets) {
+    async #compileTarget(tenant, manifest, connectors) {
         let catalogConnectors = [];
         let httpConnectors = [];
         let secretBindings = [];
@@ -225,19 +209,26 @@ export class ServerRegistry {
             httpConnectors = cc.connectors;
             secretBindings = cc.secretBindings;
         }
-        const broker = buildBroker(secretBindings, secrets);
-        if (!broker.ok)
-            return { ok: false, errors: broker.errors };
+        const scope = resolveConfigScope({
+            org: tenant.org,
+            app: tenant.app,
+            env: tenant.env,
+        });
+        const missing = missingSecretErrors(secretBindings, await this.#configStore.resolveConfigValues('secret', scope));
+        if (missing.length > 0)
+            return { ok: false, errors: missing };
         const compiled = compile(manifest, { catalog: new InMemoryCatalog(catalogConnectors) });
         if (!compiled.ok)
             return { ok: false, errors: compiled.errors };
+        const broker = new ManagedConfigBroker(secretBindings, this.#configStore, scope);
         return {
             ok: true,
             served: {
                 artifact: compiled.artifact,
                 deps: {
                     connectors: new InMemoryConnectorRegistry(httpConnectors),
-                    broker: broker.broker,
+                    broker,
+                    env: () => this.#configStore.resolveConfigValues('variable', scope),
                 },
             },
         };
@@ -332,6 +323,9 @@ export class ServerRegistry {
         const hash = active?.callerKeyHash;
         return hash !== undefined && verifyCallerKey(token, hash);
     }
+    get configStore() {
+        return this.#configStore;
+    }
     /**
      * The lazy half of {@link get}: point-read one persisted record and recompile it on a cache miss. `store`
      * is passed in (resolved by the caller) so this stays free of `#store`-narrowing. No record → `undefined`
@@ -341,11 +335,7 @@ export class ServerRegistry {
         const record = await store.get(deploymentId);
         if (!record)
             return undefined;
-        // A wrong/missing master key (or tampered ciphertext) throws here and propagates: the record exists but
-        // cannot be materialised (possibly transiently, e.g. KMS unavailable), so it is a `500`, not a `404`.
-        // `SecretDecryptError` is deliberately opaque — no secret material reaches the (swallowed) 500 body.
-        const secrets = await secretsOf(record.secrets, this.#secretBox);
-        const built = this.#compileTarget(record.manifest, record.connectors, secrets);
+        const built = await this.#compileTarget(recordTenant(record), record.manifest, record.connectors);
         if (!built.ok) {
             // The inputs compiled at deploy time; failing now is source/catalog drift — a server error. Codes
             // only (never a secret name or value) in case this is ever logged; the client gets a generic 500.
@@ -391,56 +381,51 @@ function recordSummary(record) {
         hasCallerKey: record.callerKeyHash !== undefined,
     };
 }
-/**
- * Encrypt deploy-supplied secret values into the at-rest envelope. With a {@link SecretBox} the whole
- * map is AES-256-GCM-sealed (`aes-256-gcm`); without one — non-persistent / in-memory paths only — it
- * falls back to the interim plaintext form (`none`). The live in-memory broker still holds plaintext;
- * only the persisted projection is sealed.
- */
-async function sealSecrets(values, box) {
-    if (!box)
-        return { enc: 'none', values: { ...values } };
-    return { enc: 'aes-256-gcm', sealed: await box.seal(JSON.stringify(values)) };
+function recordTenant(record) {
+    return { org: record.orgSlug, app: record.appSlug, env: record.environment };
 }
-/**
- * Recover plaintext secret values from a persisted envelope for replay. A `none` envelope is read
- * directly (non-persistent/in-memory); an `aes-256-gcm` envelope is decrypted with the {@link SecretBox} —
- * fail-closed if no box (no master key) is available, and a `SecretDecryptError` on a wrong key or
- * tampered ciphertext.
- */
-async function secretsOf(envelope, box) {
-    if (envelope.enc === 'none')
-        return { ...envelope.values };
-    if (!box) {
-        throw new Error('cannot recover an encrypted secret envelope without a secret master key');
-    }
-    return JSON.parse(await box.open(envelope.sealed));
+function emptySecretEnvelope() {
+    return { enc: 'none', values: {} };
 }
-/**
- * Resolve declared secret references against the deploy-supplied values into a per-server
- * {@link MapServiceBroker}. Each binding keyed by `(connectorId, operation?)` gets a `{token}` credential;
- * operations with no declared auth fall back to the broker's empty-token default (preserving public-API
- * behavior). A reference with no supplied value fails closed — the server is not registered — and the
- * error names only the reference (never a value), keeping secrets out of error bodies and logs.
- */
-function buildBroker(bindings, secrets) {
-    const entries = new Map();
+function missingSecretErrors(bindings, secrets) {
+    const seen = new Set();
     const errors = [];
     for (const binding of bindings) {
-        const value = secrets[binding.secretRef];
-        if (value === undefined) {
+        if (secrets[binding.secretRef] === undefined && !seen.has(binding.secretRef)) {
+            seen.add(binding.secretRef);
             errors.push({
                 code: 'missing_secret',
                 path: `secrets.${binding.secretRef}`,
-                message: `no value supplied for required secret "${binding.secretRef}"`,
+                message: `no managed value found for required secret "${binding.secretRef}"`,
             });
-            continue;
         }
-        entries.set(MapServiceBroker.key(binding.connectorId, binding.operation), { token: value });
     }
-    if (errors.length > 0)
-        return { ok: false, errors };
-    return { ok: true, broker: new MapServiceBroker(entries) };
+    return errors;
+}
+class ManagedConfigBroker {
+    #bindings = new Map();
+    #store;
+    #scope;
+    constructor(bindings, store, scope) {
+        this.#store = store;
+        this.#scope = scope;
+        for (const binding of bindings) {
+            this.#bindings.set(MapServiceBroker.key(binding.connectorId, binding.operation), binding.secretRef);
+        }
+    }
+    async getCredential(request) {
+        const opRef = request.operation !== undefined
+            ? this.#bindings.get(MapServiceBroker.key(request.connectorId, request.operation))
+            : undefined;
+        const ref = opRef ?? this.#bindings.get(MapServiceBroker.key(request.connectorId));
+        if (ref === undefined)
+            return { token: '' };
+        const secrets = await this.#store.resolveConfigValues('secret', this.#scope);
+        const token = secrets[ref];
+        if (token === undefined)
+            throw new Error(`missing managed secret "${ref}"`);
+        return { token };
+    }
 }
 function tenantKey(ref) {
     return `${ref.org}/${ref.app}/${ref.env}`;
@@ -460,6 +445,7 @@ export function createServiceHandler(registry, options = {}) {
     const logger = options.logger ?? noopLogger;
     const tls = options.tls ?? {};
     const controlPlane = options.controlPlaneStore ?? new InMemoryControlPlaneStore();
+    const configStore = options.configStore ?? registry.configStore;
     const router = createMcpRouter(() => Promise.resolve(undefined), {
         logger,
         tls,
@@ -578,6 +564,18 @@ export function createServiceHandler(registry, options = {}) {
             });
             return;
         }
+        const configRef = parseConfigPath(url.pathname);
+        if (configRef !== undefined &&
+            (req.method === 'GET' || req.method === 'PUT' || req.method === 'DELETE')) {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            handleConfigValues(req, res, gate, controlPlane, configStore, maxBody, configRef).catch(() => {
+                if (!res.headersSent)
+                    sendJson(res, 500, { error: 'internal error' });
+            });
+            return;
+        }
         const deploymentsRef = parseDeploymentsPath(url.pathname);
         if (deploymentsRef !== undefined && req.method === 'GET') {
             applySecurityHeaders(res, tls);
@@ -617,7 +615,6 @@ async function handleDeploy(req, res, registry, options, maxBody, tenant, gate,
         return sendJson(res, 413, { error: 'request body too large' });
     let manifest;
     let connectors;
-    let secrets;
     let accessMode = 'caller-key';
     try {
         const parsed = JSON.parse(body.text);
@@ -630,7 +627,7 @@ async function handleDeploy(req, res, registry, options, maxBody, tenant, gate,
             connectors = parsed.connectors;
         }
         if (parsed.secrets !== undefined) {
-            secrets = parseSecrets(parsed.secrets);
+            throw new Error('"secrets" is no longer accepted; use noodle secrets set before deploy');
         }
         if (parsed.accessMode !== undefined) {
             if (!isAccessMode(parsed.accessMode)) {
@@ -650,7 +647,7 @@ async function handleDeploy(req, res, registry, options, maxBody, tenant, gate,
         });
     }
     const logger = options.logger ?? noopLogger;
-    const result = await registry.deploy(tenant, manifest, connectors, secrets, identity || undefined, accessMode);
+    const result = await registry.deploy(tenant, manifest, connectors, identity || undefined, accessMode);
     if (!result.ok) {
         // Codes are safe enum strings; never a path-with-value. No secret name or value is logged.
         logger.warn('deploy.rejected', {
@@ -667,7 +664,6 @@ async function handleDeploy(req, res, registry, options, maxBody, tenant, gate,
         app: tenant.app,
         env: tenant.env,
         hasConnectors: connectors !== undefined,
-        secretCount: secrets ? Object.keys(secrets).length : 0,
     });
     const base = options.publicBaseUrl ?? baseFromRequest(req, options.tls ?? {});
     return sendJson(res, 201, {
@@ -785,6 +781,54 @@ async function handleMembers(req, res, gate, controlPlane, maxBody, ref) {
     }
     return sendJson(res, 404, { error: 'not found' });
 }
+async function handleConfigValues(req, res, gate, controlPlane, configStore, maxBody, ref) {
+    const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: false });
+    if (identity === false)
+        return;
+    if (ref.invalid !== undefined)
+        return sendJson(res, 400, { error: ref.invalid });
+    if (identity !== undefined && !identity.superAdmin) {
+        const member = await controlPlane.isOrgMember({ org: ref.scope.org, subject: identity.subject });
+        if (!member)
+            return sendForbidden(res, 'forbidden');
+    }
+    if (req.method === 'GET' && ref.name === undefined) {
+        return sendJson(res, 200, {
+            ok: true,
+            values: await configStore.listConfigValues(ref.kind, ref.scope),
+        });
+    }
+    if (req.method === 'PUT' && ref.name !== undefined) {
+        const body = await readJsonBody(req, maxBody);
+        if (!body.ok)
+            return sendJson(res, body.status, { error: body.error });
+        const parsed = body.value;
+        if (typeof parsed.value !== 'string') {
+            return sendJson(res, 400, { error: '"value" must be a string' });
+        }
+        try {
+            const value = await configStore.setConfigValue({
+                kind: ref.kind,
+                scope: ref.scope,
+                name: ref.name,
+                value: parsed.value,
+                ...(identity !== undefined ? { updatedBySubject: identity.subject } : {}),
+                ...(identity?.email !== undefined ? { updatedByEmail: identity.email } : {}),
+            });
+            return sendJson(res, 200, { ok: true, value });
+        }
+        catch (error) {
+            return sendJson(res, 400, { error: error.message });
+        }
+    }
+    if (req.method === 'DELETE' && ref.name !== undefined) {
+        await configStore.deleteConfigValue(ref.kind, ref.scope, ref.name);
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    return sendJson(res, 404, { error: 'not found' });
+}
 async function handleDeployments(req, res, registry, gate, controlPlane, ref, url) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)
@@ -912,6 +956,45 @@ function parseMembersPath(pathname) {
         return undefined;
     }
 }
+function parseConfigPath(pathname) {
+    const kindPattern = '(secrets|variables)';
+    const org = new RegExp(`^/v1/orgs/([^/]+)/${kindPattern}(?:/([^/]+))?$`).exec(pathname);
+    if (org) {
+        return configRouteRef(org[2] === 'secrets' ? 'secret' : 'variable', { level: 'org', org: decodeURIComponent(org[1]) }, org[3]);
+    }
+    const app = new RegExp(`^/v1/orgs/([^/]+)/apps/([^/]+)/${kindPattern}(?:/([^/]+))?$`).exec(pathname);
+    if (app) {
+        return configRouteRef(app[3] === 'secrets' ? 'secret' : 'variable', {
+            level: 'app',
+            org: decodeURIComponent(app[1]),
+            app: decodeURIComponent(app[2]),
+        }, app[4]);
+    }
+    const env = new RegExp(`^/v1/orgs/([^/]+)/apps/([^/]+)/envs/([^/]+)/${kindPattern}(?:/([^/]+))?$`).exec(pathname);
+    if (!env)
+        return undefined;
+    return configRouteRef(env[4] === 'secrets' ? 'secret' : 'variable', {
+        level: 'env',
+        org: decodeURIComponent(env[1]),
+        app: decodeURIComponent(env[2]),
+        env: decodeURIComponent(env[3]),
+    }, env[5]);
+}
+function configRouteRef(kind, scope, encodedName) {
+    try {
+        const safeScope = validateConfigScope(scope);
+        const name = encodedName !== undefined ? validateConfigName(decodeURIComponent(encodedName)) : undefined;
+        return { kind, scope: safeScope, ...(name !== undefined ? { name } : {}) };
+    }
+    catch {
+        return {
+            kind,
+            scope: { level: 'org', org: '__invalid__' },
+            ...(encodedName !== undefined ? { name: '__invalid__' } : {}),
+            invalid: 'invalid config scope or name',
+        };
+    }
+}
 function parseDeploymentsPath(pathname) {
     const match = /^\/v1\/orgs\/([^/]+)\/deployments$/.exec(pathname);
     if (!match)
@@ -942,22 +1025,6 @@ function parseKeysPath(pathname) {
 function createAdmissionGate(_logger) {
     return async () => ({ allow: true });
 }
-/**
- * Validate the deploy request's `secrets` field into a `name -> value` map. Rejects a non-object or a
- * non-string value, naming only the offending key (never a value) so secrets never reach an error body.
- */
-function parseSecrets(raw) {
-    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
-        throw new Error('"secrets" must be an object of string values');
-    }
-    const out = {};
-    for (const [name, value] of Object.entries(raw)) {
-        if (typeof value !== 'string')
-            throw new Error(`secret "${name}" must be a string`);
-        out[name] = value;
-    }
-    return out;
-}
 function baseFromRequest(req, tls) {
     const host = req.headers.host ?? 'localhost';
     return `${effectiveProto(req, tls.trustProxy ?? false)}://${host}`;
@@ -981,11 +1048,29 @@ export async function serveService(options = {}) {
         throw new Error(`refusing to bind a non-loopback host (${host}) without deploy authentication; ` +
             'set NOODLE_GOOGLE_CLIENT_ID (or pass a deployGate)');
     }
+    const durableStoreRequested = options.dataDir !== undefined || options.databaseUrl !== undefined || options.cloudSql !== undefined;
+    // Fail closed: any durable store must have a master-key custodian. Existing deploy records may still
+    // contain encrypted legacy secret envelopes, and managed config secrets are encrypted independently.
+    // KMS (the KEK never enters the process — ADR 0037) takes precedence over a static local key.
+    let secretBox;
+    if (durableStoreRequested) {
+        if (options.kmsKeyName !== undefined) {
+            const { gcpKmsMasterKeyProvider } = await import('./secret/kms-master-key.js');
+            secretBox = new SecretBox(gcpKmsMasterKeyProvider({ keyName: options.kmsKeyName }));
+        }
+        else if (options.secretMasterKey !== undefined) {
+            secretBox = new SecretBox(staticMasterKeyProvider(options.secretMasterKey));
+        }
+        else {
+            throw new Error('persistence requires a secret master-key custodian; set NOODLE_KMS_KEY or NOODLE_SECRET_MASTER_KEY');
+        }
+    }
     // Select exactly one durable backend: Postgres (cloud, ADR 0035) > file (local) > in-memory. The
     // Postgres modules are loaded lazily so `pg` / the Cloud SQL connector are never pulled in on the
     // file/in-memory paths (keeping the default startup light and dependency-free).
     let store;
     let controlPlaneStore = options.controlPlaneStore;
+    let configStore = options.configStore;
     let pgPool;
     if (options.databaseUrl !== undefined || options.cloudSql !== undefined) {
         const [{ createPostgresPool }, { PostgresArtifactStore }] = await Promise.all([
@@ -996,32 +1081,17 @@ export async function serveService(options = {}) {
             ...(options.databaseUrl !== undefined ? { databaseUrl: options.databaseUrl } : {}),
             ...(options.cloudSql !== undefined ? { cloudSql: options.cloudSql } : {}),
         });
-        const postgres = new PostgresArtifactStore(pgPool.pool);
+        const postgres = new PostgresArtifactStore(pgPool.pool, secretBox);
         await postgres.ensureSchema();
         store = postgres;
         controlPlaneStore = controlPlaneStore ?? postgres;
+        configStore = configStore ?? postgres;
     }
     else if (options.dataDir !== undefined) {
         store = new JsonFileArtifactStore(options.dataDir);
     }
     controlPlaneStore = controlPlaneStore ?? new InMemoryControlPlaneStore();
-    // Fail closed: any durable store must encrypt secrets at rest, so it requires a master-key custodian. A
-    // KMS key (the KEK never enters the process — ADR 0037) takes precedence over a static key; an
-    // absent/invalid key throws here, before any traffic is served. The KMS adapter + its `@google-cloud/kms`
-    // SDK load lazily, so a static/file deployment never pulls them in.
-    let secretBox;
-    if (store) {
-        if (options.kmsKeyName !== undefined) {
-            const { gcpKmsMasterKeyProvider } = await import('./secret/kms-master-key.js');
-            secretBox = new SecretBox(gcpKmsMasterKeyProvider({ keyName: options.kmsKeyName }));
-        }
-        else if (options.secretMasterKey !== undefined) {
-            secretBox = new SecretBox(staticMasterKeyProvider(options.secretMasterKey));
-        }
-        else {
-            throw new Error('persistence requires a secret master-key custodian; set NOODLE_KMS_KEY or NOODLE_SECRET_MASTER_KEY');
-        }
-    }
+    configStore = configStore ?? new InMemoryConfigStore();
     // Self-hosted authorization server (OA-2): build the AS Express app + its state store (the shared Postgres
     // store when persistence is on, else in-memory). Express + the SDK auth handlers load lazily, only here, so
     // an AS-less deployment never pulls them in. Owner-only token verification is wired to the same signing key
@@ -1069,7 +1139,7 @@ export async function serveService(options = {}) {
                     keyResolver: await options.oauth.signer.verifierKey(),
                 });
     }
-    const registry = new ServerRegistry(store, secretBox);
+    const registry = new ServerRegistry(store, secretBox, configStore);
     // Recovery is lazy by default (ADR 0036): each server recompiles on its first request, which is correct
     // on a multi-instance platform (any instance serves any deploy) and a cheaper cold start. `warmAll` opts
     // into eager recompile-all-on-boot (boot-time validation of every server, for a pinned/on-prem instance).
@@ -1091,6 +1161,7 @@ export async function serveService(options = {}) {
         ...options,
         readinessProbe,
         controlPlaneStore,
+        configStore,
         ...(options.googleClientId !== undefined
             ? { controlPlaneGoogleClientId: options.googleClientId }
             : {}),