ydb-qdrant 9.0.3 → 9.1.0

package/README.md

@@ -54,7 +54,16 @@ npm install
 ```
 
 ## Configure credentials
-The server uses `getCredentialsFromEnv()` and supports these env vars (first match wins):
+The server supports explicit programmatic `authService` in the npm API. Without it, env-based credentials are used:
+
+- Static username/password credentials (durable local YDB)
+  ```bash
+  export YDB_STATIC_CREDENTIALS_USER=qdrantapp
+  export YDB_STATIC_CREDENTIALS_PASSWORD_FILE=/run/secrets/qdrantapp.password
+  ```
+  `YDB_STATIC_CREDENTIALS_PASSWORD` is supported only as a fallback when a password file is not set. `YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT` can override the auth endpoint; otherwise the YDB endpoint is used. For private CA TLS, set `YDB_SSL_ROOT_CERTIFICATES_FILE`.
+
+The remaining YDB SDK env credentials are resolved by `getCredentialsFromEnv()`:
 
 - Service account key file (recommended)
   ```bash

package/dist/config/env.d.ts

@@ -1,6 +1,11 @@
 import "dotenv/config";
 export declare const YDB_QDRANT_ENDPOINT: string;
 export declare const YDB_QDRANT_DATABASE: string;
+export declare const YDB_STATIC_CREDENTIALS_USER: string;
+export declare const YDB_STATIC_CREDENTIALS_PASSWORD_FILE: string;
+export declare const YDB_STATIC_CREDENTIALS_PASSWORD: string;
+export declare const YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT: string;
+export declare const YDB_SSL_ROOT_CERTIFICATES_FILE: string;
 export declare const LEGACY_YDB_ENDPOINT: string;
 export declare const LEGACY_YDB_DATABASE: string;
 export declare const YDB_ENDPOINT: string;

package/dist/config/env.js

@@ -2,6 +2,11 @@ import "dotenv/config";
 import { parseBooleanEnv, parseIntegerEnv } from "../utils/EnvParsers.js";
 export const YDB_QDRANT_ENDPOINT = process.env.YDB_QDRANT_ENDPOINT?.trim() ?? "";
 export const YDB_QDRANT_DATABASE = process.env.YDB_QDRANT_DATABASE?.trim() ?? "";
+export const YDB_STATIC_CREDENTIALS_USER = process.env.YDB_STATIC_CREDENTIALS_USER?.trim() ?? "";
+export const YDB_STATIC_CREDENTIALS_PASSWORD_FILE = process.env.YDB_STATIC_CREDENTIALS_PASSWORD_FILE?.trim() ?? "";
+export const YDB_STATIC_CREDENTIALS_PASSWORD = process.env.YDB_STATIC_CREDENTIALS_PASSWORD ?? "";
+export const YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT = process.env.YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT?.trim() ?? "";
+export const YDB_SSL_ROOT_CERTIFICATES_FILE = process.env.YDB_SSL_ROOT_CERTIFICATES_FILE?.trim() ?? "";
 export const LEGACY_YDB_ENDPOINT = process.env.YDB_ENDPOINT?.trim() ?? "";
 export const LEGACY_YDB_DATABASE = process.env.YDB_DATABASE?.trim() ?? "";
 export const YDB_ENDPOINT = YDB_QDRANT_ENDPOINT;

package/dist/ydb/client.js

@@ -1,8 +1,10 @@
 import { createRequire } from "module";
-import { SESSION_POOL_MIN_SIZE, SESSION_POOL_MAX_SIZE, SESSION_KEEPALIVE_PERIOD_MS, STARTUP_PROBE_SESSION_TIMEOUT_MS, YDB_SESSION_RETRY_MAX_RETRIES, TABLE_SESSION_TIMEOUT_MS, resolveYdbConnectionConfig, } from "../config/env.js";
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { SESSION_POOL_MIN_SIZE, SESSION_POOL_MAX_SIZE, SESSION_KEEPALIVE_PERIOD_MS, STARTUP_PROBE_SESSION_TIMEOUT_MS, YDB_SESSION_RETRY_MAX_RETRIES, TABLE_SESSION_TIMEOUT_MS, YDB_SSL_ROOT_CERTIFICATES_FILE, YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT, YDB_STATIC_CREDENTIALS_PASSWORD, YDB_STATIC_CREDENTIALS_PASSWORD_FILE, YDB_STATIC_CREDENTIALS_USER, resolveYdbConnectionConfig, } from "../config/env.js";
 import { logger } from "../logging/logger.js";
 const require = createRequire(import.meta.url);
-const { Driver, getCredentialsFromEnv, Types, TypedValues, TableDescription, Column, TableIndex, AlterTableDescription, ExecuteQuerySettings, BulkUpsertSettings, OperationParams, Ydb, } = require("ydb-sdk");
+const { Driver, getCredentialsFromEnv, Types, TypedValues, TableDescription, Column, TableIndex, AlterTableDescription, ExecuteQuerySettings, BulkUpsertSettings, OperationParams, StaticCredentialsAuthService, getDefaultLogger, Ydb, } = require("ydb-sdk");
 export { Types, TypedValues, TableDescription, Column, TableIndex, AlterTableDescription, ExecuteQuerySettings, BulkUpsertSettings, Ydb, };
 export function createExecuteQuerySettings(options) {
     const { keepInCache = true, idempotent = true } = options ?? {};
@@ -130,15 +132,100 @@ export function configureDriver(config) {
     }
     overrideConfig = config;
 }
+function readStaticCredentialsPasswordFromFile(path) {
+    try {
+        return readFileSync(path, "utf8").replace(/[\r\n]+$/, "");
+    }
+    catch (cause) {
+        throw new Error(`Failed to read YDB_STATIC_CREDENTIALS_PASSWORD_FILE at ${path}.`, { cause });
+    }
+}
+function readSslRootCertificatesFromFile(path) {
+    try {
+        return readFileSync(path);
+    }
+    catch (cause) {
+        throw new Error(`Failed to read YDB_SSL_ROOT_CERTIFICATES_FILE at ${path}.`, { cause });
+    }
+}
+function resolveStaticCredentialsPassword() {
+    if (YDB_STATIC_CREDENTIALS_PASSWORD_FILE) {
+        const password = readStaticCredentialsPasswordFromFile(YDB_STATIC_CREDENTIALS_PASSWORD_FILE);
+        return password.length > 0 ? password : undefined;
+    }
+    return YDB_STATIC_CREDENTIALS_PASSWORD.length > 0
+        ? YDB_STATIC_CREDENTIALS_PASSWORD
+        : undefined;
+}
+function endpointFromConnectionString(connectionString) {
+    const url = new URL(connectionString);
+    return `${url.protocol}//${url.host}`;
+}
+function resolveStaticCredentialsAuthEndpoint(base) {
+    if (YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT) {
+        return YDB_STATIC_CREDENTIALS_AUTH_ENDPOINT;
+    }
+    if ("endpoint" in base) {
+        return base.endpoint;
+    }
+    return endpointFromConnectionString(base.connectionString);
+}
+function isSecureEndpoint(endpoint) {
+    return /^(grpcs|https):\/\//i.test(endpoint);
+}
+function createPrivateCaSslCredentialsForEndpoint(endpoint) {
+    if (!isSecureEndpoint(endpoint) || !YDB_SSL_ROOT_CERTIFICATES_FILE) {
+        return undefined;
+    }
+    return {
+        rootCertificates: readSslRootCertificatesFromFile(YDB_SSL_ROOT_CERTIFICATES_FILE),
+    };
+}
+function createSdkDefaultSslCredentialsForStaticAuth() {
+    try {
+        // ydb-sdk does not publicly export this helper; keep the private lookup lazy and non-fatal.
+        const { makeDefaultSslCredentials } = require(join(dirname(require.resolve("ydb-sdk")), "utils/ssl-credentials.js"));
+        return makeDefaultSslCredentials();
+    }
+    catch (cause) {
+        logger.warn({ err: cause }, "YDB SDK default SSL credentials unavailable; falling back to grpc default TLS roots");
+        return {};
+    }
+}
+function createStaticAuthSslCredentialsForEndpoint(endpoint) {
+    if (!isSecureEndpoint(endpoint)) {
+        return undefined;
+    }
+    return (createPrivateCaSslCredentialsForEndpoint(endpoint) ??
+        createSdkDefaultSslCredentialsForStaticAuth());
+}
+function createStaticCredentialsAuthService(base) {
+    if (!YDB_STATIC_CREDENTIALS_USER) {
+        return undefined;
+    }
+    const password = resolveStaticCredentialsPassword();
+    if (!password) {
+        throw new Error("YDB_STATIC_CREDENTIALS_USER is set, but neither YDB_STATIC_CREDENTIALS_PASSWORD_FILE nor YDB_STATIC_CREDENTIALS_PASSWORD provides a non-empty password.");
+    }
+    const authEndpoint = resolveStaticCredentialsAuthEndpoint(base);
+    const sslCredentials = createStaticAuthSslCredentialsForEndpoint(authEndpoint);
+    return new StaticCredentialsAuthService(YDB_STATIC_CREDENTIALS_USER, password, authEndpoint, getDefaultLogger(), sslCredentials ? { sslCredentials } : undefined);
+}
 function getDriverConfig() {
     const base = resolveYdbConnectionConfig({
         endpoint: overrideConfig?.endpoint,
         database: overrideConfig?.database,
         connectionString: overrideConfig?.connectionString,
     });
+    const sslCredentials = "endpoint" in base
+        ? createPrivateCaSslCredentialsForEndpoint(base.endpoint)
+        : createPrivateCaSslCredentialsForEndpoint(endpointFromConnectionString(base.connectionString));
     return {
         ...base,
-        authService: overrideConfig?.authService ?? getCredentialsFromEnv(),
+        authService: overrideConfig?.authService ??
+            createStaticCredentialsAuthService(base) ??
+            getCredentialsFromEnv(),
+        ...(sslCredentials ? { sslCredentials } : {}),
         poolSettings: {
             minLimit: SESSION_POOL_MIN_SIZE,
             maxLimit: SESSION_POOL_MAX_SIZE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ydb-qdrant",
-  "version": "9.0.3",
+  "version": "9.1.0",
   "main": "dist/package/api.js",
   "types": "dist/package/api.d.ts",
   "exports": {