Skip to content

Commit eedcf4b

Browse files
RhysSullivanRhysSullivan
authored
Merge pull request #59 from RhysSullivan/t3code/5f897a8e
[codex] clean up plugin-based secret management
2 parents 9010f52 + 2a973d0 commit eedcf4b

25 files changed

Lines changed: 479 additions & 504 deletions

File tree

‎bun.lock‎

Lines changed: 27 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/sqlite-sdk-consumer/src/sqlite-backend.ts‎

Lines changed: 83 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@ type SecretMaterialSummary = {
6565
updatedAt: number;
6666
};
6767

68+
type SqliteSecretStoredData = {
69+
value: string;
70+
};
71+
6872
const SQLITE_SECRET_STORE_KIND = "sqlite";
6973
const SQLITE_SECRET_STORE_ID = "sts_sqlite";
7074

@@ -92,14 +96,19 @@ const sourceArtifacts = sqliteTable("source_artifacts", {
9296

9397
const secretMaterials = sqliteTable("secret_materials", {
9498
id: text("id").primaryKey(),
95-
providerId: text("provider_id").notNull(),
99+
storeId: text("store_id").notNull(),
96100
name: text("name"),
97101
purpose: text("purpose").notNull(),
98102
createdAt: integer("created_at").notNull(),
99103
updatedAt: integer("updated_at").notNull(),
100104
json: text("json").notNull(),
101105
});
102106

107+
const secretMaterialStoredData = sqliteTable("secret_material_stored_data", {
108+
secretId: text("secret_id").primaryKey(),
109+
json: text("json").notNull(),
110+
});
111+
103112
const executions = sqliteTable("executions", {
104113
id: text("id").primaryKey(),
105114
scopeId: text("scope_id").notNull(),
@@ -213,14 +222,19 @@ const openSqliteStore = (databasePath: string) => {
213222
214223
CREATE TABLE IF NOT EXISTS secret_materials (
215224
id TEXT PRIMARY KEY NOT NULL,
216-
provider_id TEXT NOT NULL,
225+
store_id TEXT NOT NULL,
217226
name TEXT,
218227
purpose TEXT NOT NULL,
219228
created_at INTEGER NOT NULL,
220229
updated_at INTEGER NOT NULL,
221230
json TEXT NOT NULL
222231
);
223232
233+
CREATE TABLE IF NOT EXISTS secret_material_stored_data (
234+
secret_id TEXT PRIMARY KEY NOT NULL,
235+
json TEXT NOT NULL
236+
);
237+
224238
CREATE TABLE IF NOT EXISTS executions (
225239
id TEXT PRIMARY KEY NOT NULL,
226240
scope_id TEXT NOT NULL,
@@ -241,6 +255,7 @@ const openSqliteStore = (databasePath: string) => {
241255
json TEXT NOT NULL
242256
);
243257
`);
258+
244259
return {
245260
sqlite,
246261
db,
@@ -292,7 +307,7 @@ const createStorageDomains = (
292307
listAll: (): readonly SecretMaterialSummary[] =>
293308
store.db.select().from(secretMaterials).all().map((row) => ({
294309
id: row.id,
295-
storeId: row.providerId,
310+
storeId: row.storeId,
296311
name: row.name,
297312
purpose: row.purpose,
298313
createdAt: row.createdAt,
@@ -301,7 +316,7 @@ const createStorageDomains = (
301316
upsert: (material: SecretMaterial) =>
302317
store.db.insert(secretMaterials).values({
303318
id: material.id,
304-
providerId: material.storeId,
319+
storeId: material.storeId,
305320
name: material.name,
306321
purpose: material.purpose,
307322
createdAt: material.createdAt,
@@ -310,7 +325,7 @@ const createStorageDomains = (
310325
}).onConflictDoUpdate({
311326
target: secretMaterials.id,
312327
set: {
313-
providerId: material.storeId,
328+
storeId: material.storeId,
314329
name: material.name,
315330
purpose: material.purpose,
316331
createdAt: material.createdAt,
@@ -320,19 +335,18 @@ const createStorageDomains = (
320335
}).run(),
321336
updateById: (
322337
id: SecretMaterial["id"],
323-
update: { name?: string | null; value?: string },
338+
update: { name?: string | null },
324339
) => {
325340
const row = store.db.select().from(secretMaterials).where(eq(secretMaterials.id, id)).get();
326341
if (!row) return null;
327342
const current = parseJson<SecretMaterial>(row.json);
328343
const next = {
329344
...current,
330345
name: update.name === undefined ? current.name : update.name,
331-
value: update.value === undefined ? current.value : update.value,
332346
updatedAt: Date.now(),
333347
};
334348
store.db.update(secretMaterials).set({
335-
providerId: next.storeId,
349+
storeId: next.storeId,
336350
name: next.name,
337351
purpose: next.purpose,
338352
createdAt: next.createdAt,
@@ -356,6 +370,40 @@ const createStorageDomains = (
356370
store.db.delete(secretMaterials).where(eq(secretMaterials.id, id)).run();
357371
return true;
358372
},
373+
secretMaterialStoredData: {
374+
getBySecretId: (secretId: SecretMaterial["id"]) => {
375+
const row = store.db.select().from(secretMaterialStoredData).where(
376+
eq(secretMaterialStoredData.secretId, secretId),
377+
).get();
378+
return row
379+
? {
380+
secretId,
381+
data: parseJson<SqliteSecretStoredData>(row.json),
382+
}
383+
: null;
384+
},
385+
upsert: (record: { secretId: SecretMaterial["id"]; data: unknown }) => {
386+
store.db.insert(secretMaterialStoredData).values({
387+
secretId: record.secretId,
388+
json: JSON.stringify(record.data),
389+
}).onConflictDoUpdate({
390+
target: secretMaterialStoredData.secretId,
391+
set: {
392+
json: JSON.stringify(record.data),
393+
},
394+
}).run();
395+
},
396+
removeBySecretId: (secretId: SecretMaterial["id"]) => {
397+
const row = store.db.select({ secretId: secretMaterialStoredData.secretId }).from(
398+
secretMaterialStoredData,
399+
).where(eq(secretMaterialStoredData.secretId, secretId)).get();
400+
if (!row) return false;
401+
store.db.delete(secretMaterialStoredData).where(
402+
eq(secretMaterialStoredData.secretId, secretId),
403+
).run();
404+
return true;
405+
},
406+
},
359407
},
360408
executions: {
361409
runs: {
@@ -612,43 +660,63 @@ export const createSqliteExecutorBackend = (
612660
secrets: {
613661
...secrets,
614662
secretStores: secrets.secretStores,
663+
secretMaterialStoredData: secrets.secretMaterialStoredData,
615664
resolve: ({ ref }) => {
616665
const material = secrets.getById(
617666
ref.secretId as SecretMaterial["id"],
618667
);
619-
if (!material || material.value === null) {
668+
const stored = secrets.secretMaterialStoredData.getBySecretId(
669+
ref.secretId as SecretMaterial["id"],
670+
);
671+
if (!material || !stored) {
620672
throw new Error(`Missing secret material ${ref.secretId}`);
621673
}
622-
return material.value;
674+
return (stored.data as SqliteSecretStoredData).value;
623675
},
624676
store: ({ purpose, value, name, storeId }) => {
625677
const now = Date.now();
626678
const id = SecretMaterialIdSchema.make(`secret_${randomUUID()}`);
627679
const material: SecretMaterial = {
628680
id,
629681
storeId: (storeId ?? SQLITE_SECRET_STORE_ID) as SecretMaterial["storeId"],
630-
handle: id,
631682
name: name ?? null,
632683
purpose,
633-
value,
634684
createdAt: now,
635685
updatedAt: now,
636686
};
637687
secrets.upsert(material);
688+
secrets.secretMaterialStoredData.upsert({
689+
secretId: id,
690+
data: {
691+
value,
692+
} satisfies SqliteSecretStoredData,
693+
});
638694
return {
639695
secretId: material.id,
640696
} satisfies SecretRef;
641697
},
642-
delete: (ref) =>
643-
secrets.removeById(ref.secretId as SecretMaterial["id"]),
698+
delete: (ref) => {
699+
secrets.secretMaterialStoredData.removeBySecretId(
700+
ref.secretId as SecretMaterial["id"],
701+
);
702+
return secrets.removeById(ref.secretId as SecretMaterial["id"]);
703+
},
644704
update: ({ ref, name, value }) => {
645705
const updated = secrets.updateById(
646706
ref.secretId as SecretMaterial["id"],
647-
{ name, value },
707+
{ name },
648708
);
649709
if (!updated) {
650710
throw new Error(`Missing secret material ${ref.secretId}`);
651711
}
712+
if (value !== undefined) {
713+
secrets.secretMaterialStoredData.upsert({
714+
secretId: ref.secretId as SecretMaterial["id"],
715+
data: {
716+
value,
717+
} satisfies SqliteSecretStoredData,
718+
});
719+
}
652720
return updated;
653721
},
654722
},

‎packages/platform/sdk-file/src/config.ts‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import {
1111
LocalExecutorConfigSchema,
1212
type LocalExecutorConfig,
1313
type LocalConfigPolicy,
14-
type LocalConfigSecretProvider,
1514
type LocalConfigSource,
1615
} from "@executor/platform-sdk/schema";
1716
import type { LoadedLocalExecutorConfig } from "@executor/platform-sdk/runtime";
@@ -249,19 +248,6 @@ const mergePolicyMaps = (
249248
};
250249
};
251250

252-
const mergeSecretProviderMaps = (
253-
base: Record<string, LocalConfigSecretProvider> | undefined,
254-
extra: Record<string, LocalConfigSecretProvider> | undefined,
255-
): Record<string, LocalConfigSecretProvider> | undefined => {
256-
if (!base && !extra) {
257-
return undefined;
258-
}
259-
return {
260-
...base,
261-
...extra,
262-
};
263-
};
264-
265251
export const mergeLocalExecutorConfigs = (
266252
base: LocalExecutorConfig | null,
267253
extra: LocalExecutorConfig | null,
@@ -278,16 +264,6 @@ export const mergeLocalExecutorConfigs = (
278264
},
279265
sources: mergeSourceMaps(base?.sources, extra?.sources),
280266
policies: mergePolicyMaps(base?.policies, extra?.policies),
281-
secrets: {
282-
providers: mergeSecretProviderMaps(
283-
base?.secrets?.providers,
284-
extra?.secrets?.providers,
285-
),
286-
defaults: {
287-
...base?.secrets?.defaults,
288-
...extra?.secrets?.defaults,
289-
},
290-
},
291267
});
292268
};
293269

0 commit comments

Comments
 (0)