Moheeb ZaraandClaude Opus 4.8
b1edb5c460
Per-file type-only fixes surfaced after the Supabase client was correctly typed. All fixes preserve runtime behavior; no any/ts-ignore/ts-expect-error. - lib/supabase/client.ts: annotate the browser client as SupabaseClient<Database> (same ssr/js drift as server.ts; fixes it centrally for all callers). - Supabase embedded-select joins whose FK metadata is missing from the generated types are bridged with `as unknown as <target>` + a TODO to remove after regenerating types/database.ts. - setState optimistic-update variance and raw <select> enum values cast to the precise element/union type; .insert payload fields (Json, enums) given the precise column type via satisfies/field casts. - Added narrowing guards where a value was legitimately nullable (comms channel, public form page) without changing the intended path. The 14 remaining errors are confined to the four files fixed in Phase B (real bugs + the tautological actions.test rewrite). 639 tests still green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
95 lines
3.0 KiB
TypeScript
95 lines
3.0 KiB
TypeScript
// Generic per-space secret vault helpers. This is the canonical store/read
|
|
// pair for any third-party credential (the AES-256-GCM `secrets` table, the
|
|
// same layout the door subsystem and Stripe config use). NOT a 'use server'
|
|
// module: it takes a Supabase admin client and is imported by server actions
|
|
// and route handlers. Secrets are server-only and never returned to a client.
|
|
import type { createAdminClient } from '@/lib/supabase/admin'
|
|
import type { TablesInsert } from '@/types/database'
|
|
import { encryptSecret, decryptSecret, encryptionAvailable } from '@/lib/secrets/crypto'
|
|
|
|
type Admin = ReturnType<typeof createAdminClient>
|
|
|
|
// Store a credential in the encrypted vault. Returns the secret row id to
|
|
// keep (as a *_ref) in integrations.config. null on failure.
|
|
export async function storeSecret(
|
|
admin: Admin,
|
|
spaceId: string,
|
|
title: string,
|
|
value: string,
|
|
createdBy: string | null,
|
|
): Promise<string | null> {
|
|
const row: Record<string, unknown> = {
|
|
space_id: spaceId,
|
|
title,
|
|
label: title,
|
|
category: 'integration',
|
|
created_by: createdBy,
|
|
}
|
|
if (encryptionAvailable()) {
|
|
const { ciphertext, version } = encryptSecret(value)
|
|
row.encrypted_value = ciphertext
|
|
row.encryption_version = version
|
|
row.value = ''
|
|
} else {
|
|
row.value = value
|
|
row.encryption_version = 0
|
|
}
|
|
const { data, error } = await admin
|
|
.from('secrets')
|
|
.insert(row as TablesInsert<'secrets'>)
|
|
.select('id')
|
|
.single()
|
|
if (error || !data) return null
|
|
return data.id as string
|
|
}
|
|
|
|
// Read + decrypt a stored credential by ref, space-scoped. Server-only.
|
|
export async function readSecret(
|
|
admin: Admin,
|
|
spaceId: string,
|
|
secretRef: string | null | undefined,
|
|
): Promise<string | null> {
|
|
if (!secretRef) return null
|
|
const { data } = await admin
|
|
.from('secrets')
|
|
.select('encryption_version, encrypted_value, value')
|
|
.eq('id', secretRef)
|
|
.eq('space_id', spaceId)
|
|
.maybeSingle()
|
|
if (!data) return null
|
|
if (data.encryption_version === 1 && data.encrypted_value) {
|
|
const raw = data.encrypted_value as unknown
|
|
const buf =
|
|
typeof raw === 'string'
|
|
? Buffer.from((raw as string).replace(/^\\x/, ''), 'hex')
|
|
: Buffer.from(raw as Uint8Array)
|
|
try {
|
|
return decryptSecret(buf, 1)
|
|
} catch {
|
|
return null
|
|
}
|
|
}
|
|
return (data.value as string | null) ?? null
|
|
}
|
|
|
|
// Config key naming convention for credentials that must be vaulted rather
|
|
// than stored plaintext in integrations.config. Derived keys (*_set, *_ref)
|
|
// are never themselves secrets.
|
|
export function isSecretConfigField(key: string): boolean {
|
|
if (key.endsWith('_set') || key.endsWith('_ref')) return false
|
|
const k = key.toLowerCase()
|
|
return (
|
|
k === 'client_secret' ||
|
|
k === 'api_key' ||
|
|
k === 'secret_key' ||
|
|
k === 'password' ||
|
|
k === 'token' ||
|
|
k === 'private_key' ||
|
|
k === 'access_token' ||
|
|
k === 'refresh_token' ||
|
|
k.endsWith('_secret') ||
|
|
k.endsWith('_token') ||
|
|
k.endsWith('_password')
|
|
)
|
|
}
|