Open History to see the last commit
1import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
2import * as NodeServices from "@effect/platform-node/NodeServices";
3import { assert, it } from "@effect/vitest";
4import * as Effect from "effect/Effect";
5import * as Layer from "effect/Layer";
6import * as Option from "effect/Option";
7import * as PlatformError from "effect/PlatformError";
8
9import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
10import * as ServerConfig from "../config.ts";
11import {
12 EnvironmentSigningKey,
13 getOrCreateEnvironmentKeyPairFromSecretStore,
14 layer,
15} from "./environmentKeys.ts";
16
17const layerServerSecretStore = () =>
18 ServerSecretStore.layer.pipe(
19 Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-environment-keys-test-" })),
20 );
21
22const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation");
23
24it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))(
25 "getOrCreateEnvironmentKeyPairFromSecretStore",
26 (it) => {
27 it.effect("persists one atomic keypair secret and reuses it", () =>
28 Effect.gen(function* () {
29 const secretStore = yield* ServerSecretStore.ServerSecretStore;
30
31 const first = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);
32 const second = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);
33
34 assert.deepEqual(second, first);
35 assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));
36 assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-private-key")));
37 assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-public-key")));
38 }).pipe(Effect.provide(layerServerSecretStore())),
39 );
40
41 it.effect("migrates a legacy keypair into the atomic secret", () =>
42 Effect.gen(function* () {
43 const secretStore = yield* ServerSecretStore.ServerSecretStore;
44 yield* secretStore.set(
45 "cloud-link-ed25519-private-key",
46 new TextEncoder().encode("private"),
47 );
48 yield* secretStore.set("cloud-link-ed25519-public-key", new TextEncoder().encode("public"));
49
50 assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {
51 privateKey: "private",
52 publicKey: "public",
53 });
54 assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));
55
56 // Unparseable key material must fail signing, not the layer every server starts.
57 const signingKey = yield* EnvironmentSigningKey.pipe(Effect.provide(layer));
58 assert.strictEqual(signingKey.publicKey, "public");
59 const error = yield* Effect.flip(signingKey.sign({ typ: "test+jwt", payload: {} }));
60 assert.strictEqual(error._tag, "RelayJwtError");
61 }).pipe(Effect.provide(layerServerSecretStore())),
62 );
63
64 it.effect("uses the persisted keypair when a concurrent creator wins", () =>
65 Effect.gen(function* () {
66 const winner = new TextEncoder().encode(
67 '{"privateKey":"winner-private","publicKey":"winner-public"}',
68 );
69 let createAttempted = false;
70 const secretStore = {
71 get: (name) =>
72 Effect.sync(() =>
73 name === "cloud-link-ed25519-key-pair" && createAttempted
74 ? Option.some(winner)
75 : Option.none(),
76 ),
77 set: unusedSecretStoreOperation,
78 create: () =>
79 Effect.sync(() => {
80 createAttempted = true;
81 }).pipe(
82 Effect.flatMap(() =>
83 Effect.fail(
84 new ServerSecretStore.SecretStorePersistError({
85 resource: "environment signing key pair",
86 cause: PlatformError.systemError({
87 _tag: "AlreadyExists",
88 module: "FileSystem",
89 method: "open",
90 pathOrDescriptor: "cloud-link-ed25519-key-pair.bin",
91 }),
92 }),
93 ),
94 ),
95 ),
96 getOrCreateRandom: unusedSecretStoreOperation,
97 remove: unusedSecretStoreOperation,
98 } satisfies ServerSecretStore.ServerSecretStore["Service"];
99
100 assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {
101 privateKey: "winner-private",
102 publicKey: "winner-public",
103 });
104 }),
105 );
106 },
107);