feat: derive workspace runtime secret requirements

2026-08-14 17:26:39 +02:00
parent e4999c8420
commit 2114c94704
2 changed files with 337 additions and 0 deletions
@@ -0,0 +1,138 @@
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, expect, test } from "vitest";
+
+import {
+  discoverWorkspaceSecretRequirements,
+  resolveRuntimeBindingsWithWorkspaceSecrets,
+} from "../src/workspaces/secret-requirements.js";
+import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";
+import { parseWorkspaceYaml } from "../src/workspaces/schema.js";
+
+const roots: string[] = [];
+
+function workspace(extra = "") {
+  return parseWorkspaceYaml(`workspace:
+  schema_version: 3
+  id: psd-clinical
+  name: Policlinico San Donato
+  language: en
+dwh:
+  engine: postgres
+  database: postgres
+  schema: datawarehouse
+  supported_transports: [postgres_direct, rest_api, ssh_tunnel]
+semantic_index:
+  vector_store: { engine: qdrant, collection: psd-clinical, dimensions: 1024, distance: cosine }
+  embedding: { provider: ollama_internal, model: qwen3-embedding:0.6b, dimensions: 1024 }
+llm_policy: { allowed: [zai/glm-5.2] }
+${extra}`);
+}
+
+function store() {
+  const root = mkdtempSync(join(tmpdir(), "thoth-requirement-vault-"));
+  const runtimeRoot = mkdtempSync(join(tmpdir(), "thoth-requirement-runtime-"));
+  roots.push(root, runtimeRoot);
+  return new WorkspaceSecretStore({ root, runtimeRoot, installationId: "test-installation" });
+}
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+test("requirements follow the selected DWH transport", () => {
+  const descriptor = workspace();
+  const direct = discoverWorkspaceSecretRequirements(descriptor, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+  });
+  expect(direct.map(({ id, required }) => ({ id, required }))).toEqual([
+    { id: "dwh.password", required: true },
+  ]);
+
+  const rest = discoverWorkspaceSecretRequirements(descriptor, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "rest_api",
+  });
+  expect(rest.map(({ id }) => id)).toEqual(["dwh.api_key"]);
+
+  const ssh = discoverWorkspaceSecretRequirements(descriptor, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "ssh_tunnel",
+  });
+  expect(ssh.map(({ id }) => id)).toEqual(["dwh.password", "dwh.ssh_private_key"]);
+});
+
+test("REST without authentication does not request an API key", () => {
+  const descriptor = workspace(`diagnostics:
+  dwh_rest:
+    method: GET
+    path: /health
+    auth: none
+    response: { database: database, schema: schema }
+`);
+  expect(discoverWorkspaceSecretRequirements(descriptor, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "rest_api",
+  })).toEqual([]);
+});
+
+test("evidence requirements follow the descriptor authentication mechanism", () => {
+  const signed = workspace(`evidence:
+  source:
+    type: http
+    uris: [https://evidence.example.test/guide.md]
+    authentication: signed_urls_file
+  policy: { max_chunk_chars: 4000, retain_published_generations: 2 }
+`);
+  expect(discoverWorkspaceSecretRequirements(signed, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+  }).map(({ id, required }) => ({ id, required }))).toEqual([
+    { id: "dwh.password", required: true },
+    { id: "evidence.signed_urls", required: true },
+  ]);
+
+  const s3 = workspace(`evidence:
+  source: { type: s3, uri: s3://clinical-evidence/published/, credentials: static_files }
+  policy: { max_chunk_chars: 4000, retain_published_generations: 2 }
+`);
+  expect(discoverWorkspaceSecretRequirements(s3, {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+  }).map(({ id, required }) => ({ id, required }))).toEqual([
+    { id: "dwh.password", required: true },
+    { id: "evidence.access_key", required: true },
+    { id: "evidence.secret_key", required: true },
+    { id: "evidence.session_token", required: false },
+  ]);
+});
+
+test("vault values are mapped to temporary file bindings and released", () => {
+  const descriptor = workspace();
+  const vault = store();
+  vault.put("psd-clinical", "dwh.password", "runtime-password");
+  const environment = {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+    THT_WS_PSD_CLINICAL_DWH_HOST: "dwh.internal",
+    THT_WS_PSD_CLINICAL_DWH_PORT: "5432",
+    THT_WS_PSD_CLINICAL_DWH_USER: "reader",
+  };
+
+  const lease = resolveRuntimeBindingsWithWorkspaceSecrets(descriptor, environment, [], vault);
+  expect(lease.bindings.dwh.missing).toEqual([]);
+  const secretPath = lease.bindings.dwh.values.THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE!;
+  expect(readFileSync(secretPath, "utf8")).toBe("runtime-password");
+  lease.release();
+  expect(() => readFileSync(secretPath, "utf8")).toThrow();
+});
+
+test("missing vault values remain missing and materialization never mutates the source environment", () => {
+  const descriptor = workspace();
+  const vault = store();
+  const environment = {
+    THT_WS_PSD_CLINICAL_DWH_TRANSPORT: "postgres_direct",
+    THT_WS_PSD_CLINICAL_DWH_HOST: "dwh.internal",
+    THT_WS_PSD_CLINICAL_DWH_PORT: "5432",
+    THT_WS_PSD_CLINICAL_DWH_USER: "reader",
+  };
+  const lease = resolveRuntimeBindingsWithWorkspaceSecrets(descriptor, environment, [], vault);
+  expect(lease.bindings.dwh.missing).toContain("THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE");
+  expect(environment).not.toHaveProperty("THT_WS_PSD_CLINICAL_DWH_PASSWORD_FILE");
+  lease.release();
+});