1import * as NodeServices from "@effect/platform-node/NodeServices";
2import { assert, it } from "@effect/vitest";
3import * as Effect from "effect/Effect";
4import * as Layer from "effect/Layer";
5import * as Option from "effect/Option";
6import * as PlatformError from "effect/PlatformError";
7
8import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
9import * as ServerConfig from "../config.ts";
10import { getOrCreateEnvironmentKeyPairFromSecretStore } from "./environmentKeys.ts";
11
12const layerServerSecretStore = () =>
13 ServerSecretStore.layer.pipe(
14 Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-environment-keys-test-" })),
15 );
16
17const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation");
18
19it.layer(NodeServices.layer)("getOrCreateEnvironmentKeyPairFromSecretStore", (it) => {
20 it.effect("persists one atomic keypair secret and reuses it", () =>
21 Effect.gen(function* () {
22 const secretStore = yield* ServerSecretStore.ServerSecretStore;
23
24 const first = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);
25 const second = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore);
26
27 assert.deepEqual(second, first);
28 assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));
29 assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-private-key")));
30 assert.isTrue(Option.isNone(yield* secretStore.get("cloud-link-ed25519-public-key")));
31 }).pipe(Effect.provide(layerServerSecretStore())),
32 );
33
34 it.effect("migrates a legacy keypair into the atomic secret", () =>
35 Effect.gen(function* () {
36 const secretStore = yield* ServerSecretStore.ServerSecretStore;
37 yield* secretStore.set("cloud-link-ed25519-private-key", new TextEncoder().encode("private"));
38 yield* secretStore.set("cloud-link-ed25519-public-key", new TextEncoder().encode("public"));
39
40 assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {
41 privateKey: "private",
42 publicKey: "public",
43 });
44 assert.isTrue(Option.isSome(yield* secretStore.get("cloud-link-ed25519-key-pair")));
45 }).pipe(Effect.provide(layerServerSecretStore())),
46 );
47
48 it.effect("uses the persisted keypair when a concurrent creator wins", () =>
49 Effect.gen(function* () {
50 const winner = new TextEncoder().encode(
51 '{"privateKey":"winner-private","publicKey":"winner-public"}',
52 );
53 let createAttempted = false;
54 const secretStore = {
55 get: (name) =>
56 Effect.sync(() =>
57 name === "cloud-link-ed25519-key-pair" && createAttempted
58 ? Option.some(winner)
59 : Option.none(),
60 ),
61 set: unusedSecretStoreOperation,
62 create: () =>
63 Effect.sync(() => {
64 createAttempted = true;
65 }).pipe(
66 Effect.flatMap(() =>
67 Effect.fail(
68 new ServerSecretStore.SecretStorePersistError({
69 resource: "environment signing key pair",
70 cause: PlatformError.systemError({
71 _tag: "AlreadyExists",
72 module: "FileSystem",
73 method: "open",
74 pathOrDescriptor: "cloud-link-ed25519-key-pair.bin",
75 }),
76 }),
77 ),
78 ),
79 ),
80 getOrCreateRandom: unusedSecretStoreOperation,
81 remove: unusedSecretStoreOperation,
82 } satisfies ServerSecretStore.ServerSecretStore["Service"];
83
84 assert.deepEqual(yield* getOrCreateEnvironmentKeyPairFromSecretStore(secretStore), {
85 privateKey: "winner-private",
86 publicKey: "winner-public",
87 });
88 }),
89 );
90});