feat(stack): protect-ffi 0.25.0 + auth strategy option (stacked on #496)#497
feat(stack): protect-ffi 0.25.0 + auth strategy option (stacked on #496)#497coderdan wants to merge 2 commits into
Conversation
protect-ffi 0.25.0 is a breaking release for both entries: WASM (@cipherstash/stack/wasm-inline): - newClient(strategy, opts) -> newClient(opts) with strategy nested. - Config takes a workspaceCrn instead of region; the AccessKeyStrategy region is derived from the CRN (crn:<region>:<workspace-id>). CS_REGION is no longer consulted; set CS_WORKSPACE_CRN. Node: - serviceToken removed from the encrypt/decrypt/query option types (and the CtsToken export). The per-operation CTS token is no longer forwarded; lock contexts still travel as lockContext.identityClaim. Public LockContext/identify() API is unchanged. Adds offline lock-context wiring tests (mock protect-ffi) asserting every operation forwards identityClaim and never sends serviceToken, plus extractRegionFromCrn unit tests. Updates the Deno e2e test, Supabase example, and wasm-e2e CI job to CS_WORKSPACE_CRN.
protect-ffi 0.25 lets newClient take an AuthStrategy (any
{ getToken(): Promise<{ token }> } object). Expose it on the Node
Encryption client via config.strategy: when supplied, getToken() is
invoked on every ZeroKMS request, taking precedence over the
credentials-derived default (clientKey is still used for encryption).
Omitting it preserves existing credentials/env behaviour.
Kept on init (rather than a separate initWithStrategy) so a future
keyProvider option can land in the same config. AuthStrategy is
re-exported from @cipherstash/stack for consumers to type their own.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🦋 Changeset detectedLatest commit: 2b9d376 The changes in this PR will be included in the next version bump. This PR includes changesets to release 6 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
1 participant
Stacked on top of #496 (
feat/stack-wasm-inline) — review/merge that first; this PR's base is the #496 branch, notmain.#496 was approved but its docs referenced
CS_WORKSPACE_CRNbeing removed.@cipherstash/protect-ffi@0.25.0enforces the opposite:CS_WORKSPACE_CRNis the source of truth andCS_REGIONis dropped. This PR bumps to0.25.0, corrects the behaviour and docs, and adds the new auth-strategy capability.1. protect-ffi 0.24.0 → 0.25.0
0.25.0is breaking for both entries (per the upstream release notes: "remove anyserviceTokenoptions andCtsTokenimports; setCS_WORKSPACE_CRNinstead ofCS_REGION"):/wasm-inline) —newClient(strategy, opts)→newClient(opts)withstrategynested (the branch's two-arg call would break at runtime). TheEncryption()config now takesworkspaceCrninstead ofregion; theAccessKeyStrategyregion is derived from the CRN (crn:<region>:<workspace-id>).CS_REGIONis no longer read.serviceTokenremoved from every encrypt/decrypt/query option type. The per-operation CTS token is no longer forwarded; auth flows through the client strategy/credentials, and lock contexts still travel aslockContext.identityClaim. The publicLockContext/identify()API is unchanged.Lock-context coverage (the important bit)
The live
lock-context.test.tsskips without aUSER_JWT, so theserviceTokenremoval had no CI guard. Addedlock-context-wiring.test.ts— mocks protect-ffi and asserts, forencrypt/decrypt/bulkEncrypt/bulkDecrypt/encryptQuery(single + batch)/encryptModel/decryptModel, thatidentityClaimreaches protect-ffi andserviceTokenis never sent.2. New
config.strategyauth strategy (Node)0.25letsnewClientaccept anAuthStrategy.Encryption({ config: { strategy } })now forwards it;getToken()is then used for every ZeroKMS request, taking precedence over the credentials-derived default (clientKeystill used for encryption). Omitting it preserves existing behaviour.Per discussion, this lives on
init(not a separateinitWithStrategy) so a futurekeyProvideroption can land in the same config.AuthStrategyis re-exported from@cipherstash/stack.Also updated
index.ts,.env.example,README), and thewasm-e2e-testsCI job →CS_WORKSPACE_CRN.e2e/wasm/deno.jsonprotect-ffi pin →0.25.0.Test plan
turbo run build --filter @cipherstash/stack(incl. DTS type-check)vitest run --exclude searchable-json-pg)wasm-e2e-testsgreen on CI (needsCS_WORKSPACE_CRNsecret exposed to the job — added in this PR)USER_JWTto confirm per-user binding under 0.25