mirror of
https://github.com/alkimake/paperclip.git
synced 2026-06-19 12:10:37 +09:00
[codex] Add routine env secrets support (#6212)
## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies. > - Scheduled routines are the control-plane path for recurring agent work. > - Routines already had dispatch/history, but their runtime environment did not carry routine-owned secret bindings through execution. > - Operators need routine-specific secrets that can override project/agent env without exposing secret values in history, logs, or access events. > - This pull request adds the routine env runtime contract, wires it into execution, and makes the routine UI/history surfaces show safe secret metadata. > - The benefit is that routine executions can use scoped secret refs predictably while preserving company boundaries and auditability. ## What Changed - Added routine env persistence/runtime support, including `routines.env`, `routine_runs.routine_revision_id`, revision snapshots, and idempotent migration `0086_routine_env_runtime_contract`. - Resolved routine env during heartbeat adapter config assembly with precedence `agent < project < routine` and secret access events recorded against the routine consumer. - Added secret binding synchronization for routine create/update/restore flows and guarded cross-company, missing, disabled, and deleted secret cases. - Added a Secrets tab to routine detail, env/secret history diff rendering, and Storybook coverage for the new UI states. - Added server/UI regression tests, including an embedded-Postgres QA path for routine secret execution and restore behavior. - Updated implementation/database docs for routine env and secret-binding behavior. ## Verification - `pnpm install --frozen-lockfile` after rebasing onto `public-gh/master` to refresh workspace links for the newly-added upstream Grok adapter package. - `pnpm exec vitest run server/src/__tests__/heartbeat-project-env.test.ts server/src/__tests__/routines-service.test.ts server/src/__tests__/secrets-service.test.ts server/src/__tests__/qa-routine-secrets-e2e.test.ts ui/src/components/RoutineHistoryTab.test.tsx` passed: 5 files, 92 tests. - `pnpm -r typecheck` passed across the workspace. - `pnpm build` passed. Vite emitted the existing large-chunk/dynamic-import warnings. - UI screenshots were captured locally during QA in `artifacts/pap-9521/` and `artifacts/pap-9522/`; generated screenshots are not committed to avoid adding binary artifacts to the repo. ## Risks - Migration risk is limited by `IF NOT EXISTS` guards for the new columns, FK, and index, and the migration is ordered as `0086` immediately after upstream `0085`. - Runtime behavior changes env precedence for routine executions by adding routine env as the highest-precedence layer; tests cover agent/project/routine precedence. - Secret handling is security-sensitive; tests cover value-free manifests/events/errors, disabled/missing/deleted secrets, and cross-company rejection. - UI history now renders routine env/secret diffs; tests and Storybook stories cover the main rendering paths. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex coding agent based on GPT-5, with shell/tool use and medium reasoning effort. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
GitHub
parent
3e6610fb93
commit
705c1b8d81
20 changed files with 1736 additions and 50 deletions
|
|
@ -61,6 +61,8 @@ const COMING_SOON_SECRET_PROVIDERS: ReadonlySet<SecretProvider> = new Set([
|
|||
"gcp_secret_manager",
|
||||
"vault",
|
||||
]);
|
||||
type DbTransaction = Parameters<Parameters<Db["transaction"]>[0]>[0];
|
||||
type SecretBindingDb = Pick<Db | DbTransaction, "select" | "delete" | "insert">;
|
||||
|
||||
function remoteProviderHttpError(error: unknown, context: {
|
||||
companyId: string;
|
||||
|
|
@ -195,6 +197,14 @@ type RuntimeSecretResolution = {
|
|||
manifestEntry: RuntimeSecretManifestEntry;
|
||||
};
|
||||
|
||||
type SecretResolutionErrorCode =
|
||||
| "binding_missing"
|
||||
| "secret_deleted"
|
||||
| "secret_inactive"
|
||||
| "version_missing"
|
||||
| "version_inactive"
|
||||
| "provider_error";
|
||||
|
||||
function asRecord(value: unknown): Record<string, unknown> | null {
|
||||
if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
|
||||
return value as Record<string, unknown>;
|
||||
|
|
@ -238,6 +248,33 @@ function defaultProviderConfigStatus(provider: SecretProvider): SecretProviderCo
|
|||
return COMING_SOON_SECRET_PROVIDERS.has(provider) ? "coming_soon" : "ready";
|
||||
}
|
||||
|
||||
function secretResolutionErrorCode(error: unknown): SecretResolutionErrorCode {
|
||||
if (isSecretProviderClientError(error)) return "provider_error";
|
||||
if (error instanceof HttpError) {
|
||||
const details = asRecord(error.details);
|
||||
switch (details?.code) {
|
||||
case "binding_missing":
|
||||
case "secret_deleted":
|
||||
case "secret_inactive":
|
||||
case "version_missing":
|
||||
case "version_inactive":
|
||||
case "provider_error":
|
||||
return details.code;
|
||||
}
|
||||
if (error.message === "Secret is not active") return "secret_inactive";
|
||||
if (error.message === "Secret version not found") return "version_missing";
|
||||
if (error.message === "Secret version is not active") return "version_inactive";
|
||||
if (
|
||||
error.message === "Secret resolution requires a binding config path" ||
|
||||
error.message.startsWith("Secret is not bound to ")
|
||||
) {
|
||||
return "binding_missing";
|
||||
}
|
||||
if (error.status >= 500) return "provider_error";
|
||||
}
|
||||
return "provider_error";
|
||||
}
|
||||
|
||||
function assertSelectableProviderConfig(config: {
|
||||
provider: string;
|
||||
status: string;
|
||||
|
|
@ -259,8 +296,8 @@ export function secretService(db: Db) {
|
|||
fieldPath?: string;
|
||||
};
|
||||
|
||||
async function getById(id: string) {
|
||||
return db
|
||||
async function getById(id: string, source: Pick<Db | DbTransaction, "select"> = db) {
|
||||
return source
|
||||
.select()
|
||||
.from(companySecrets)
|
||||
.where(eq(companySecrets.id, id))
|
||||
|
|
@ -321,7 +358,7 @@ export function secretService(db: Db) {
|
|||
) {
|
||||
if (!context) return;
|
||||
if (!context.configPath) {
|
||||
throw unprocessable("Secret resolution requires a binding config path");
|
||||
throw unprocessable("Secret resolution requires a binding config path", { code: "binding_missing" });
|
||||
}
|
||||
const binding = await getBinding({
|
||||
companyId,
|
||||
|
|
@ -333,6 +370,7 @@ export function secretService(db: Db) {
|
|||
if (!binding) {
|
||||
throw unprocessable(
|
||||
`Secret is not bound to ${context.consumerType}:${context.consumerId} at ${context.configPath}`,
|
||||
{ code: "binding_missing" },
|
||||
);
|
||||
}
|
||||
}
|
||||
|
|
@ -365,8 +403,12 @@ export function secretService(db: Db) {
|
|||
});
|
||||
}
|
||||
|
||||
async function assertSecretInCompany(companyId: string, secretId: string) {
|
||||
const secret = await getById(secretId);
|
||||
async function assertSecretInCompany(
|
||||
companyId: string,
|
||||
secretId: string,
|
||||
source: Pick<Db | DbTransaction, "select"> = db,
|
||||
) {
|
||||
const secret = await getById(secretId, source);
|
||||
if (!secret) throw notFound("Secret not found");
|
||||
if (secret.status === "deleted") throw notFound("Secret not found");
|
||||
if (secret.companyId !== companyId) throw unprocessable("Secret must belong to same company");
|
||||
|
|
@ -495,19 +537,24 @@ export function secretService(db: Db) {
|
|||
version: number | "latest",
|
||||
context?: SecretConsumerContext,
|
||||
): Promise<RuntimeSecretResolution> {
|
||||
const secret = await assertSecretInCompany(companyId, secretId);
|
||||
const secret = await getById(secretId);
|
||||
if (!secret) throw notFound("Secret not found");
|
||||
if (secret.companyId !== companyId) throw unprocessable("Secret must belong to same company");
|
||||
const resolvedVersion = version === "latest" ? secret.latestVersion : version;
|
||||
const providerId = secret.provider as SecretProvider;
|
||||
const configPath = context?.configPath ?? null;
|
||||
try {
|
||||
if (secret.status === "deleted") {
|
||||
throw new HttpError(404, "Secret not found", { code: "secret_deleted" });
|
||||
}
|
||||
if (secret.status !== "active") {
|
||||
throw unprocessable("Secret is not active");
|
||||
throw unprocessable("Secret is not active", { code: "secret_inactive" });
|
||||
}
|
||||
await assertBindingContext(companyId, secret.id, context);
|
||||
const versionRow = await getSecretVersion(secret.id, resolvedVersion);
|
||||
if (!versionRow) throw notFound("Secret version not found");
|
||||
if (!versionRow) throw new HttpError(404, "Secret version not found", { code: "version_missing" });
|
||||
if (versionRow.status === "disabled" || versionRow.status === "destroyed" || versionRow.revokedAt) {
|
||||
throw unprocessable("Secret version is not active");
|
||||
throw unprocessable("Secret version is not active", { code: "version_inactive" });
|
||||
}
|
||||
const provider = getSecretProvider(providerId);
|
||||
const providerConfig = await getSelectableRuntimeProviderConfig({
|
||||
|
|
@ -555,7 +602,7 @@ export function secretService(db: Db) {
|
|||
},
|
||||
};
|
||||
} catch (err) {
|
||||
const errorCode = err instanceof Error ? err.message.slice(0, 120) : "resolution_failed";
|
||||
const errorCode = secretResolutionErrorCode(err);
|
||||
await recordAccessEvent({
|
||||
companyId,
|
||||
secretId: secret.id,
|
||||
|
|
@ -1984,6 +2031,7 @@ export function secretService(db: Db) {
|
|||
companyId: string,
|
||||
target: { targetType: SecretBindingTargetType; targetId: string; pathPrefix?: string },
|
||||
envValue: unknown,
|
||||
options?: { db?: SecretBindingDb },
|
||||
) => {
|
||||
const record = asRecord(envValue) ?? {};
|
||||
const refs: Array<{
|
||||
|
|
@ -1992,12 +2040,13 @@ export function secretService(db: Db) {
|
|||
versionSelector: SecretVersionSelector;
|
||||
}> = [];
|
||||
const pathPrefix = target.pathPrefix ?? "env";
|
||||
const bindingDb = options?.db ?? db;
|
||||
for (const [key, rawBinding] of Object.entries(record)) {
|
||||
const parsed = envBindingSchema.safeParse(rawBinding);
|
||||
if (!parsed.success) continue;
|
||||
const binding = canonicalizeBinding(parsed.data as EnvBinding);
|
||||
if (binding.type !== "secret_ref") continue;
|
||||
await assertSecretInCompany(companyId, binding.secretId);
|
||||
await assertSecretInCompany(companyId, binding.secretId, bindingDb);
|
||||
refs.push({
|
||||
secretId: binding.secretId,
|
||||
configPath: `${pathPrefix}.${key}`,
|
||||
|
|
@ -2005,8 +2054,8 @@ export function secretService(db: Db) {
|
|||
});
|
||||
}
|
||||
|
||||
await db.transaction(async (tx) => {
|
||||
await tx
|
||||
const writeBindings = async (targetDb: SecretBindingDb) => {
|
||||
await targetDb
|
||||
.delete(companySecretBindings)
|
||||
.where(
|
||||
and(
|
||||
|
|
@ -2017,7 +2066,7 @@ export function secretService(db: Db) {
|
|||
),
|
||||
);
|
||||
if (refs.length === 0) return;
|
||||
await tx.insert(companySecretBindings).values(
|
||||
await targetDb.insert(companySecretBindings).values(
|
||||
refs.map((ref) => ({
|
||||
companyId,
|
||||
secretId: ref.secretId,
|
||||
|
|
@ -2028,7 +2077,13 @@ export function secretService(db: Db) {
|
|||
required: true,
|
||||
})),
|
||||
);
|
||||
});
|
||||
};
|
||||
|
||||
if (options?.db) {
|
||||
await writeBindings(options.db);
|
||||
} else {
|
||||
await db.transaction(async (tx) => writeBindings(tx));
|
||||
}
|
||||
return refs;
|
||||
},
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue