History

Return credentials as Redacted from CredentialProvider

Rhys Sullivan committed 3 months ago

Commit 46f3da21 parent 0fbb93d32 files · +540 −127Browse files

Showing the changes to examples/all-plugins/src (1 of 32 files). Show all

Unified · Split

examples/all-plugins/src/main.ts+11−5
@@ -18,12 +18,13 @@ · 17 unmodified lines
1818 // default.
1919 // ---------------------------------------------------------------------------
2020
21−import { Cause, Effect, Result } from "effect";
21+import { Cause, Effect, Redacted, Result } from "effect";
2222
2323 import {
2424 AuthTemplateSlug,
2525 ConnectionName,
2626 createExecutor,
27+ credentialValueToWrite,
2728 IntegrationSlug,
2829 ProviderItemId,
2930 ProviderKey,
@@ -61,15 +62,20 @@ import { workosVaultPlugin } from "@executor-js/plugin-workos-vault"; · 31 unmodified lines
6162 // A connection's value lives in a writable credential provider. This tiny
6263 // in-memory store is enough for a script; the keychain / file-secrets /
6364 // 1Password plugins below contribute durable ones. Providers are Effect-native,
64−// so `get`/`set` return `Effect`s.
65+// so `get`/`set` return `Effect`s, and `get` hands back a `Redacted` so a
66+// credential cannot land in a log by accident.
6567 const memory = new Map<string, string>();
6668 const memoryProvider: CredentialProvider = {
6769 key: ProviderKey.make("memory"),
6870 writable: true,
69− get: (id: ProviderItemId) => Effect.sync(() => memory.get(String(id)) ?? null),
70− set: (id: ProviderItemId, value: string) =>
71+ get: (id: ProviderItemId) =>
7172 Effect.sync(() => {
72− memory.set(String(id), value);
73+ const value = memory.get(String(id));
74+ return value === undefined ? null : Redacted.make(value);
75+ }),
76+ set: (id: ProviderItemId, value: string | Redacted.Redacted<string>) =>
77+ Effect.sync(() => {
78+ memory.set(String(id), credentialValueToWrite(value));
7379 }),
7480 };
7581