import * as Context from "effect/Context";import * as Crypto from "effect/Crypto";import * as Data from "effect/Data";import * as Effect from "effect/Effect";import * as FileSystem from "effect/FileSystem";import * as Layer from "effect/Layer";import * as Path from "effect/Path";import * as Predicate from "effect/Predicate";import * as PlatformError from "effect/PlatformError"; import { ServerConfig } from "../config.ts"; export class SecretStoreError extends Data.TaggedError("SecretStoreError")<{ readonly message: string; readonly cause?: unknown;}> {} const isPlatformError = (value: unknown): value is PlatformError.PlatformError => Predicate.isTagged(value, "PlatformError"); export const isSecretAlreadyExistsError = (error: SecretStoreError): boolean => isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists"; export interface ServerSecretStoreShape { readonly get: (name: string) => Effect.Effect<Uint8Array | null, SecretStoreError>; readonly set: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>; readonly create: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>; readonly getOrCreateRandom: ( name: string, bytes: number, ) => Effect.Effect<Uint8Array, SecretStoreError>; readonly remove: (name: string) => Effect.Effect<void, SecretStoreError>;} export class ServerSecretStore extends Context.Service<ServerSecretStore, ServerSecretStoreShape>()( "t3/auth/ServerSecretStore",) {} export const make = Effect.fn("makeServerSecretStore")(function* () { const crypto = yield* Crypto.Crypto; const fileSystem = yield* FileSystem.FileSystem; const path = yield* Path.Path; const serverConfig = yield* ServerConfig; yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true }); yield* fileSystem.chmod(serverConfig.secretsDir, 0o700).pipe( Effect.mapError( (cause) => new SecretStoreError({ message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`, cause, }), ), ); const resolveSecretPath = (name: string) => path.join(serverConfig.secretsDir, `${name}.bin`); const get: ServerSecretStoreShape["get"] = (name) => fileSystem.readFile(resolveSecretPath(name)).pipe( Effect.map((bytes) => Uint8Array.from(bytes)), Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.succeed(null) : Effect.fail( new SecretStoreError({ message: `Failed to read secret ${name}.`, cause, }), ), ), Effect.withSpan("ServerSecretStore.get"), ); const set: ServerSecretStoreShape["set"] = (name, value) => { const secretPath = resolveSecretPath(name); return crypto.randomUUIDv4.pipe( Effect.mapError( (cause) => new SecretStoreError({ message: `Failed to create temporary path for secret ${name}.`, cause, }), ), Effect.flatMap((uuid) => { const tempPath = `${secretPath}.${uuid}.tmp`; return Effect.gen(function* () { yield* fileSystem.writeFile(tempPath, value); yield* fileSystem.chmod(tempPath, 0o600); yield* fileSystem.rename(tempPath, secretPath); yield* fileSystem.chmod(secretPath, 0o600); }).pipe( Effect.catch((cause) => fileSystem.remove(tempPath).pipe( Effect.ignore, Effect.flatMap(() => Effect.fail( new SecretStoreError({ message: `Failed to persist secret ${name}.`, cause, }), ), ), ), ), ); }), Effect.withSpan("ServerSecretStore.set"), ); }; const create: ServerSecretStoreShape["create"] = (name, value) => { const secretPath = resolveSecretPath(name); return Effect.scoped( Effect.gen(function* () { const file = yield* fileSystem.open(secretPath, { flag: "wx", mode: 0o600, }); yield* file.writeAll(value); yield* file.sync; yield* fileSystem.chmod(secretPath, 0o600); }), ).pipe( Effect.mapError( (cause) => new SecretStoreError({ message: `Failed to persist secret ${name}.`, cause, }), ), ); }; const getOrCreateRandom: ServerSecretStoreShape["getOrCreateRandom"] = (name, bytes) => get(name).pipe( Effect.flatMap((existing) => { if (existing) { return Effect.succeed(existing); } return crypto.randomBytes(bytes).pipe( Effect.mapError( (cause) => new SecretStoreError({ message: `Failed to generate random bytes for secret ${name}.`, cause, }), ), Effect.flatMap((generated) => create(name, generated).pipe( Effect.as(Uint8Array.from(generated)), Effect.catchTag("SecretStoreError", (error) => isSecretAlreadyExistsError(error) ? get(name).pipe( Effect.flatMap((created) => created !== null ? Effect.succeed(created) : Effect.fail( new SecretStoreError({ message: `Failed to read secret ${name} after concurrent creation.`, }), ), ), ) : Effect.fail(error), ), ), ), ); }), Effect.withSpan("ServerSecretStore.getOrCreateRandom"), ); const remove: ServerSecretStoreShape["remove"] = (name) => fileSystem.remove(resolveSecretPath(name)).pipe( Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.void : Effect.fail( new SecretStoreError({ message: `Failed to remove secret ${name}.`, cause, }), ), ), Effect.withSpan("ServerSecretStore.remove"), ); return { get, set, create, getOrCreateRandom, remove, } satisfies ServerSecretStoreShape;}); export const layer = Layer.effect(ServerSecretStore, make());
import * as Context from "effect/Context";
import * as Crypto from "effect/Crypto";
import * as Data from "effect/Data";
import * as Effect from "effect/Effect";
import * as FileSystem from "effect/FileSystem";
import * as Layer from "effect/Layer";
import * as Path from "effect/Path";
import * as Predicate from "effect/Predicate";
import * as PlatformError from "effect/PlatformError";
import { ServerConfig } from "../config.ts";
export class SecretStoreError extends Data.TaggedError("SecretStoreError")<{
readonly message: string;
readonly cause?: unknown;
}> {}
const isPlatformError = (value: unknown): value is PlatformError.PlatformError =>
Predicate.isTagged(value, "PlatformError");
export const isSecretAlreadyExistsError = (error: SecretStoreError): boolean =>
isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
export interface ServerSecretStoreShape {
readonly get: (name: string) => Effect.Effect<Uint8Array | null, SecretStoreError>;
readonly set: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>;
readonly create: (name: string, value: Uint8Array) => Effect.Effect<void, SecretStoreError>;
readonly getOrCreateRandom: (
name: string,
bytes: number,
) => Effect.Effect<Uint8Array, SecretStoreError>;
readonly remove: (name: string) => Effect.Effect<void, SecretStoreError>;
}
export class ServerSecretStore extends Context.Service<ServerSecretStore, ServerSecretStoreShape>()(
"t3/auth/ServerSecretStore",
) {}
export const make = Effect.fn("makeServerSecretStore")(function* () {
const crypto = yield* Crypto.Crypto;
const fileSystem = yield* FileSystem.FileSystem;
const path = yield* Path.Path;
const serverConfig = yield* ServerConfig;
yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
yield* fileSystem.chmod(serverConfig.secretsDir, 0o700).pipe(
Effect.mapError(
(cause) =>
new SecretStoreError({
message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`,
cause,
}),
),
);
const resolveSecretPath = (name: string) => path.join(serverConfig.secretsDir, `${name}.bin`);
const get: ServerSecretStoreShape["get"] = (name) =>
fileSystem.readFile(resolveSecretPath(name)).pipe(
Effect.map((bytes) => Uint8Array.from(bytes)),
Effect.catch((cause) =>
cause.reason._tag === "NotFound"
? Effect.succeed(null)
: Effect.fail(
new SecretStoreError({
message: `Failed to read secret ${name}.`,
cause,
}),
),
),
Effect.withSpan("ServerSecretStore.get"),
);
const set: ServerSecretStoreShape["set"] = (name, value) => {
const secretPath = resolveSecretPath(name);
return crypto.randomUUIDv4.pipe(
Effect.mapError(
(cause) =>
new SecretStoreError({
message: `Failed to create temporary path for secret ${name}.`,
cause,
}),
),
Effect.flatMap((uuid) => {
const tempPath = `${secretPath}.${uuid}.tmp`;
return Effect.gen(function* () {
yield* fileSystem.writeFile(tempPath, value);
yield* fileSystem.chmod(tempPath, 0o600);
yield* fileSystem.rename(tempPath, secretPath);
yield* fileSystem.chmod(secretPath, 0o600);
}).pipe(
Effect.catch((cause) =>
fileSystem.remove(tempPath).pipe(
Effect.ignore,
Effect.flatMap(() =>
Effect.fail(
new SecretStoreError({
message: `Failed to persist secret ${name}.`,
cause,
}),
),
),
),
),
);
}),
Effect.withSpan("ServerSecretStore.set"),
);
};
const create: ServerSecretStoreShape["create"] = (name, value) => {
const secretPath = resolveSecretPath(name);
return Effect.scoped(
Effect.gen(function* () {
const file = yield* fileSystem.open(secretPath, {
flag: "wx",
mode: 0o600,
});
yield* file.writeAll(value);
yield* file.sync;
yield* fileSystem.chmod(secretPath, 0o600);
}),
).pipe(
Effect.mapError(
(cause) =>
new SecretStoreError({
message: `Failed to persist secret ${name}.`,
cause,
}),
),
);
};
const getOrCreateRandom: ServerSecretStoreShape["getOrCreateRandom"] = (name, bytes) =>
get(name).pipe(
Effect.flatMap((existing) => {
if (existing) {
return Effect.succeed(existing);
}
return crypto.randomBytes(bytes).pipe(
Effect.mapError(
(cause) =>
new SecretStoreError({
message: `Failed to generate random bytes for secret ${name}.`,
cause,
}),
),
Effect.flatMap((generated) =>
create(name, generated).pipe(
Effect.as(Uint8Array.from(generated)),
Effect.catchTag("SecretStoreError", (error) =>
isSecretAlreadyExistsError(error)
? get(name).pipe(
Effect.flatMap((created) =>
created !== null
? Effect.succeed(created)
: Effect.fail(
new SecretStoreError({
message: `Failed to read secret ${name} after concurrent creation.`,
}),
),
),
)
: Effect.fail(error),
),
),
),
);
}),
Effect.withSpan("ServerSecretStore.getOrCreateRandom"),
);
const remove: ServerSecretStoreShape["remove"] = (name) =>
fileSystem.remove(resolveSecretPath(name)).pipe(
Effect.catch((cause) =>
cause.reason._tag === "NotFound"
? Effect.void
: Effect.fail(
new SecretStoreError({
message: `Failed to remove secret ${name}.`,
cause,
}),
),
),
Effect.withSpan("ServerSecretStore.remove"),
);
return {
get,
set,
create,
getOrCreateRandom,
remove,
} satisfies ServerSecretStoreShape;
});
export const layer = Layer.effect(ServerSecretStore, make());