feat(capability): per-scope BYO provider credentials + Twilio SMS egress

IIOS becomes the tenant's integration/credential hub for anything it sends. New IiosProviderCredential (one row per scope+providerType) seals the secret with AES-256-GCM under IIOS_CRED_KEY (secret-crypto.ts); only non-secret displayHints are ever read back. ProviderCredentialService upsert/resolve/status; TwilioSmsProvider resolves the caller's own creds per scope at send time and POSTs to Twilio (fail-closed NOT_CONFIGURED when unset). Registered over the SMS sandbox only when the platform key + store are present. PUT/GET /v1/providers/:type/credentials (scope-fenced, masked reads). 16 new unit tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-22 15:10:18 +05:30
parent 2aa2893973
commit ddd628ab6f
12 changed files with 503 additions and 3 deletions
@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { credKeyFromEnv, sealSecret, openSecret, SECRET_KEY_VERSION } from './secret-crypto';
+
+const KEY = Buffer.alloc(32, 7); // deterministic 32-byte key for tests
+
+describe('secret-crypto', () => {
+  it('round-trips a secret through seal → open', () => {
+    const sealed = sealSecret('sk_live_abc123', KEY);
+    expect(sealed.keyVersion).toBe(SECRET_KEY_VERSION);
+    expect(sealed.cipherText).not.toContain('sk_live_abc123');
+    expect(openSecret(sealed, KEY)).toBe('sk_live_abc123');
+  });
+
+  it('produces a distinct ciphertext each time (random IV)', () => {
+    const a = sealSecret('same', KEY);
+    const b = sealSecret('same', KEY);
+    expect(a.cipherText).not.toBe(b.cipherText);
+    expect(a.iv).not.toBe(b.iv);
+  });
+
+  it('fails to open with the wrong key', () => {
+    const sealed = sealSecret('top-secret', KEY);
+    expect(() => openSecret(sealed, Buffer.alloc(32, 9))).toThrow();
+  });
+
+  it('fails to open if the ciphertext is tampered (GCM auth)', () => {
+    const sealed = sealSecret('top-secret', KEY);
+    const bad = { ...sealed, cipherText: Buffer.from('deadbeef', 'hex').toString('base64') };
+    expect(() => openSecret(bad, KEY)).toThrow();
+  });
+
+  it('credKeyFromEnv returns null when unset and rejects a wrong-length key', () => {
+    expect(credKeyFromEnv({})).toBeNull();
+    expect(() => credKeyFromEnv({ IIOS_CRED_KEY: Buffer.alloc(16).toString('base64') })).toThrow(/32 bytes/);
+    const key = credKeyFromEnv({ IIOS_CRED_KEY: KEY.toString('base64') });
+    expect(key?.length).toBe(32);
+  });
+});