From c161a26ec0a02bc978bd81a6498d4e2e47b60719 Mon Sep 17 00:00:00 2001
From: dswbx <dennis.senn@gmx.ch>
Date: Wed, 25 Jun 2025 07:49:39 +0200
Subject: [PATCH] test secrets extraction

---
 app/__test__/api/DataApi.spec.ts           |  2 +-
 app/src/auth/auth-schema.ts                | 20 ++------------------
 app/src/auth/authenticate/Authenticator.ts |  4 ++--
 app/src/core/object/schema/index.ts        |  2 ++
 app/src/core/object/schema/secret.ts       |  7 +++++++
 app/src/modules/server/SystemController.ts | 14 ++++++++++++++
 6 files changed, 28 insertions(+), 21 deletions(-)
 create mode 100644 app/src/core/object/schema/secret.ts

diff --git a/app/__test__/api/DataApi.spec.ts b/app/__test__/api/DataApi.spec.ts
index 5be5e1e6..cb48d7c3 100644
--- a/app/__test__/api/DataApi.spec.ts
+++ b/app/__test__/api/DataApi.spec.ts
@@ -1,12 +1,12 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import { Guard } from "../../src/auth";
-import { parse } from "../../src/core/utils";
 import { DataApi } from "../../src/data/api/DataApi";
 import { DataController } from "../../src/data/api/DataController";
 import { dataConfigSchema } from "../../src/data/data-schema";
 import * as proto from "../../src/data/prototype";
 import { schemaToEm } from "../helper";
 import { disableConsoleLog, enableConsoleLog } from "core/utils/test";
+import { parse } from "core/object/schema";
 
 beforeAll(disableConsoleLog);
 afterAll(enableConsoleLog);
diff --git a/app/src/auth/auth-schema.ts b/app/src/auth/auth-schema.ts
index e34a0059..940d0e83 100644
--- a/app/src/auth/auth-schema.ts
+++ b/app/src/auth/auth-schema.ts
@@ -46,20 +46,6 @@ export const guardRoleSchema = s.strictObject({
    implicit_allow: s.boolean().optional(),
 });
 
-const a = s.record(strategiesSchema, {
-   // ^?
-   title: "Strategies",
-   default: {
-      password: {
-         type: "password",
-         enabled: true,
-         config: {
-            hashing: "sha256",
-         },
-      },
-   },
-});
-
 export const authConfigSchema = s.strictObject(
    {
       enabled: s.boolean({ default: false }),
@@ -85,9 +71,7 @@ export const authConfigSchema = s.strictObject(
    },
    { title: "Authentication" },
 );
-const b = authConfigSchema.properties.basepath;
-//    ^?
-const c = authConfigSchema.properties.strategies;
-//    ^?
+
+export type AppAuthJWTConfig = s.Static<typeof jwtConfig>;
 
 export type AppAuthSchema = s.Static<typeof authConfigSchema>;
diff --git a/app/src/auth/authenticate/Authenticator.ts b/app/src/auth/authenticate/Authenticator.ts
index c383bcf4..72a7f959 100644
--- a/app/src/auth/authenticate/Authenticator.ts
+++ b/app/src/auth/authenticate/Authenticator.ts
@@ -8,7 +8,7 @@ import type { CookieOptions } from "hono/utils/cookie";
 import type { ServerEnv } from "modules/Controller";
 import { pick } from "lodash-es";
 import { InvalidConditionsException } from "auth/errors";
-import { s, parse } from "core/object/schema";
+import { s, parse, secret } from "core/object/schema";
 
 type Input = any; // workaround
 export type JWTPayload = Parameters<typeof sign>[0];
@@ -72,7 +72,7 @@ export const jwtConfig = s
    .object(
       {
          // @todo: autogenerate a secret if not present. But it must be persisted from AppAuth
-         secret: s.string({ default: "" }),
+         secret: secret({ default: "" }),
          alg: s.string({ enum: ["HS256", "HS384", "HS512"], default: "HS256" }).optional(),
          expires: s.number().optional(), // seconds
          issuer: s.string().optional(),
diff --git a/app/src/core/object/schema/index.ts b/app/src/core/object/schema/index.ts
index 036754c5..335e773f 100644
--- a/app/src/core/object/schema/index.ts
+++ b/app/src/core/object/schema/index.ts
@@ -3,6 +3,8 @@ import * as s from "jsonv-ts";
 export { validator as jsc, type Options } from "jsonv-ts/hono";
 export { describeRoute, schemaToSpec, openAPISpecs } from "jsonv-ts/hono";
 
+export { secret } from "./secret";
+
 export { s };
 
 export const stripMark = <O extends object>(o: O): O => o;
diff --git a/app/src/core/object/schema/secret.ts b/app/src/core/object/schema/secret.ts
new file mode 100644
index 00000000..d8f141b2
--- /dev/null
+++ b/app/src/core/object/schema/secret.ts
@@ -0,0 +1,7 @@
+import { StringSchema, type IStringOptions } from "jsonv-ts";
+
+export class SecretSchema<O extends IStringOptions> extends StringSchema<O> {}
+
+export const secret = <O extends IStringOptions>(o?: O) => {
+   return new SecretSchema(o);
+};
diff --git a/app/src/modules/server/SystemController.ts b/app/src/modules/server/SystemController.ts
index 4df29da5..c0eb6b06 100644
--- a/app/src/modules/server/SystemController.ts
+++ b/app/src/modules/server/SystemController.ts
@@ -17,6 +17,7 @@ import {
 import * as SystemPermissions from "modules/permissions";
 import { jsc, s, describeRoute, InvalidSchemaError } from "core/object/schema";
 import { getVersion } from "core/env";
+import { SecretSchema } from "core/object/schema/secret";
 
 export type ConfigUpdate<Key extends ModuleKey = ModuleKey> = {
    success: true;
@@ -318,6 +319,19 @@ export class SystemController extends Controller {
                   utc: datetimeStringUTC(),
                },
                plugins: Array.from(this.app.plugins.keys()),
+               walk: {
+                  auth: [
+                     ...c
+                        .get("app")
+                        .getSchema()
+                        .auth.walk({ data: c.get("app").toJSON(true).auth }),
+                  ]
+                     .filter((n) => n.schema instanceof SecretSchema)
+                     .map((n) => ({
+                        ...n,
+                        schema: n.schema.constructor.name,
+                     })),
+               },
             }),
       );