@onlineapps/conn-infra-secrets

Resolution connector for ctx.secrets.get(ref). Reads the encrypted Redis projection written by biz-meta (SecretBox) and decrypts it in-process with the injected AES-256-GCM master key. Authoritative store (oagen_meta.secret) is owned by biz-meta and never touched here. Projection key contract: state:meta:secret:<tenant>:<workspace|->:<ref>.

Canonical design: api/docs/architecture/secretbox.md.

Usage (wired by ServiceWrapper)

const SecretsConnector = require('@onlineapps/conn-infra-secrets');
const secrets = new SecretsConnector({ redisUrl: process.env.REDIS_URL, masterKeyBase64: process.env.SECRETS_MASTER_KEY });
await secrets.connect();
// ContextBuilder facade calls: secrets.get(ref, { tenant_id, workspace_id })

Handlers only ever call ctx.secrets.get(ref); the ContextBuilder facade injects the invocation scope.

Errors (no fallbacks)

• SECRET_NOT_FOUND — no projection for the ref/scope.
• SECRET_DECRYPT_FAILED — master key mismatch or corrupted blob.
• SECRET_SCOPE_MISSING / SECRET_REF_INVALID — bad call.

Test

npm run test:unit — decrypt round-trip, tamper/not-found, scope, mock.