feat(server): read Bitbucket and GitCafe credentials from a secret provider

apps/server/src/secrets/settingsSecretValue.ts

@@ -0,0 +1,12 @@
+import { isSecretReference, type SettingsSecretValue } from "@t3tools/contracts";
+import type * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as Effect from "effect/Effect";
+
+/** An unreadable secret comes back as `""`, so a credential that is missing behaves as unset. */
+export const resolveSettingsSecret = (
+  resolver: SecretResolver.SecretResolver["Service"],
+  value: SettingsSecretValue,
+): Effect.Effect<string> =>
+  !isSecretReference(value)
+    ? Effect.succeed(value)
+    : resolver.read([value]).pipe(Effect.map(([secret]) => secret ?? ""));

apps/server/src/serverSettings.test.ts

@@ -1536,6 +1536,35 @@ it.layer(NodeServices.layer)("server settings", (it) => {
       }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
 
+  it.effect("keeps a credential reference as written and drops the literal it replaces", () =>
+    Effect.gen(function* () {
+      const serverSettings = yield* ServerSettingsModule.ServerSettingsService;
+      const secrets = yield* ServerSecretStore.ServerSecretStore;
+      const reference = {
+        provider: SecretProviderId.make("personal"),
+        reference: "op://Private/Bitbucket/token",
+      };
+      const stored = (kind: string, field: string) =>
+        secrets.get(sourceControlHostSecretName({ kind, field, serverHost: null }));
+
+      yield* serverSettings.updateSettings({
+        sourceControlHosts: { bitbucket: { accessToken: "bb-access" } },
+      });
+      assert.isTrue(Option.isSome(yield* stored("bitbucket", "accessToken")));
+
+      const saved = yield* serverSettings.updateSettings({
+        sourceControlHosts: { bitbucket: { accessToken: reference } },
+      });
+      assert.deepEqual(saved.sourceControlHosts.bitbucket?.accessToken, reference);
+      assert.isTrue(Option.isNone(yield* stored("bitbucket", "accessToken")));
+      assert.deepEqual(
+        ServerSettingsModule.redactServerSettingsForClient(saved).sourceControlHosts.bitbucket
+          ?.accessToken,
+        reference,
+      );
+    }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
+  );
+
   it.effect("keeps the retired keys for another load when a token cannot be copied", () => {
     const cause = new ServerSecretStore.SecretStoreReadError({
       resource: "bitbucket-access-token",

apps/server/src/settingsSecrets.ts

@@ -6,6 +6,7 @@ import {
   type ServerSettings,
   SimlockDeviceHostConfig,
   UsageLimitSourceConfig,
+  isSecretReference,
   secretSettingsFields,
 } from "@t3tools/contracts";
 import { acpRegistryClient } from "@t3tools/provider-acp-registry/client";
@@ -60,7 +61,7 @@ export function mapSettingsSecrets(
   ) => {
     const next = { ...fields };
     for (const field of secretFields) {
-      if (!(field in next)) continue;
+      if (!(field in next) || isSecretReference(next[field])) continue;
       next[field] = writeSecretFieldValues(
         next[field],
         readSecretFieldValues(next[field]).map(([serverHost, value]) => {

apps/server/src/sourceControl/ServerSourceControlHost.ts

@@ -1,11 +1,15 @@
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 
+import * as SecretResolverLayer from "../secrets/SecretResolver.ts";
+import { resolveSettingsSecret } from "../secrets/settingsSecretValue.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import * as GitVcsDriver from "../vcs/GitVcsDriver.ts";
 import * as VcsDriverRegistry from "../vcs/VcsDriverRegistry.ts";
 import * as VcsProcess from "../vcs/VcsProcess.ts";
+import { resolveSourceControlHostSecrets } from "./sourceControlHostSecrets.ts";
 
 export const layer = Layer.effect(
   SourceControlHost.SourceControlHost,
@@ -14,8 +18,24 @@ export const layer = Layer.effect(
     const process = yield* VcsProcess.VcsProcess;
     const git = yield* GitVcsDriver.GitVcsDriver;
     const vcsRegistry = yield* VcsDriverRegistry.VcsDriverRegistry;
+    const secrets = yield* SecretResolver.SecretResolver;
     return SourceControlHost.SourceControlHost.of({
-      settings: { get: serverSettings.getSettings, update: serverSettings.updateSettings },
+      settings: {
+        get: serverSettings.getSettings.pipe(
+          Effect.flatMap((settings) =>
+            resolveSourceControlHostSecrets(settings.sourceControlHosts, (source) =>
+              resolveSettingsSecret(secrets, source),
+            ).pipe(
+              Effect.map((sourceControlHosts) =>
+                sourceControlHosts === settings.sourceControlHosts
+                  ? settings
+                  : { ...settings, sourceControlHosts },
+              ),
+            ),
+          ),
+        ),
+        update: serverSettings.updateSettings,
+      },
       process: { run: process.run },
       git: {
         execute: git.execute,
@@ -35,4 +55,4 @@ export const layer = Layer.effect(
       },
     });
   }),
-);
+).pipe(Layer.provide(SecretResolverLayer.layer));

apps/server/src/sourceControl/sourceControlHostSecrets.test.ts

@@ -0,0 +1,51 @@
+import { assert, it } from "@effect/vitest";
+import { SecretProviderId } from "@t3tools/contracts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { resolveSettingsSecret } from "../secrets/settingsSecretValue.ts";
+import { resolveSourceControlHostSecrets } from "./sourceControlHostSecrets.ts";
+
+const source = (reference: string) => ({
+  provider: SecretProviderId.make("homelab"),
+  reference,
+});
+
+const secretsByReference = new Map([["bitbucket#token", "bb_from_provider"]]);
+
+const layerResolver = Layer.succeed(SecretResolver.SecretResolver, {
+  read: (references) =>
+    Effect.succeed(references.map((reference) => secretsByReference.get(reference.reference))),
+  invalidate: () => Effect.void,
+});
+
+const fakeResolver = SecretResolver.SecretResolver.use((resolver) => Effect.succeed(resolver));
+
+it.effect("replaces credential references with the secrets they name", () =>
+  Effect.gen(function* () {
+    const resolver = yield* fakeResolver;
+    const hosts = {
+      bitbucket: { email: "me@example.test", accessToken: source("bitbucket#token") },
+      gitcafe: { token: source("missing#token") },
+    };
+    const resolved = yield* resolveSourceControlHostSecrets(hosts, (value) =>
+      resolveSettingsSecret(resolver, value),
+    );
+    assert.deepEqual(resolved, {
+      bitbucket: { email: "me@example.test", accessToken: "bb_from_provider" },
+      gitcafe: { token: "" },
+    });
+  }).pipe(Effect.provide(layerResolver)),
+);
+
+it.effect("hands back the same settings when no credential names a secret", () =>
+  Effect.gen(function* () {
+    const resolver = yield* fakeResolver;
+    const hosts = { gitcafe: { token: "literal" } };
+    const resolved = yield* resolveSourceControlHostSecrets(hosts, (value) =>
+      resolveSettingsSecret(resolver, value),
+    );
+    assert.strictEqual(resolved, hosts);
+  }).pipe(Effect.provide(layerResolver)),
+);

apps/server/src/sourceControl/sourceControlHostSecrets.ts

@@ -1,4 +1,5 @@
-import { secretSettingsFields } from "@t3tools/contracts";
+import { isSecretReference, secretSettingsFields, type SecretReference } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
 
 import { sourceControlDefinitions } from "./sourceControlDefinitions.ts";
 
@@ -30,6 +31,7 @@ export function readSecretFieldValues(
   value: unknown,
 ): ReadonlyArray<readonly [serverHost: string | null, value: string]> {
   if (typeof value === "string") return [[null, value]];
+  if (isSecretReference(value)) return [];
   if (value === null || typeof value !== "object" || Array.isArray(value)) return [];
   return Object.entries(value).flatMap(([serverHost, entry]) =>
     typeof entry === "string" ? [[serverHost.trim().toLowerCase(), entry] as const] : [],
@@ -41,5 +43,31 @@ export function writeSecretFieldValues(
   values: ReadonlyArray<readonly [serverHost: string | null, value: string]>,
 ): unknown {
   if (typeof original === "string") return values[0]?.[1] ?? "";
+  if (isSecretReference(original)) return original;
   return Object.fromEntries(values.map(([serverHost, value]) => [serverHost ?? "", value]));
 }
+
+type SourceControlHostsSettings = Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+
+/** Replaces each secret provider reference in a credential field with the secret it names. */
+export function resolveSourceControlHostSecrets<R>(
+  hosts: SourceControlHostsSettings,
+  resolve: (source: SecretReference) => Effect.Effect<string, never, R>,
+): Effect.Effect<SourceControlHostsSettings, never, R> {
+  const pending = Object.entries(hosts).flatMap(([kind, fields]) =>
+    (SOURCE_CONTROL_HOST_SECRET_FIELDS.get(kind) ?? []).flatMap((field) => {
+      const value = fields[field];
+      return isSecretReference(value) ? [{ kind, field, source: value }] : [];
+    }),
+  );
+  if (pending.length === 0) return Effect.succeed(hosts);
+  return Effect.forEach(pending, ({ kind, field, source }) =>
+    resolve(source).pipe(Effect.map((value) => ({ kind, field, value }))),
+  ).pipe(
+    Effect.map((fields) => {
+      const next: Record<string, Readonly<Record<string, unknown>>> = { ...hosts };
+      for (const { kind, field, value } of fields) next[kind] = { ...next[kind], [field]: value };
+      return next;
+    }),
+  );
+}

apps/web/src/components/settings/ProviderInstanceCard.tsx

@@ -487,7 +487,7 @@ export function ProviderEnvironmentSection(props: {
               <div className="flex min-w-0 flex-col gap-1.5 rounded-lg border p-2">
                 <div className="flex min-w-0 items-center gap-1.5">
                   {nameInput}
-                  {source === null ? null : <div className="w-48 shrink-0">{source}</div>}
+                  {source}
                   {removeButton}
                 </div>
                 <div className="flex min-w-0 items-start gap-1.5">

apps/web/src/components/settings/ProviderSettingsForm.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vite-plus/test";
-import { makeProviderSettingsSchema, ProviderDriverKind, TrimmedString } from "@t3tools/contracts";
+import {
+  makeProviderSettingsSchema,
+  ProviderDriverKind,
+  SecretProviderId,
+  TrimmedString,
+} from "@t3tools/contracts";
 import * as Schema from "effect/Schema";
 
 import { providerClients } from "./providerDriverMeta";
@@ -56,6 +61,27 @@ describe("ProviderSettingsForm helpers", () => {
 
     expect(next).toEqual({ experimental: false });
   });
+
+  it("stores a secret reference as written", () => {
+    const reference = {
+      provider: SecretProviderId.make("personal"),
+      reference: "op://Private/Bitbucket/token",
+    };
+
+    const next = nextProviderConfigWithFieldValue(
+      { email: "me@example.com" },
+      {
+        key: "accessToken",
+        control: "password",
+        label: "Access token",
+        secret: true,
+        clearWhenEmpty: "omit",
+      },
+      reference,
+    );
+
+    expect(next).toEqual({ email: "me@example.com", accessToken: reference });
+  });
 });
 
 describe("reconcileRowsDraft", () => {