feat(server): read Bitbucket and GitCafe credentials from a secret provider

apps/server/src/secrets/settingsSecretValue.ts

@@ -0,0 +1,13 @@
+import { isSecretReference, type SettingsSecretValue } from "@t3tools/contracts";
+import type * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as Effect from "effect/Effect";
+
+/** An unreadable secret comes back as `""`, so a credential that is missing behaves as unset. */
+export const resolveSettingsSecret = Effect.fn("SettingsSecrets.resolve")(function* (
+  resolver: SecretResolver.SecretResolver["Service"],
+  value: SettingsSecretValue,
+) {
+  if (!isSecretReference(value)) return value;
+  const [secret] = yield* resolver.read([value]);
+  return secret ?? "";
+});

apps/server/src/serverSettings.test.ts

@@ -1533,6 +1533,25 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         assert.isTrue(Option.isNone(yield* stored("bitbucket", "accessToken", null)));
         assert.isTrue(Option.isNone(yield* stored("github", "tokens", "github.com")));
         assert.isTrue(Option.isSome(yield* stored("github", "tokens", "ghe.acme.test")));
+
+        const reference = {
+          provider: SecretProviderId.make("personal"),
+          reference: "op://Private/Bitbucket/token",
+        };
+        yield* serverSettings.updateSettings({
+          sourceControlHosts: { bitbucket: { accessToken: "bb-access" } },
+        });
+        assert.isTrue(Option.isSome(yield* stored("bitbucket", "accessToken", null)));
+        const referenced = yield* serverSettings.updateSettings({
+          sourceControlHosts: { bitbucket: { accessToken: reference } },
+        });
+        assert.deepEqual(referenced.sourceControlHosts.bitbucket?.accessToken, reference);
+        assert.isTrue(Option.isNone(yield* stored("bitbucket", "accessToken", null)));
+        assert.deepEqual(
+          ServerSettingsModule.redactServerSettingsForClient(referenced).sourceControlHosts
+            .bitbucket?.accessToken,
+          reference,
+        );
       }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
 

apps/server/src/settingsSecrets.ts

@@ -6,6 +6,7 @@ import {
   type ServerSettings,
   SimlockDeviceHostConfig,
   UsageLimitSourceConfig,
+  isSecretReference,
   secretSettingsFields,
 } from "@t3tools/contracts";
 import { acpRegistryClient } from "@t3tools/provider-acp-registry/client";
@@ -60,7 +61,7 @@ export function mapSettingsSecrets(
   ) => {
     const next = { ...fields };
     for (const field of secretFields) {
-      if (!(field in next)) continue;
+      if (!(field in next) || isSecretReference(next[field])) continue;
       next[field] = writeSecretFieldValues(
         next[field],
         readSecretFieldValues(next[field]).map(([serverHost, value]) => {

apps/server/src/sourceControl/ServerSourceControlHost.ts

@@ -1,11 +1,15 @@
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 
+import * as SecretResolverLayer from "../secrets/SecretResolver.ts";
+import { resolveSettingsSecret } from "../secrets/settingsSecretValue.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import * as GitVcsDriver from "../vcs/GitVcsDriver.ts";
 import * as VcsDriverRegistry from "../vcs/VcsDriverRegistry.ts";
 import * as VcsProcess from "../vcs/VcsProcess.ts";
+import { resolveSourceControlHostSecrets } from "./sourceControlHostSecrets.ts";
 
 export const layer = Layer.effect(
   SourceControlHost.SourceControlHost,
@@ -14,8 +18,26 @@ export const layer = Layer.effect(
     const process = yield* VcsProcess.VcsProcess;
     const git = yield* GitVcsDriver.GitVcsDriver;
     const vcsRegistry = yield* VcsDriverRegistry.VcsDriverRegistry;
+    const secrets = yield* SecretResolver.SecretResolver;
     return SourceControlHost.SourceControlHost.of({
-      settings: { get: serverSettings.getSettings, update: serverSettings.updateSettings },
+      settings: {
+        get: serverSettings.getSettings,
+        getWithSecrets: (kind) =>
+          serverSettings.getSettings.pipe(
+            Effect.flatMap((settings) =>
+              resolveSourceControlHostSecrets(settings.sourceControlHosts, kind, (source) =>
+                resolveSettingsSecret(secrets, source),
+              ).pipe(
+                Effect.map((sourceControlHosts) =>
+                  sourceControlHosts === settings.sourceControlHosts
+                    ? settings
+                    : { ...settings, sourceControlHosts },
+                ),
+              ),
+            ),
+          ),
+        update: serverSettings.updateSettings,
+      },
       process: { run: process.run },
       git: {
         execute: git.execute,
@@ -35,4 +57,4 @@ export const layer = Layer.effect(
       },
     });
   }),
-);
+).pipe(Layer.provide(SecretResolverLayer.layer));

apps/server/src/sourceControl/sourceControlHostSecrets.test.ts

@@ -0,0 +1,62 @@
+import { assert, it } from "@effect/vitest";
+import { SecretProviderId } from "@t3tools/contracts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { resolveSettingsSecret } from "../secrets/settingsSecretValue.ts";
+import { resolveSourceControlHostSecrets } from "./sourceControlHostSecrets.ts";
+
+const source = (reference: string) => ({
+  provider: SecretProviderId.make("homelab"),
+  reference,
+});
+
+const secretsByReference = new Map([["bitbucket#token", "bb_from_provider"]]);
+
+const layerResolver = Layer.succeed(SecretResolver.SecretResolver, {
+  read: (references) =>
+    Effect.succeed(references.map((reference) => secretsByReference.get(reference.reference))),
+  invalidate: () => Effect.void,
+});
+
+const fakeResolver = SecretResolver.SecretResolver.use((resolver) => Effect.succeed(resolver));
+
+const hosts = {
+  bitbucket: { email: "me@example.test", accessToken: source("bitbucket#token") },
+  gitcafe: { token: source("missing#token") },
+  github: { tokens: { "github.com": "ghp_literal" } },
+};
+
+const countingResolver = Effect.gen(function* () {
+  const resolver = yield* fakeResolver;
+  const reads: Array<string> = [];
+  const resolve = (value: Parameters<typeof resolveSettingsSecret>[1]) =>
+    Effect.sync(() => {
+      if (typeof value !== "string") reads.push(value.reference);
+    }).pipe(Effect.andThen(resolveSettingsSecret(resolver, value)));
+  return { reads, resolve };
+});
+
+it.effect(
+  "replaces only the requested kind's credential references with the secrets they name",
+  () =>
+    Effect.gen(function* () {
+      const { reads, resolve } = yield* countingResolver;
+      const resolved = yield* resolveSourceControlHostSecrets(hosts, "bitbucket", resolve);
+      assert.deepEqual(resolved, {
+        ...hosts,
+        bitbucket: { email: "me@example.test", accessToken: "bb_from_provider" },
+      });
+      assert.deepEqual(reads, ["bitbucket#token"]);
+    }).pipe(Effect.provide(layerResolver)),
+);
+
+it.effect("leaves the resolver unused for a kind that holds no reference", () =>
+  Effect.gen(function* () {
+    const { reads, resolve } = yield* countingResolver;
+    const resolved = yield* resolveSourceControlHostSecrets(hosts, "github", resolve);
+    assert.strictEqual(resolved, hosts);
+    assert.deepEqual(reads, []);
+  }).pipe(Effect.provide(layerResolver)),
+);

apps/server/src/sourceControl/sourceControlHostSecrets.ts

@@ -1,4 +1,5 @@
-import { secretSettingsFields } from "@t3tools/contracts";
+import { isSecretReference, secretSettingsFields, type SecretReference } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
 
 import { sourceControlDefinitions } from "./sourceControlDefinitions.ts";
 
@@ -30,6 +31,7 @@ export function readSecretFieldValues(
   value: unknown,
 ): ReadonlyArray<readonly [serverHost: string | null, value: string]> {
   if (typeof value === "string") return [[null, value]];
+  if (isSecretReference(value)) return [];
   if (value === null || typeof value !== "object" || Array.isArray(value)) return [];
   return Object.entries(value).flatMap(([serverHost, entry]) =>
     typeof entry === "string" ? [[serverHost.trim().toLowerCase(), entry] as const] : [],
@@ -41,5 +43,28 @@ export function writeSecretFieldValues(
   values: ReadonlyArray<readonly [serverHost: string | null, value: string]>,
 ): unknown {
   if (typeof original === "string") return values[0]?.[1] ?? "";
+  if (isSecretReference(original)) return original;
   return Object.fromEntries(values.map(([serverHost, value]) => [serverHost ?? "", value]));
 }
+
+type SourceControlHostsSettings = Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+
+/** Replaces each secret provider reference in one host kind's credential fields with the secret it names. */
+export const resolveSourceControlHostSecrets = Effect.fn("SourceControlHost.resolveSecrets")(
+  function* <R>(
+    hosts: SourceControlHostsSettings,
+    kind: string,
+    resolve: (source: SecretReference) => Effect.Effect<string, never, R>,
+  ) {
+    const fields = hosts[kind] ?? {};
+    const pending = (SOURCE_CONTROL_HOST_SECRET_FIELDS.get(kind) ?? []).flatMap((field) => {
+      const value = fields[field];
+      return isSecretReference(value) ? [{ field, source: value }] : [];
+    });
+    if (pending.length === 0) return hosts;
+    const resolved = yield* Effect.forEach(pending, ({ field, source }) =>
+      resolve(source).pipe(Effect.map((value) => [field, value] as const)),
+    );
+    return { ...hosts, [kind]: { ...fields, ...Object.fromEntries(resolved) } };
+  },
+);

apps/web/src/components/settings/ProviderInstanceCard.tsx

@@ -487,7 +487,7 @@ export function ProviderEnvironmentSection(props: {
               <div className="flex min-w-0 flex-col gap-1.5 rounded-lg border p-2">
                 <div className="flex min-w-0 items-center gap-1.5">
                   {nameInput}
-                  {source === null ? null : <div className="w-48 shrink-0">{source}</div>}
+                  {source}
                   {removeButton}
                 </div>
                 <div className="flex min-w-0 items-start gap-1.5">

apps/web/src/components/settings/ProviderSettingsForm.tsx

@@ -2,11 +2,14 @@ import { useState, type ReactNode } from "react";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import {
+  isSecretReference,
   isSecretSetting,
+  type EnvironmentId,
   type ProviderSettingsFormAnnotation,
   type ProviderSettingsFormControl,
   type ProviderSettingsFormOption,
   type ProviderSettingsFormSchemaAnnotation,
+  type SecretReference,
 } from "@t3tools/contracts";
 import { PlusIcon, XIcon } from "lucide-react";
 
@@ -15,6 +18,7 @@ import { Button } from "../ui/button";
 import { DraftInput } from "../ui/draft-input";
 import { Input } from "../ui/input";
 import { SecretInput } from "./SecretInput";
+import { SecretSourceInput, useSecretSources } from "./SecretSourceInput";
 import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../ui/select";
 import { Switch } from "../ui/switch";
 import { Textarea } from "../ui/textarea";
@@ -281,11 +285,16 @@ function readProviderConfigBoolean(config: unknown, key: string, defaultValue =
 export function nextProviderConfigWithFieldValue(
   config: unknown,
   field: ProviderSettingsFieldModel,
-  value: string | boolean,
+  value: string | boolean | SecretReference,
 ): Record<string, unknown> | undefined {
   const base: Record<string, unknown> =
     config !== null && typeof config === "object" ? { ...(config as Record<string, unknown>) } : {};
 
+  if (typeof value === "object") {
+    base[field.key] = value;
+    return base;
+  }
+
   if (typeof value === "boolean") {
     const emptyBooleanValue = field.defaultBooleanValue ?? false;
     if (field.clearWhenEmpty === "omit" && value === emptyBooleanValue) {
@@ -311,6 +320,61 @@ interface ProviderSettingsFormProps {
   readonly idPrefix: string;
   readonly variant: "card" | "dialog" | "settings";
   readonly onChange: (nextConfig: Record<string, unknown> | undefined) => void;
+  /** Lets secret fields in the settings variant read from a secret provider on this environment. */
+  readonly environmentId?: EnvironmentId | undefined;
+}
+
+function SecretSettingsControl({
+  field,
+  value,
+  inputId,
+  descriptionId,
+  environmentId,
+  onChange,
+}: {
+  readonly field: ProviderSettingsFieldModel;
+  readonly value: unknown;
+  readonly inputId: string;
+  readonly descriptionId: string | undefined;
+  readonly environmentId: EnvironmentId;
+  readonly onChange: ProviderSettingsFormProps["onChange"];
+}) {
+  const sources = useSecretSources(environmentId);
+  const saved =
+    value !== null && typeof value === "object"
+      ? (value as Record<string, unknown>)[field.key]
+      : undefined;
+  const reference = isSecretReference(saved) ? saved : undefined;
+  const configured = reference !== undefined || (typeof saved === "string" && saved.length > 0);
+  return (
+    <div className="flex w-full min-w-0 items-start gap-2 @min-[32rem]/settings-row:w-80">
+      <SecretSourceInput
+        id={inputId}
+        aria-describedby={descriptionId}
+        aria-label={field.label}
+        size="sm"
+        className="min-w-0 flex-1"
+        value={reference ?? ""}
+        configured={reference === undefined && configured}
+        sources={sources}
+        onCommit={(next) => onChange(nextProviderConfigWithFieldValue(value, field, next))}
+        onSecretChange={(secret) =>
+          onChange(nextProviderConfigWithFieldValue(value, field, secret ?? ""))
+        }
+      />
+      {configured ? (
+        <Button
+          type="button"
+          size="icon-sm"
+          variant="ghost-destructive"
+          onClick={() => onChange(nextProviderConfigWithFieldValue(value, field, ""))}
+          aria-label={`Clear ${field.label}`}
+        >
+          <XIcon className="size-3.5" />
+        </Button>
+      ) : null}
+    </div>
+  );
 }
 
 function ProviderSettingsSelect({
@@ -370,6 +434,7 @@ interface ProviderSettingsFieldRowProps {
   readonly idPrefix: string;
   readonly variant: ProviderSettingsFormProps["variant"];
   readonly onChange: ProviderSettingsFormProps["onChange"];
+  readonly environmentId: EnvironmentId | undefined;
 }
 
 function ProviderSettingsFieldRow({
@@ -378,6 +443,7 @@ function ProviderSettingsFieldRow({
   idPrefix,
   variant,
   onChange,
+  environmentId,
 }: ProviderSettingsFieldRowProps) {
   const inputId = `${idPrefix}-${field.key}`;
   const descriptionClassName =
@@ -424,6 +490,15 @@ function ProviderSettingsFieldRow({
           placeholder={field.placeholder}
           spellCheck={false}
         />
+      ) : field.secret && environmentId !== undefined ? (
+        <SecretSettingsControl
+          field={field}
+          value={value}
+          inputId={inputId}
+          descriptionId={descriptionId}
+          environmentId={environmentId}
+          onChange={onChange}
+        />
       ) : field.secret ? (
         <div className="flex w-full min-w-0 items-center gap-2 @min-[32rem]/settings-row:w-56">
           <SecretInput
@@ -581,6 +656,7 @@ export function ProviderSettingsForm({
   idPrefix,
   variant,
   onChange,
+  environmentId,
 }: ProviderSettingsFormProps) {
   const fields = deriveProviderSettingsFields(definition, value);
   const isLocalAcp =
@@ -601,6 +677,7 @@ export function ProviderSettingsForm({
           idPrefix={idPrefix}
           variant={variant}
           onChange={onChange}
+          environmentId={environmentId}
         />
       ))}
       {isLocalAcp ? <ProviderCommandArguments value={value} onChange={onChange} /> : null}