Credential Isolation

// packages/execution-control/src/SessionCredentialVault.ts
interface SessionCredentialVault {
  issue(...): Promise<SessionCredential>;   // single-use, time-bounded lease
  consume(sessionCredentialId: string): Promise<ExecutionCredential>;  // only once
  revoke(sessionCredentialId: string): Promise<void>;
}

export interface CredentialProvider {
  readonly providerId: string;
  resolve(connectorId: string): Promise<CredentialHandle>;
}

// packages/execution-control/src/SessionCredentialVault.ts
async consume(sessionCredentialId: string): Promise<ExecutionCredential> {
  const record = /* ... */;
  if (record.revoked) {
    throw new Error(`Session credential has been revoked: ${sessionCredentialId}.`);
  }
  // ...
}

// packages/api/src/bootstrap/createHubSpotCredentialProvider.ts
class HubSpotEnvironmentCredentialProvider implements CredentialProvider {
  readonly providerId = "environment";

  async resolve(connectorId: string): Promise<CredentialHandle> {
    if (connectorId !== HUBSPOT_CONNECTOR_ID) {
      throw new Error(
        `HubSpotEnvironmentCredentialProvider cannot resolve credentials for connector "${connectorId}".`,
      );
    }

    const reference = process.env.HUBSPOT_PRIVATE_APP_TOKEN;

    if (reference === undefined) {
      throw new Error(
        `Environment variable HUBSPOT_PRIVATE_APP_TOKEN for connector "${HUBSPOT_CONNECTOR_ID}" is not set.`,
      );
    }

    const secrets = await SecretsProviderBootstrap.create();
    const privateAppToken = await secrets.getSecret(reference);

    return brandCredentialHandle({
      providerId: this.providerId,
      credentialId: "HUBSPOT_PRIVATE_APP_TOKEN",
      value: Object.freeze({ privateAppToken }),
    });
  }
}