构建密钥轮换服务

项目概述

本项目实现一个面向 secret lifecycle 的完整系统，核心要解决的问题是 rotating credentials on a schedule without exposing a window where old and new secrets disagree。整体由 Secret store、Rotation schedule、Dual-publish window、Consumer notifier、Rollback handler 五个模块组成，每个模块单一职责、可独立测试，最后通过集成测试验证端到端正确性。设计上把 a consumer that reads the secret during rotation and caches the old version indefinitely 作为第一类需求先行处理，而非事后再补。

架构与关键决策

数据模型为 a secret identified by a name and version, with a rotation window where two versions are valid until consumers ack the new one。Secret store 定义其余阶段共同依赖的数据形状并在边界处校验输入；Rotation schedule 承载 secret lifecycle 的正确性逻辑；Dual-publish window 专门处理 a consumer that reads the secret during rotation and caches the old version indefinitely，在失败路径上给出明确的拒绝、重试或降级策略；Consumer notifier 提供可观测性，每次操作输出带关联 id 的结构化事件；Rollback handler 在过载时按既定方式降级，避免过载演变为数据损坏。配置与代码分离，使风险变更可经 diff 审阅。

实施与测试

按五个阶段依次实现 Secret store、Rotation schedule、Dual-publish window、Consumer notifier、Rollback handler，每阶段配套聚焦单测。集成测试组合各模块并驱动真实 secret lifecycle 场景：先验证正常路径，再刻意触发 a consumer that reads the secret during rotation and caches the old version indefinitely 并断言系统降级而非损坏。所有依赖均在进程内或被桩替换，用例在 CI 中确定可复现。

限制与后续

• 单区域设计，多区域复制超出范围。
• Secret store 默认进程内，未水平共享。
• 无鉴权层，假定部署在强制身份的边缘之后。

代码示例

# setup for secrets-rotation-service
pnpm init
pnpm add fastify redis
pnpm add -D typescript tsx vitest

secrets_rotation_service/
├── src/index.ts
├── src/secret-store.ts
├── src/rotation-schedule.ts
├── tests/secrets_rotation_service.test.ts
└── package.json

// Secret store: secret lifecycle core
export function secretstore(input: SecretstoreInput): SecretstoreResult {
  // Build the secret store that anchors secret lifecycle and defines the core data shape.
  return processSecretstore(input);
}

// Rotation schedule — handles secret lifecycle Add the rotation schedule so
export class Rotationschedule {
  constructor(private opts: RotationscheduleOptions) {}
  async run(ctx: Context): Promise<RotationscheduleOutput> {
    return this.execute(ctx);
  }
}

// Dual-publish window: secret lifecycle stage
export const dualpublishwindow = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Consumer notifier for secret lifecycle
export async function consumernotifier(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Rollback handler: secret lifecycle finalization
export function rollbackhandler(state: State): Result {
  validate(state);
  return finalize(state);
}

# run the secret lifecycle test suite
pnpm vitest run