feat: add effect/Redacted

packages/shared/src/crypto.ts

@@ -1,6 +1,7 @@
 import * as Encoding from "effect/Encoding";
 import * as Hash from "effect/Hash";
 import * as Micro from "effect/Micro";
+import * as Redacted from "effect/Redacted";
 import SQIds, { defaultOptions } from "sqids";
 
 import { UploadThingError } from "./error";
@@ -27,13 +28,16 @@ function shuffle(str: string, seed: string) {
   return chars.join("");
 }
 
-export const signPayload = (payload: string, secret: string) =>
+export const signPayload = (
+  payload: string,
+  secret: Redacted.Redacted<string>,
+) =>
   Micro.gen(function* () {
     const signingKey = yield* Micro.tryPromise({
       try: () =>
         crypto.subtle.importKey(
           "raw",
-          encoder.encode(secret),
+          encoder.encode(Redacted.value(secret)),
           algorithm,
           false,
           ["sign"],
@@ -61,13 +65,13 @@ export const signPayload = (payload: string, secret: string) =>
 export const verifySignature = (
   payload: string,
   signature: string | null,
-  secret: string,
+  secret: Redacted.Redacted<string>,
 ) =>
   Micro.gen(function* () {
     const sig = signature?.slice(signaturePrefix.length);
     if (!sig) return false;
 
-    const secretBytes = encoder.encode(secret);
+    const secretBytes = encoder.encode(Redacted.value(secret));
     const signingKey = yield* Micro.promise(() =>
       crypto.subtle.importKey("raw", secretBytes, algorithm, false, ["verify"]),
     );
@@ -131,7 +135,7 @@ export const verifyKey = (key: string, appId: string) =>
 
 export const generateSignedURL = (
   url: string | URL,
-  secretKey: string,
+  secretKey: Redacted.Redacted<string>,
   opts: {
     ttlInSeconds?: Time | undefined;
     data?: Record<string, string | number | boolean | null | undefined>;

packages/shared/test/crypto.test.ts

@@ -1,6 +1,6 @@
 import { it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
-import * as Exit from "effect/Exit";
+import * as Redacted from "effect/Redacted";
 import { describe, expect } from "vitest";
 
 import {
@@ -14,7 +14,7 @@ import {
 describe("crypto sign / verify", () => {
   it.effect("signs and verifies a payload", () =>
     Effect.gen(function* () {
-      const secret = "foo-123";
+      const secret = Redacted.make("foo-123");
       const payload = "hello world";
 
       const sig = yield* signPayload(payload, secret);
@@ -26,7 +26,7 @@ describe("crypto sign / verify", () => {
 
   it.effect("doesn't verify a payload with a bad signature", () =>
     Effect.gen(function* () {
-      const secret = "foo-123";
+      const secret = Redacted.make("foo-123");
       const payload = "hello world";
 
       const sig = yield* signPayload(payload, secret);
@@ -38,11 +38,15 @@ describe("crypto sign / verify", () => {
 
   it.effect("doesn't verify a payload with a bad secret", () =>
     Effect.gen(function* () {
-      const secret = "foo-123";
+      const secret = Redacted.make("foo-123");
       const payload = "hello world";
 
       const sig = yield* signPayload(payload, secret);
-      const verified = yield* verifySignature(payload, sig, "bad");
+      const verified = yield* verifySignature(
+        payload,
+        sig,
+        Redacted.make("bad"),
+      );
 
       expect(verified).toBe(false);
     }),
@@ -51,7 +55,7 @@ describe("crypto sign / verify", () => {
   it.effect("generates a signed URL", () =>
     Effect.gen(function* () {
       const url = "https://example.com";
-      const secret = "foo-123";
+      const secret = Redacted.make("foo-123");
 
       const signedURL = yield* generateSignedURL(url, secret, {
         ttlInSeconds: 60 * 60,
@@ -67,7 +71,7 @@ describe("crypto sign / verify", () => {
   it.effect("generates and verifies a signed URL", () =>
     Effect.gen(function* () {
       const url = "https://example.com";
-      const secret = "foo-123";
+      const secret = Redacted.make("foo-123");
 
       const signedURL = yield* generateSignedURL(url, secret, {
         ttlInSeconds: 60 * 60,

packages/uploadthing/src/internal/config.test.ts

@@ -4,6 +4,7 @@ import { it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
 import { afterEach, beforeEach, describe, expect } from "vitest";
 
 import { UploadThingError } from "@uploadthing/shared";
@@ -12,12 +13,12 @@ import { configProvider, IngestUrl, IsDevelopment, UTToken } from "./config";
 import { ParsedToken, UploadThingToken } from "./shared-schemas";
 
 const app1TokenData = {
-  apiKey: "sk_foo",
+  apiKey: Redacted.make("sk_foo"),
   appId: "app-1",
   regions: ["fra1"] as const,
 };
 const app2TokenData = {
-  apiKey: "sk_bar",
+  apiKey: Redacted.make("sk_bar"),
   appId: "app-2",
   regions: ["dub1"] as const,
 };

packages/uploadthing/src/internal/handler.ts

@@ -16,6 +16,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as ManagedRuntime from "effect/ManagedRuntime";
 import * as Match from "effect/Match";
+import * as Redacted from "effect/Redacted";
 
 import {
   fillInputRouteConfig,
@@ -373,7 +374,7 @@ const handleCallbackRequest = (opts: {
       yield* HttpClientRequest.post(`/callback-result`).pipe(
         HttpClientRequest.prependUrl(baseUrl),
         HttpClientRequest.setHeaders({
-          "x-uploadthing-api-key": apiKey,
+          "x-uploadthing-api-key": Redacted.value(apiKey),
           "x-uploadthing-version": pkgJson.version,
           "x-uploadthing-be-adapter": beAdapter,
           "x-uploadthing-fe-package": fePackage,
@@ -602,7 +603,7 @@ const handleUploadAction = (opts: {
     const metadataRequest = HttpClientRequest.post("/route-metadata").pipe(
       HttpClientRequest.prependUrl(ingestUrl),
       HttpClientRequest.setHeaders({
-        "x-uploadthing-api-key": apiKey,
+        "x-uploadthing-api-key": Redacted.value(apiKey),
         "x-uploadthing-version": pkgJson.version,
         "x-uploadthing-be-adapter": beAdapter,
         "x-uploadthing-fe-package": fePackage,

packages/uploadthing/src/internal/jsonl.test.ts

@@ -1,6 +1,7 @@
 import { it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
+import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import { beforeEach, describe, expect, vi } from "vitest";
 
@@ -13,7 +14,8 @@ const te = new TextEncoder();
 
 const createChunk = (_payload: unknown) => {
   const payload = JSON.stringify(_payload);
-  return Effect.map(signPayload(payload, "sk_123"), (signature) =>
+  const secret = Redacted.make("sk_123");
+  return Effect.map(signPayload(payload, secret), (signature) =>
     JSON.stringify(
       MetadataFetchStreamPart.make({ payload, signature, hook: "callback" }),
     ),

packages/uploadthing/src/internal/shared-schemas.ts

@@ -28,7 +28,7 @@ const DecodeString = S.transform(S.Uint8ArrayFromSelf, S.String, {
 });
 
 export const ParsedToken = S.Struct({
-  apiKey: S.String.pipe(S.startsWith("sk_")),
+  apiKey: S.Redacted(S.String.pipe(S.startsWith("sk_"))), 
   appId: S.String,
   regions: S.NonEmptyArray(S.String),
   ingestHost: S.String.pipe(

packages/uploadthing/src/sdk/index.ts

@@ -9,6 +9,7 @@ import * as Arr from "effect/Array";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Predicate from "effect/Predicate";
+import * as Redacted from "effect/Redacted";
 
 import type {
   ACL,
@@ -75,7 +76,7 @@ export class UTApi {
         HttpClientRequest.setHeaders({
           "x-uploadthing-version": UPLOADTHING_VERSION,
           "x-uploadthing-be-adapter": "server-sdk",
-          "x-uploadthing-api-key": apiKey,
+          "x-uploadthing-api-key": Redacted.value(apiKey),
         }),
         HttpClient.filterStatusOk(httpClient),
         Effect.tapBoth({

packages/uploadthing/test/__test-helpers.ts

@@ -1,4 +1,5 @@
 import * as S from "@effect/schema/Schema";
+import * as Redacted from "effect/Redacted";
 import type { StrictRequest } from "msw";
 import { http, HttpResponse } from "msw";
 import { setupServer } from "msw/node";
@@ -17,7 +18,7 @@ export const uploadCompleteMock = vi.fn();
 export const onErrorMock = vi.fn();
 
 const tokenData = {
-  apiKey: "sk_foo",
+  apiKey: Redacted.make("sk_foo"),
   appId: "app-1",
   regions: ["fra1"] as const,
 };

packages/uploadthing/test/request-handler.test.ts

@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 import { describe, expect } from "vitest";
 import { z } from "zod";
 
@@ -418,7 +419,7 @@ describe(".onUploadComplete()", () => {
       }),
     });
     const signature = await Effect.runPromise(
-      signPayload(payload, "sk_live_badkey"),
+      signPayload(payload, Redacted.make("sk_live_badkey")),
     );
 
     const res = await handler(