11package vault
22
33import (
4+ "context"
45 "fmt"
56
67 "github.com/smartcontractkit/chainlink-common/pkg/capabilities/actions/vault"
@@ -39,11 +40,11 @@ func NewKVStoreWrapper(store WriteKVStore, migrationEnabled bool, lggr logger.Lo
3940
4041// GetSecret tries orgID first, falling back to workflowOwner for legacy entries.
4142// When migration is disabled, delegates directly to the inner store using id as-is.
42- func (w * KVStoreWrapper ) GetSecret (id * vault.SecretIdentifier , orgID , workflowOwner string ) (* vault.StoredSecret , error ) {
43+ func (w * KVStoreWrapper ) GetSecret (ctx context. Context , id * vault.SecretIdentifier , orgID , workflowOwner string ) (* vault.StoredSecret , error ) {
4344 if ! w .migrationEnabled {
44- return w .store .GetSecret (id )
45+ return w .store .GetSecret (ctx , id )
4546 }
46- return w .adapter .getSecret (id , orgID , workflowOwner )
47+ return w .adapter .getSecret (ctx , id , orgID , workflowOwner )
4748}
4849
4950// GetMetadata merges metadata from both orgID and workflowOwner, deduplicating
@@ -54,61 +55,61 @@ func (w *KVStoreWrapper) GetSecret(id *vault.SecretIdentifier, orgID, workflowOw
5455// namespace::key collapses entries that exist under both owners (transient
5556// mid-migration state) into a single entry, so the result reflects the true
5657// number of unique secrets the owner has.
57- func (w * KVStoreWrapper ) GetMetadata (orgID , workflowOwner string ) (* vault.StoredMetadata , error ) {
58+ func (w * KVStoreWrapper ) GetMetadata (ctx context. Context , orgID , workflowOwner string ) (* vault.StoredMetadata , error ) {
5859 if ! w .migrationEnabled {
59- return w .store .GetMetadata (orgID )
60+ return w .store .GetMetadata (ctx , orgID )
6061 }
61- return w .adapter .getMetadata (orgID , workflowOwner )
62+ return w .adapter .getMetadata (ctx , orgID , workflowOwner )
6263}
6364
6465// GetSecretIdentifiersCountForOwner returns the count of unique secrets across
6566// both orgID and workflowOwner after deduplication.
6667// When migration is disabled, delegates directly to the inner store using orgID.
67- func (w * KVStoreWrapper ) GetSecretIdentifiersCountForOwner (orgID , workflowOwner string ) (int , error ) {
68+ func (w * KVStoreWrapper ) GetSecretIdentifiersCountForOwner (ctx context. Context , orgID , workflowOwner string ) (int , error ) {
6869 if ! w .migrationEnabled {
69- return w .store .GetSecretIdentifiersCountForOwner (orgID )
70+ return w .store .GetSecretIdentifiersCountForOwner (ctx , orgID )
7071 }
71- return w .adapter .getSecretIdentifiersCountForOwner (orgID , workflowOwner )
72+ return w .adapter .getSecretIdentifiersCountForOwner (ctx , orgID , workflowOwner )
7273}
7374
7475// WriteSecret writes the secret under orgID. If a legacy entry exists under
7576// workflowOwner with the same namespace/key, it is deleted (lazy migration).
7677// When migration is disabled, delegates directly to the inner store.
77- func (w * KVStoreWrapper ) WriteSecret (id * vault.SecretIdentifier , secret * vault.StoredSecret , orgID , workflowOwner string ) error {
78+ func (w * KVStoreWrapper ) WriteSecret (ctx context. Context , id * vault.SecretIdentifier , secret * vault.StoredSecret , orgID , workflowOwner string ) error {
7879 if ! w .migrationEnabled {
79- return w .store .WriteSecret (id , secret )
80+ return w .store .WriteSecret (ctx , id , secret )
8081 }
81- return w .adapter .writeSecret (id , secret , orgID , workflowOwner )
82+ return w .adapter .writeSecret (ctx , id , secret , orgID , workflowOwner )
8283}
8384
8485// WriteMetadata writes metadata under orgID.
8586// When migration is disabled, delegates directly to the inner store.
86- func (w * KVStoreWrapper ) WriteMetadata (orgID string , metadata * vault.StoredMetadata ) error {
87+ func (w * KVStoreWrapper ) WriteMetadata (ctx context. Context , orgID string , metadata * vault.StoredMetadata ) error {
8788 if ! w .migrationEnabled {
88- return w .store .WriteMetadata (orgID , metadata )
89+ return w .store .WriteMetadata (ctx , orgID , metadata )
8990 }
90- return w .adapter .writeMetadata (orgID , metadata )
91+ return w .adapter .writeMetadata (ctx , orgID , metadata )
9192}
9293
9394// DeleteSecret deletes the secret from orgID if present, falling back to
9495// workflowOwner for legacy entries. If the secret exists under both owners
9596// (transient mid-migration state), both entries are deleted.
9697// When migration is disabled, delegates directly to the inner store.
97- func (w * KVStoreWrapper ) DeleteSecret (id * vault.SecretIdentifier , orgID , workflowOwner string ) error {
98+ func (w * KVStoreWrapper ) DeleteSecret (ctx context. Context , id * vault.SecretIdentifier , orgID , workflowOwner string ) error {
9899 if ! w .migrationEnabled {
99- return w .store .DeleteSecret (id )
100+ return w .store .DeleteSecret (ctx , id )
100101 }
101- return w .adapter .deleteSecret (id , orgID , workflowOwner )
102+ return w .adapter .deleteSecret (ctx , id , orgID , workflowOwner )
102103}
103104
104105// GetPendingQueue is always a pass-through (pending queue is not owner-scoped).
105- func (w * KVStoreWrapper ) GetPendingQueue () ([]* vault.StoredPendingQueueItem , error ) {
106- return w .store .GetPendingQueue ()
106+ func (w * KVStoreWrapper ) GetPendingQueue (ctx context. Context ) ([]* vault.StoredPendingQueueItem , error ) {
107+ return w .store .GetPendingQueue (ctx )
107108}
108109
109110// WritePendingQueue is always a pass-through (pending queue is not owner-scoped).
110- func (w * KVStoreWrapper ) WritePendingQueue (pending []* vault.StoredPendingQueueItem ) error {
111- return w .store .WritePendingQueue (pending )
111+ func (w * KVStoreWrapper ) WritePendingQueue (ctx context. Context , pending []* vault.StoredPendingQueueItem ) error {
112+ return w .store .WritePendingQueue (ctx , pending )
112113}
113114
114115// ownerMigrationAdapter handles the migration of secrets from workflow_owner-keyed
@@ -124,13 +125,13 @@ func newOwnerMigrationAdapter(store WriteKVStore, lggr logger.Logger) *ownerMigr
124125 return & ownerMigrationAdapter {store : store , lggr : lggr }
125126}
126127
127- func (a * ownerMigrationAdapter ) getSecret (id * vault.SecretIdentifier , orgID , workflowOwner string ) (* vault.StoredSecret , error ) {
128+ func (a * ownerMigrationAdapter ) getSecret (ctx context. Context , id * vault.SecretIdentifier , orgID , workflowOwner string ) (* vault.StoredSecret , error ) {
128129 if id == nil {
129- return a .store .GetSecret (id )
130+ return a .store .GetSecret (ctx , id )
130131 }
131132
132133 orgIDSid := withOwner (id , orgID )
133- secret , err := a .store .GetSecret (orgIDSid )
134+ secret , err := a .store .GetSecret (ctx , orgIDSid )
134135 if err != nil {
135136 return nil , err
136137 }
@@ -143,11 +144,11 @@ func (a *ownerMigrationAdapter) getSecret(id *vault.SecretIdentifier, orgID, wor
143144 }
144145
145146 woSid := withOwner (id , workflowOwner )
146- return a .store .GetSecret (woSid )
147+ return a .store .GetSecret (ctx , woSid )
147148}
148149
149- func (a * ownerMigrationAdapter ) getMetadata (orgID , workflowOwner string ) (* vault.StoredMetadata , error ) {
150- orgMd , err := a .store .GetMetadata (orgID )
150+ func (a * ownerMigrationAdapter ) getMetadata (ctx context. Context , orgID , workflowOwner string ) (* vault.StoredMetadata , error ) {
151+ orgMd , err := a .store .GetMetadata (ctx , orgID )
151152 if err != nil {
152153 return nil , err
153154 }
@@ -156,16 +157,16 @@ func (a *ownerMigrationAdapter) getMetadata(orgID, workflowOwner string) (*vault
156157 return orgMd , nil
157158 }
158159
159- woMd , err := a .store .GetMetadata (workflowOwner )
160+ woMd , err := a .store .GetMetadata (ctx , workflowOwner )
160161 if err != nil {
161162 return nil , err
162163 }
163164
164165 return mergeMetadata (orgMd , woMd , orgID , a .lggr ), nil
165166}
166167
167- func (a * ownerMigrationAdapter ) getSecretIdentifiersCountForOwner (orgID , workflowOwner string ) (int , error ) {
168- md , err := a .getMetadata (orgID , workflowOwner )
168+ func (a * ownerMigrationAdapter ) getSecretIdentifiersCountForOwner (ctx context. Context , orgID , workflowOwner string ) (int , error ) {
169+ md , err := a .getMetadata (ctx , orgID , workflowOwner )
169170 if err != nil {
170171 return 0 , err
171172 }
@@ -175,13 +176,13 @@ func (a *ownerMigrationAdapter) getSecretIdentifiersCountForOwner(orgID, workflo
175176 return len (md .SecretIdentifiers ), nil
176177}
177178
178- func (a * ownerMigrationAdapter ) writeSecret (id * vault.SecretIdentifier , secret * vault.StoredSecret , orgID , workflowOwner string ) error {
179+ func (a * ownerMigrationAdapter ) writeSecret (ctx context. Context , id * vault.SecretIdentifier , secret * vault.StoredSecret , orgID , workflowOwner string ) error {
179180 if id == nil {
180- return a .store .WriteSecret (id , secret )
181+ return a .store .WriteSecret (ctx , id , secret )
181182 }
182183
183184 orgIDSid := withOwner (id , orgID )
184- if err := a .store .WriteSecret (orgIDSid , secret ); err != nil {
185+ if err := a .store .WriteSecret (ctx , orgIDSid , secret ); err != nil {
185186 return err
186187 }
187188
@@ -190,45 +191,45 @@ func (a *ownerMigrationAdapter) writeSecret(id *vault.SecretIdentifier, secret *
190191 }
191192
192193 woSid := withOwner (id , workflowOwner )
193- legacySecret , err := a .store .GetSecret (woSid )
194+ legacySecret , err := a .store .GetSecret (ctx , woSid )
194195 if err != nil {
195196 return fmt .Errorf ("failed to check for legacy entry during write: %w" , err )
196197 }
197198 if legacySecret != nil {
198- if err := a .store .DeleteSecret (woSid ); err != nil {
199+ if err := a .store .DeleteSecret (ctx , woSid ); err != nil {
199200 return fmt .Errorf ("failed to delete legacy entry during migration: %w" , err )
200201 }
201202 }
202203
203204 return nil
204205}
205206
206- func (a * ownerMigrationAdapter ) writeMetadata (orgID string , metadata * vault.StoredMetadata ) error {
207- return a .store .WriteMetadata (orgID , metadata )
207+ func (a * ownerMigrationAdapter ) writeMetadata (ctx context. Context , orgID string , metadata * vault.StoredMetadata ) error {
208+ return a .store .WriteMetadata (ctx , orgID , metadata )
208209}
209210
210- func (a * ownerMigrationAdapter ) deleteSecret (id * vault.SecretIdentifier , orgID , workflowOwner string ) error {
211+ func (a * ownerMigrationAdapter ) deleteSecret (ctx context. Context , id * vault.SecretIdentifier , orgID , workflowOwner string ) error {
211212 if id == nil {
212- return a .store .DeleteSecret (id )
213+ return a .store .DeleteSecret (ctx , id )
213214 }
214215
215216 orgIDSid := withOwner (id , orgID )
216- orgSecret , err := a .store .GetSecret (orgIDSid )
217+ orgSecret , err := a .store .GetSecret (ctx , orgIDSid )
217218 if err != nil {
218219 return fmt .Errorf ("failed to check org_id entry for deletion: %w" , err )
219220 }
220221 if orgSecret != nil {
221- if err := a .store .DeleteSecret (orgIDSid ); err != nil {
222+ if err := a .store .DeleteSecret (ctx , orgIDSid ); err != nil {
222223 return fmt .Errorf ("failed to delete org_id entry: %w" , err )
223224 }
224225 if needsMigration (orgID , workflowOwner ) {
225226 woSid := withOwner (id , workflowOwner )
226- woSecret , woErr := a .store .GetSecret (woSid )
227+ woSecret , woErr := a .store .GetSecret (ctx , woSid )
227228 if woErr != nil {
228229 return fmt .Errorf ("failed to check legacy entry after org_id deletion: %w" , woErr )
229230 }
230231 if woSecret != nil {
231- if woErr = a .store .DeleteSecret (woSid ); woErr != nil {
232+ if woErr = a .store .DeleteSecret (ctx , woSid ); woErr != nil {
232233 return fmt .Errorf ("failed to clean up legacy entry after org_id deletion: %w" , woErr )
233234 }
234235 }
@@ -238,18 +239,18 @@ func (a *ownerMigrationAdapter) deleteSecret(id *vault.SecretIdentifier, orgID,
238239
239240 if needsMigration (orgID , workflowOwner ) {
240241 woSid := withOwner (id , workflowOwner )
241- woSecret , woErr := a .store .GetSecret (woSid )
242+ woSecret , woErr := a .store .GetSecret (ctx , woSid )
242243 if woErr != nil {
243244 return fmt .Errorf ("failed to check legacy entry for deletion: %w" , woErr )
244245 }
245246 if woSecret != nil {
246- return a .store .DeleteSecret (woSid )
247+ return a .store .DeleteSecret (ctx , woSid )
247248 }
248249 }
249250
250251 // Not found under either owner — delegate to inner which will produce
251252 // the appropriate error from metadata removal.
252- return a .store .DeleteSecret (orgIDSid )
253+ return a .store .DeleteSecret (ctx , orgIDSid )
253254}
254255
255256// --- shared helpers ---
0 commit comments