dotenv-secretsmanager 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aff4454079cc1d1cbb65a127d128f185343e0f68527fea618e2939282db02a60
-  data.tar.gz: 570fb3b58c722c78f5d38ba24657cf299463256e78bd4fffd9832b34e760c330
+  metadata.gz: 1179b709da58d9aaf2a856a5a1231036f53151846e30a7767cb04944d1ecbbc4
+  data.tar.gz: 439b0ebd08d2a4056ff1cb7d4fdb017fb92f0a9b82f30ae0315452e6b4e52bef
 SHA512:
-  metadata.gz: f59d0999d3ce01cf9d4cc3a0afcda6eacf66b4ee89ee60d0108b2cf895c1deb9ddc99ea0c45b5b08dc02627edf292b97f788326603f40884a5bcd29efd5114e2
-  data.tar.gz: af7e008123e0b98461a01091d49d69deb4c9d994eba3f34c0b6e30e55959b1a6b9bfd0e1a00d5b453a399b804a88965fae5e83892d01e6b007cda74604bf60ca
+  metadata.gz: 8e45f5ef7022f70044e3608839c9a518b6269f530206f9e8d2e13f6d7f0a4adf579448733c7bee5120250019fd869aa08ab9a133c7bed24652fb5dd89fb48ddc
+  data.tar.gz: 15f96a1c520ccc704909758ef8c38845000d33b17f246d0f9bb840cd33dc1b2b819bc564bcd436f290ceba18e72914b7bc54c07b8c315066591d16ba6c3d09b3

data/README.md

@@ -61,6 +61,43 @@ end
 Credentials and region come from the standard AWS SDK credential chain. The gem
 makes zero AWS calls and builds no client when no references are present.
 
+## Skipping resolution
+
+Set the `DOTENV_SECRETSMANAGER_SKIP` env var (or `configuration.skip`) to skip
+resolution: no AWS calls and no client constructed. Instead of resolving them,
+`resolve!` **removes** every `ENV` key whose value is an `aws-sm:` reference, so
+the net effect is as if those references were never in `ENV`.
+
+This deletion is deliberate: a raw `aws-sm:` value is never valid for any
+consumer, and a *present-but-invalid* secret breaks boot. For example, leaving
+`RAILS_MASTER_KEY="aws-sm:..."` in `ENV` makes Rails credentials decryption fail
+with `ArgumentError: key must be 16 bytes`, whereas an *absent* `RAILS_MASTER_KEY`
+is tolerated. Non-reference inline config (e.g. `DEFAULT_URL_HOST`) is left
+intact — the build still wants those values.
+
+```sh
+DOTENV_SECRETSMANAGER_SKIP=true
+```
+
+```ruby
+Dotenv::SecretsManager.configure { |c| c.skip = true }
+```
+
+- The env var is truthy when it is `1`, `true`, `yes`, or `on`
+  (case-insensitive; surrounding whitespace is ignored). Anything else —
+  `""`, `0`, `false`, `no`, or unset — does not by itself skip.
+- Either source skips: a truthy env var **or** `configuration.skip == true`.
+  The config flag skips regardless of the env var.
+- The env var is read at call time (when the railtie fires), so it is the right
+  knob for build-time use.
+
+The primary use case is an image build that boots the app — for example a Rails
+`assets:precompile` step in a Docker build — where there is no AWS region or
+credentials and no secrets are needed. Without skipping, constructing the AWS
+client raises (e.g. `Aws::Errors::MissingRegionError`) and fails the build. Set
+`DOTENV_SECRETSMANAGER_SKIP=true` on that step only. Non-secret `.env`
+config still loads normally; only secrets resolution is skipped.
+
 ## Deployment (AWS Lightsail Container Service)
 
 Set only `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION` as

data/lib/dotenv/secretsmanager/configuration.rb

@@ -9,11 +9,14 @@ module Dotenv
       attr_accessor :logger
       # nil => a default Aws::SecretsManager::Client (built lazily, only if needed)
       attr_accessor :client
+      # true => skip resolution entirely (no AWS calls, no client, ENV untouched)
+      attr_accessor :skip
 
       def initialize
         @on_error = :raise
         @logger = nil
         @client = nil
+        @skip = false
       end
     end
   end

data/lib/dotenv/secretsmanager/version.rb

@@ -2,6 +2,6 @@
 
 module Dotenv
   module SecretsManager
-    VERSION = "0.1.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/dotenv/secretsmanager.rb

@@ -9,6 +9,8 @@ require "dotenv/secretsmanager/resolver"
 
 module Dotenv
   module SecretsManager
+    SKIP_ENV_VAR = "DOTENV_SECRETSMANAGER_SKIP"
+
     class << self
       def configuration
         @configuration ||= Configuration.new
@@ -24,8 +26,32 @@ module Dotenv
       end
 
       def resolve!(env = ENV)
+        if skip?
+          # Delete reference-holding keys rather than leaving them: a raw
+          # aws-sm: literal is never a valid value for any consumer, and a
+          # present-but-invalid secret (e.g. RAILS_MASTER_KEY) breaks boot.
+          # Non-reference inline config is left intact for the build.
+          env.keys.each { |key| env.delete(key) if Reference.reference?(env[key]) }
+          return env
+        end
+
         Resolver.new(env: env, config: configuration).resolve!
       end
+
+      # Skip resolution entirely. Either the env var or the config flag can
+      # request it; resolution happens only when neither does. Read at call
+      # time so a railtie firing during an image build honors the env var.
+      def skip?
+        truthy?(ENV[SKIP_ENV_VAR]) || configuration.skip
+      end
+
+      private
+
+      def truthy?(value)
+        return false if value.nil?
+
+        %w[1 true yes on].include?(value.strip.downcase)
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dotenv-secretsmanager
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - key88sf