google_cloud_env_secrets 0.1.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fab903e59b088a60cb9d49094486fe45b02548810173815d3402dce4691dad2
-  data.tar.gz: f3282975fd0322ccce97d160c66deceddecabae685923d16d686bfc1eec471ea
+  metadata.gz: 8ffdb42eb21d616a6cb019876bf789e683d28c64a9e558de253c3c72e0382a9c
+  data.tar.gz: 5761a861832c4ebe93b1eab5d93d9dfab3c04cccf378fa8444bebc19867a6c6e
 SHA512:
-  metadata.gz: 9e0edffc6c1e70e59960d9f05a03a4a452aa0701f77c81d7a682fe746e721aad2f4a41d8f583019a2906e20cd8841e294e5f146ed3c592f9417149562be8d6af
-  data.tar.gz: 11f1759d55177b5c7f3eb99b749f589b7d59eb4eedfacebf6d435f98208a3e1f6574824f782239032e689352c8aed3f605e2746601b4bb3b39f480b637d83d66
+  metadata.gz: 988ddf45d7210a08f200070cc6ef8a8416d4f35213f5cf202a6544aed08755bf187bd604f82f884a07e63f20307df35f62b2a3b64cf109fdbba3701886ce19e0
+  data.tar.gz: c4c95a3d190def351086673ad62f9aa6a234b2e609ace0723f5aefa03a25a39930b90fe02f9654e23030ddfdbede34c865ca2bd92ba7df0b24fe94089f5a7b6f

data/README.md

@@ -23,12 +23,20 @@ $ gem install google_cloud_env_secrets
 
 Configure this gem with environment vars:
 
-| Variable                         | Description                                                                                                                                                                                                                                          |
-|----------------------------------|--------------------------------------------------------------------|
-| `GOOGLE_APPLICATION_CREDENTIALS` | Manually set path to Google Application Credentials.               |
-| `GOOGLE_PROJECT`                 | Manually set the Google project. Automatically detected otherwise. |
-| `GOOGLE_SECRETS_PREFIX`          | Only load secrets that start with prefix.                          |
+| Variable                              | Description                                                                                                                                                                                                                                          |
+|---------------------------------------|--------------------------------------------------------------------|
+| `GOOGLE_APPLICATION_CREDENTIALS`      | Google Application Credentials, path or data (not base64 encoded). |
+| `GOOGLE_PROJECT`                      | Google project                                                     |
+| `GOOGLE_SECRETS_PREFIX`               | Only load secrets that start with given prefix.                    |
+| `GOOGLE_SECRETS_OVERLOAD`             | Replace existing ENV vars with secret's value. Default `true`.     |
 
+The `GOOGLE_APPLICATION_CREDENTIALS` and `GOOGLE_PROJECT` variables are both optional. If not given,
+we will detect them automatically, if run on Google Cloud.
+
+Google Secrets are available after the [before_configuration hook](https://guides.rubyonrails.org/configuring.html#initialization-events).
+You can call `GoogleCloudEnvSecrets.load` if you need the ENV secrets sooner than that.
+
+See [docs](https://www.rubydoc.info/github/mattes/rails_google_cloud_env_secrets/main), too.
 
 ## Required IAM Roles
 
@@ -36,3 +44,4 @@ Configure this gem with environment vars:
 Secret Manager Secret Accessor
 Secret Manager Viewer
 ```
+

data/lib/google_cloud_env_secrets/config.rb

@@ -1,12 +1,16 @@
+require "json"
+
 module GoogleCloudEnvSecrets
   class Configuration
     attr_accessor :project
     attr_accessor :credentials
     attr_accessor :cache_secrets
     attr_accessor :prefix
+    attr_accessor :overload
 
     def initialize
       @cache_secrets = true
+      @overload = true
     end
   end
 
@@ -18,4 +22,16 @@ module GoogleCloudEnvSecrets
     self.configuration ||= Configuration.new
     yield(configuration)
   end
+
+  def self.parse_project_from_credentials(credentials)
+    if File.exist?(credentials)
+      j = JSON.parse(File.read(credentials))
+      return j["project_id"]
+    else
+      j = JSON.parse(credentials)
+      return j["project_id"]
+    end
+  rescue
+    nil
+  end
 end

data/lib/google_cloud_env_secrets/railtie.rb

@@ -1,14 +1,29 @@
 module GoogleCloudEnvSecrets
   class Railtie < ::Rails::Railtie
-    initializer "google_cloud_env_secrets.initialize", after: :bootstrap_hook do |app|
-      GoogleCloudEnvSecrets.configure do |config|
-        config.credentials = ENV["GOOGLE_APPLICATION_CREDENTIALS"] || nil
-        config.project = ENV["GOOGLE_PROJECT"] || Google::Cloud.env.project_id
-        config.prefix = ENV["GOOGLE_SECRETS_PREFIX"] || nil
-      end
 
-      secrets = GoogleCloudEnvSecrets.all
-      GoogleCloudEnvSecrets.inject_env!(secrets)
+    # load Google Secrets during Rails `before_configuration` hook
+    config.before_configuration do
+      GoogleCloudEnvSecrets.load
+    end
+
+    rake_tasks do
+      load "tasks/google_cloud_env_secrets_tasks.rake"
     end
   end
+
+  # load Google Secrets into ENV
+  def self.load
+    GoogleCloudEnvSecrets.configure do |config|
+      config.credentials = ENV["GOOGLE_APPLICATION_CREDENTIALS"] || nil
+      config.project = ENV["GOOGLE_PROJECT"] || GoogleCloudEnvSecrets.parse_project_from_credentials(config.credentials) || Google::Cloud.env.project_id
+      config.prefix = ENV["GOOGLE_SECRETS_PREFIX"] || nil
+
+      if ENV.has_key?("GOOGLE_SECRETS_OVERLOAD")
+        config.overload = ENV["GOOGLE_SECRETS_OVERLOAD"]&.to_s&.downcase == "true"
+      end
+    end
+
+    secrets = GoogleCloudEnvSecrets.all
+    GoogleCloudEnvSecrets.inject_env!(secrets, GoogleCloudEnvSecrets.configuration.overload)
+  end
 end

data/lib/google_cloud_env_secrets/secrets.rb

@@ -2,10 +2,19 @@ module GoogleCloudEnvSecrets
   def self.all
     @secrets = nil unless self.configuration.cache_secrets
     @secrets ||= begin
+        # Skip if not running on Google Cloud and credentials are not set explicitly
+        if self.configuration.credentials.nil? && Google::Cloud.env.project_id.nil?
+          return {}
+        end
+
         # Configure and initialize
         # https://googleapis.dev/ruby/google-cloud-secret_manager/latest/Google/Cloud/SecretManager.html
         Google::Cloud::SecretManager.configure do |config|
-          config.credentials = self.configuration.credentials
+          if File.exist?(self.configuration.credentials)
+            config.credentials = self.configuration.credentials # load by file
+          else
+            config.credentials = JSON.parse(self.configuration.credentials) # load data
+          end
         end
 
         client = Google::Cloud::SecretManager.secret_manager_service
@@ -38,17 +47,26 @@ module GoogleCloudEnvSecrets
 
         secrets
       end
-    @secrets
+
+    @secrets || {}
   end
 
   def self.find(name)
-    self.all # make sure we have the secrets loaded
-    @secrets[name.to_s]
+    self.all[name.to_s]
   end
 
-  def self.inject_env!(secrets = {})
+  def self.exist?(name)
+    self.all.has_key?(name.to_s)
+  end
+
+  def self.inject_env!(secrets = {}, overload = true, env = ENV)
     secrets.each do |name, value|
-      ENV[name.to_s] = value
+      name = name.to_s
+      if overload
+        env[name] = value
+      else
+        env[name] ||= value
+      end
     end
   end
 end

data/lib/google_cloud_env_secrets/version.rb

@@ -1,3 +1,3 @@
 module GoogleCloudEnvSecrets
-  VERSION = '0.1.0'
+  VERSION = "1.0.1"
 end

data/lib/tasks/google_cloud_env_secrets_tasks.rake

@@ -1,5 +1,9 @@
 desc "Fetch Google Cloud Secret"
 task :google_cloud_secret do
-  name = ARGV[1]
-  puts GoogleCloudEnvSecrets.find(name)
+  name = ENV["NAME"].strip
+
+  fail "#{name} not found" unless GoogleCloudEnvSecrets.exist?(name)
+
+  $stdout.sync = true
+  print GoogleCloudEnvSecrets.find(name)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: google_cloud_env_secrets
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Matthias Kadenbach
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-09 00:00:00.000000000 Z
+date: 2020-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -16,20 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.3
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: '6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 6.0.3
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 6.0.3.4
+        version: '6'
 - !ruby/object:Gem::Dependency
   name: google-cloud-secret_manager
   requirement: !ruby/object:Gem::Requirement