secrets_parser 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 482b595adb191ed6b889340e239cdcc376e84a3ee3e0e0e15a4df745ee28009f
-  data.tar.gz: 3e077fcda36d288afaebac53430bc567aae58b50e936e66cad5464e3dd4c1e9e
+  metadata.gz: bebee18f1aec76f28803a0e6d930d45db6100a76c67b1310681b30b93b8594cb
+  data.tar.gz: d6fa1b8673811b3eaf2174241774e7a9525d3f679968f5fabd6b3be3185921b3
 SHA512:
-  metadata.gz: 48775396ba15fa9ff16ec517d13ee4e53a8349072ed9704c455c24cb42c53f5c627b1f00cbfc7e6b070ce5db96ed6044aa1822299fc46656c9b6e092bb8bb851
-  data.tar.gz: eb1f9e854bb59043f2f9bc50f190b03e4177fbe76d7f110302bdd470cf769a9f449e25b64c5b1cae909a897f737aa89ade8e8420365f24e67bc7af0f65410949
+  metadata.gz: d75d57d335287068bd8f57bd15e4d1c95f60e6302062eda46e187c4cf4e70c7b05f49c9e62f1b030a3d3bc5b5320960422cb44e78c195e62f184e971feca748f
+  data.tar.gz: 947134c3cf57df1e0e902c87c304c902fe58d575f219d36b91699ebd1cb3bc299be75377f31cbf122da2675421867d2b19dac05d9c8c84169d922a67afc42222

data/README.md

@@ -1,5 +1,7 @@
 # Secrets Parser
 
+[![Build Status](https://travis-ci.org/peertransfer/secrets_parser.svg?branch=master)](https://travis-ci.org/peertransfer/secrets_parser)
+
 This gem parse the secrets reading a field in a JSON file, download the encrypted secrets file from S3 and change the values for the encrypted ones.
 
 ## Usage

data/lib/secrets_parser/parser.rb

@@ -1,32 +1,45 @@
-require 'json'
 require 'aws-sdk-s3'
+require 'json'
+require 'logger'
 require_relative 'helpers'
+require_relative 's3'
 
 module Secrets
+  module Errors
+    class NoSuchKey < StandardError; end
+  end
+
   class Parser
     SECRETS_FILE_SUFFIX = '.json.encrypted'.freeze
 
+    class Configuration
+      SETTINGS = %i[s3_client kms_client logger s3].freeze
+
+      attr_accessor(*SETTINGS)
+
+      def []=(key, value)
+        public_send("#{key}=", value)
+      end
+    end
+
     def initialize
-      @config = {
-        s3_client: nil,
-        kms_client: nil,
-        logger: nil
-      }
+      @config = Configuration.new
+      @secret_variables = {}
     end
 
     def set_config
-      yield @config
+      yield(@config)
+      @config.logger ||= Logger.new(File::NULL)
+      self
     end
 
     def parse(file_to_parse, field_to_parse)
-      Aws.config.update(
-        region: ENV['AWS_DEFAULT_REGION']
-      )
+      @config.s3 = S3.new(@config.s3_client, @config.kms_client, @config.logger)
 
       app_json = JSON.parse(IO.read(file_to_parse))
       app_variables = app_json[field_to_parse]
 
-      logger.info "Parsing #{field_to_parse} section of #{file_to_parse}" if logger?
+      logger.info "Parsing #{field_to_parse} section of #{file_to_parse}"
 
       app_json[field_to_parse] = parse_secrets_from app_variables
 
@@ -36,80 +49,60 @@ module Secrets
     private
 
     def secret?(string)
-      if string.is_a? String
-        string.start_with? 'secret:'
-      else
-        false
-      end
+      string.is_a?(String) && string.start_with?('secret:')
     end
 
-    def secret_file_path_from(secret)
-      secret_file_path = secret[secret.index(':') + 1..secret.rindex(':') - 1]
-      Helpers.expand_param_from_env secret_file_path
-    end
+    def secrets_from(secret_file)
+      return @secret_variables[secret_file] if already_decrypted?(secret_file)
 
-    def secret_key_from(secret)
-      secret[secret.rindex(':') + 1..secret.length]
+      encrypted_secrets_io = @config.s3.download(secret_file + SECRETS_FILE_SUFFIX)
+      decrypted_secrets = @config.s3.decrypt(encrypted_secrets_io)
+
+      JSON.parse(decrypted_secrets)
     end
 
-    def download(file)
-      bucket_name = file[0, file.index('/')]
-      file = file[file.index('/') + 1..file.length] + SECRETS_FILE_SUFFIX
-      tmp_file = "/tmp/secrets#{SECRETS_FILE_SUFFIX}"
+    def parse_secrets_from(variables)
+      variables.each_pair do |key, value|
+        next unless secret?(value)
 
-      logger.info "Downloading #{file} from #{bucket_name}" if logger?
+        secret_file = secret_file_from(value)
+        secret_key = secret_key_from(value)
 
-      File.open(tmp_file, 'wb') do |secret_file|
-        @config[:s3_client].get_object({ bucket: bucket_name, key: file }, target: secret_file)
+        @secret_variables[secret_file] = secrets_from(secret_file)
+
+        logger.info "Updating #{key} value"
+        variables[key] = secret_value_from(secret_file, secret_key)
       end
 
-      tmp_file
+      variables
     end
 
-    def decrypt(file)
-      kms = @config[:kms_client]
-
-      kms.decrypt(
-        ciphertext_blob: IO.read(file)
-      )
+    def already_decrypted?(secret_file)
+      @secret_variables.key?(secret_file)
     end
 
-    def extract_secrets_from(secret_file)
-      encrypted_secrets_file = download secret_file
-      decrypted_secrets_file = decrypt encrypted_secrets_file
-
-      JSON.parse(decrypted_secrets_file.plaintext)
+    def secret_file_from(secret)
+      Helpers.expand_param_from_env(secret).split(':')[1]
     end
 
-    def parse_secrets_from(variables)
-      secret_variables = {}
-
-      variables.each_pair do |key, value|
-        next unless secret?(value)
-
-        secret = value
-
-        secret_file = secret_file_path_from(secret)
-        secret_key = secret_key_from(secret)
-
-        unless secret_variables.key?(secret_file)
-          secret_variables[secret_file] = extract_secrets_from secret_file
-        end
-
-        logger.info "Updating #{key} value" if logger?
+    def secret_key_from(secret)
+      Helpers.expand_param_from_env(secret).split(':')[2]
+    end
 
-        variables[key] = secret_variables[secret_file][secret_key]
+    def secret_value_from(secret_file, secret_key)
+      unless secret_key_exists?(secret_file, secret_key)
+        raise Secrets::Errors::NoSuchKey, "Secret key #{secret_key} does not exist in #{secret_file}"
       end
 
-      variables
+      @secret_variables[secret_file][secret_key]
     end
 
-    def logger?
-      !logger.nil?
+    def secret_key_exists?(secret_file, secret_key)
+      !@secret_variables[secret_file][secret_key].nil?
     end
 
     def logger
-      @config[:logger]
+      @config.logger
     end
   end
 end

data/lib/secrets_parser/s3.rb

@@ -0,0 +1,38 @@
+require 'aws-sdk-s3'
+require 'json'
+require 'logger'
+require_relative 'helpers'
+
+module Secrets
+  module Errors
+    class NoSuchFile < StandardError; end
+  end
+
+  class S3
+    def initialize(s3_client, kms_client, logger)
+      @s3_client = s3_client
+      @kms_client = kms_client
+      @logger = logger
+    end
+
+    def download(filename)
+      bucket_name, file = filename.split('/', 2)
+
+      @logger.info "Downloading #{file} from #{bucket_name}"
+      begin
+        resp = @s3_client.get_object(bucket: bucket_name, key: file)
+        resp.body
+      rescue Aws::S3::Errors::NoSuchKey
+        raise Secrets::Errors::NoSuchFile, "Secret file #{file} does not exist in #{bucket_name}"
+      end
+    end
+
+    def decrypt(io)
+      @kms_client.decrypt(ciphertext_blob: io.read).plaintext
+    end
+
+    def logger
+      @config.logger
+    end
+  end
+end

data/lib/secrets_parser/version.rb

@@ -1,3 +1,3 @@
 module SecretsParser
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secrets_parser
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Paco Sanchez
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-10 00:00:00.000000000 Z
+date: 2019-05-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -66,6 +66,7 @@ files:
 - lib/secrets_parser.rb
 - lib/secrets_parser/helpers.rb
 - lib/secrets_parser/parser.rb
+- lib/secrets_parser/s3.rb
 - lib/secrets_parser/version.rb
 - secrets_parser.gemspec
 homepage: https://github.com/peertransfer/secrets_parser
@@ -88,8 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.7
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Write a short summary, because RubyGems requires one.