@adobe/helix-config 4.10.2 → 4.11.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [4.11.0](https://github.com/adobe/helix-config/compare/v4.10.2...v4.11.0) (2025-01-13)
+
+
+### Features
+
+* resolve secrets ([#230](https://github.com/adobe/helix-config/issues/230)) ([90437c9](https://github.com/adobe/helix-config/commit/90437c9fc241c05939e5690f945917c3f339e8b8))
+
 ## [4.10.2](https://github.com/adobe/helix-config/compare/v4.10.1...v4.10.2) (2025-01-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "4.10.2",
+  "version": "4.11.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-merge.js

@@ -32,6 +32,7 @@ const ROOT_PROPERTIES = {
   robots: {},
   extends: {},
   tokens: {},
+  secrets: {},
   public: {},
   groups: {},
 };

package/src/config-view.js

@@ -106,12 +106,61 @@ async function getGlobalTokenHash(ctx, rso) {
     .replaceAll('=', '');
 }
 
+/**
+ * looks up a secret hash or value depending on the `hashed` flag. it looks at the following places
+ * to resolve the secret id:
+ * - config.secrets
+ * - config.tokens
+ * - orgConfig.secrets
+ * - orgConfig.tokens
+ *
+ * @param {object} config
+ * @param {object} orgConfig
+ * @param {string} id
+ * @param {boolean} [hashed=false]
+ * @returns {string|null}
+ */
+function lookupSecret(config, orgConfig, id, hashed = false) {
+  if (!id) {
+    return null;
+  }
+  for (const list of [config?.secrets, config?.tokens, orgConfig?.secrets, orgConfig?.tokens]) {
+    const secret = list?.[id];
+    if (secret?.hash && hashed) {
+      return secret.hash;
+    }
+    if (secret?.value && !hashed) {
+      return secret.value;
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolves a secret addressed with the `idProp` and stores it in the `dstProp`. This function has
+ * no effect, if the secret does not exist, or is not a key secret (i.e. a hashed secret).
+ * @param object
+ * @param idProp
+ * @param dstProp
+ * @param siteConfig
+ * @param orgConfig
+ */
+function resolveSecret(object, idProp, dstProp, siteConfig, orgConfig) {
+  const id = object?.[idProp];
+  if (id) {
+    const secret = lookupSecret(siteConfig, orgConfig, id);
+    if (secret) {
+      // eslint-disable-next-line no-param-reassign
+      object[dstProp] = secret;
+    }
+  }
+}
+
 /**
  * Returns the normalized access configuration for the give partition.
  */
 export async function getAccessConfig(ctx, config, orgConfig, partition, rso) {
   const { access } = config;
-  const tokens = { ...orgConfig?.tokens || {}, ...config.tokens };
   const pAccess = access[partition] ?? {};
   const apiKeyId = toArray(pAccess.apiKeyId ?? access.site?.apiKeyId);
   const allow = toArray(pAccess.allow ?? access.site?.allow);
@@ -121,7 +170,7 @@ export async function getAccessConfig(ctx, config, orgConfig, partition, rso) {
     tokenHash: apiKeyId
       // token ids are always stored in base64url format, but legacy apiKeyIds are not
       .map((jti) => jti.replaceAll('/', '_').replaceAll('+', '-'))
-      .map((id) => tokens[id]?.hash)
+      .map((id) => lookupSecret(config, orgConfig, id, true))
       .filter((hash) => !!hash),
   };
   // if an allow is defined but no apiKeyId, create a fake one so that auth is still enforced.
@@ -240,6 +289,7 @@ async function resolveConfig(ctx, rso, scope) {
     if (config) {
       const profile = await loadProfile(ctx, rso, 'default');
       config.data.tokens = profile?.data.tokens || {};
+      config.data.secrets = profile?.data.secrets || {};
     }
     return config;
   }
@@ -465,8 +515,12 @@ export async function getConfigResponse(ctx, opts) {
     });
   }
 
-  // delete token hashes but keep for pipeline because the cloudflare worker still needs them
+  // resolve well known secrets
+  resolveSecret(config.code.source, 'secretId', 'secret', config, orgConfig);
+
   delete config.tokens;
+  delete config.secrets;
+  // delete token hashes but keep for pipeline because the cloudflare worker still needs them
   if (opts.scope !== SCOPE_PIPELINE) {
     delete config.access?.preview?.tokenHash;
     delete config.access?.live?.tokenHash;