@apolitical/server 4.0.1 → 4.1.0-pla-305.0

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "@apolitical/server",
-  "version": "4.0.1",
+  "version": "4.1.0-pla-305.0",
   "description": "Node.js module to encapsulate Apolitical's express server setup",
   "author": "Apolitical Group Limited <engineering@apolitical.co>",
   "license": "MIT",
   "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./secrets": "./src/secrets.js"
+  },
   "files": [
     "src"
   ],
@@ -25,6 +29,7 @@
   "dependencies": {
     "@apolitical/logger": "2.1.0",
     "@cloudnative/health-connect": "2.1.0",
+    "@google-cloud/secret-manager": "^6.1.1",
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/auto-instrumentations-node": "0.57.1",
     "@opentelemetry/exporter-trace-otlp-grpc": "0.200.0",

package/src/config.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { NODE_ENV, LOG_LEVEL } = process.env;
+const { NODE_ENV, LOG_LEVEL, GOOGLE_CLOUD_PROJECT, GOOGLE_IMPERSONATE_SERVICE_ACCOUNT } = process.env;
 
 const NAME = 'apolitical-server';
 const UUID = '00000000-0000-0000-0000-000000000000';
@@ -10,6 +10,8 @@ const ADMIN_ROLE = 'administrator';
 module.exports = {
   NODE_ENV,
   LOG_LEVEL,
+  GOOGLE_CLOUD_PROJECT,
+  GOOGLE_IMPERSONATE_SERVICE_ACCOUNT,
   LOGGER_OPTIONS: {
     logLevel: LOG_LEVEL,
     labels: {

package/src/container.js

@@ -22,6 +22,7 @@ const prerender = require('prerender-node');
 const qs = require('qs');
 const swaggerUi = require('swagger-ui-express');
 const xss = require('xss');
+const secretManager = require('@google-cloud/secret-manager');
 // Internal Modules
 const apoliticalLogger = require('@apolitical/logger');
 // Configuration
@@ -55,6 +56,7 @@ const expressService = require('./services/express.service');
 const healthService = require('./services/health.service');
 const jwtService = require('./services/jwt.service');
 const serverService = require('./services/server.service');
+const secretsService = require('./services/secrets.service');
 
 // DI container
 const container = createContainer();
@@ -80,6 +82,7 @@ container.register({
   qs: asValue(qs),
   swaggerUi: asValue(swaggerUi),
   xss: asValue(xss),
+  secretManager: asValue(secretManager),
   // Internal Modules
   apoliticalLogger: asValue(apoliticalLogger),
   // Configuration
@@ -113,6 +116,7 @@ container.register({
   healthService: asFunction(healthService).singleton(),
   jwtService: asFunction(jwtService).singleton(),
   serverService: asFunction(serverService).singleton(),
+  secretsService: asFunction(secretsService).singleton(),
 });
 
 module.exports = container;

package/src/secrets.js

@@ -0,0 +1,10 @@
+'use strict';
+
+const secretManager = require('@google-cloud/secret-manager');
+const secretsServiceFactory = require('./services/secrets.service');
+
+module.exports = secretsServiceFactory({
+  secretManager,
+  config: process.env,
+  logger: console,
+});

package/src/services/secrets.service.js

@@ -0,0 +1,100 @@
+'use strict';
+
+module.exports = ({ secretManager, config, logger }) => {
+  const DEV_DEFAULTS = {
+    impersonateAccount: 'development-platform@hazel-tea-194609.iam.gserviceaccount.com',
+  };
+
+  const cache = {};
+  let client = null;
+
+  // Resolved once at first client creation; stored in closure so subsequent
+  // calls to isImpersonationEnabled() reflect the dev default without
+  // re-reading process.env.
+  let resolvedImpersonationTarget = config.GOOGLE_IMPERSONATE_SERVICE_ACCOUNT?.trim() || null;
+
+  function isImpersonationEnabled() {
+    return resolvedImpersonationTarget !== null;
+  }
+
+  function impersonationLogContext() {
+    return resolvedImpersonationTarget ? { targetServiceAccount: resolvedImpersonationTarget } : {};
+  }
+
+  function getClient() {
+    if (!client) {
+      if (config.NODE_ENV !== 'production' && !isImpersonationEnabled()) {
+        resolvedImpersonationTarget = DEV_DEFAULTS.impersonateAccount;
+        // Set on process.env so the Google Cloud SDK picks it up via ADC
+        process.env['GOOGLE_IMPERSONATE_SERVICE_ACCOUNT'] = resolvedImpersonationTarget;
+        logger.info('[secrets] set default impersonation for development', {
+          targetServiceAccount: resolvedImpersonationTarget,
+        });
+      }
+
+      if (isImpersonationEnabled()) {
+        logger.info('[secrets] using impersonation', impersonationLogContext());
+      }
+
+      client = new secretManager.SecretManagerServiceClient();
+    }
+    return client;
+  }
+
+  async function loadSecrets(opts) {
+    const { secrets } = opts;
+    const projectId = opts.projectId ?? config.GOOGLE_CLOUD_PROJECT;
+
+    if (!projectId) {
+      throw new Error('Missing projectId for Secret Manager');
+    }
+    if (!secrets || secrets.length === 0) {
+      return;
+    }
+
+    const secretClient = getClient();
+
+    for (const spec of secrets) {
+      const version = spec.version ?? 'latest';
+      const name = `projects/${projectId}/secrets/${spec.name}/versions/${version}`;
+
+      try {
+        const [resp] = await secretClient.accessSecretVersion({ name });
+        const payload = resp.payload?.data?.toString('utf8');
+
+        if (!payload) {
+          throw new Error(`Empty payload for secret ${spec.name}`);
+        }
+
+        cache[spec.envVar] = payload;
+
+        if (spec.exportToEnv) {
+          process.env[spec.envVar] = payload;
+        }
+
+        logger.info('[secrets] loaded', {
+          name: spec.name,
+          envVar: spec.envVar,
+          version,
+          cached: true,
+          exportedToEnv: !!spec.exportToEnv,
+        });
+      } catch (err) {
+        throw new Error(`Failed to load secret "${spec.name}": ${err.message}`);
+      }
+    }
+  }
+
+  function getSecret(envVar) {
+    const val = cache[envVar] ?? process.env[envVar];
+    if (!val) {
+      throw new Error(`Secret "${envVar}" not loaded`);
+    }
+    return val;
+  }
+
+  return {
+    loadSecrets,
+    getSecret,
+  };
+};

package/src/services/server.service.js

@@ -8,6 +8,7 @@ module.exports = ({
   jwtService,
   serverError,
   requestHelper,
+  secretsService,
 }) => {
   // Register shutdown to clean up any resources used by the express app
   registerShutdown(shutdown);
@@ -22,5 +23,6 @@ module.exports = ({
       authorisation: authorisationMiddleware,
     },
     request: requestHelper,
+    secrets: secretsService,
   };
 };