@ciq-dev/neoiq-foundation-node 1.0.1-beta.6 → 1.0.2-0

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { AutoInstrumentationConfigSchema, FeaturesConfigSchema, FoundationConfigSchema, LoggingConfigSchema, OtelConfigSchema, RedactionConfigSchema, RequestLoggingConfigSchema, ShutdownConfigSchema, SpanStatusCode, context, getActiveSpan, getDefaultOtelEndpoint, getTraceContext, getTracer, isTracingEnabled, parseConfig, propagation, setupTracing, shutdownTracing, trace } from "./tracing-CcsyQIpB.mjs";
+import { AutoInstrumentationConfigSchema, FeaturesConfigSchema, FoundationConfigSchema, LoggingConfigSchema, OtelConfigSchema, RedactionConfigSchema, RequestLoggingConfigSchema, ShutdownConfigSchema, SpanStatusCode, VaultCacheConfigSchema, VaultConfigSchema, context, getActiveSpan, getDefaultOtelEndpoint, getTraceContext, getTracer, isTracingEnabled, parseConfig, propagation, setupTracing, shutdownTracing, trace } from "./tracing-BwTyDuEv.mjs";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from "@opentelemetry/semantic-conventions";
 import { SpanStatusCode as SpanStatusCode$1, context as context$1, metrics, propagation as propagation$1, trace as trace$1 } from "@opentelemetry/api";
@@ -11,6 +11,7 @@ import { randomUUID } from "crypto";
 import axios from "axios";
 import axiosRetry from "axios-retry";
 import CircuitBreaker from "opossum";
+import { readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
 
@@ -730,6 +731,136 @@ function createHttpClient(options) {
 	return client;
 }
 
+//#endregion
+//#region src/features/vault.ts
+async function loadNodeVault() {
+	try {
+		const mod = await import("node-vault");
+		return mod.default ?? mod;
+	} catch {
+		throw new Error("node-vault is not installed. Install the optional peer dependency: npm install node-vault");
+	}
+}
+var VaultClient = class {
+	client = null;
+	clientPromise;
+	authenticated = false;
+	cache = new Map();
+	config;
+	logger;
+	cacheEnabled;
+	cacheTtlMs;
+	constructor(options) {
+		this.config = {
+			address: "https://vault.beta.commerceiq.ai/",
+			authMethod: "kubernetes",
+			role: "",
+			mountPoint: "secret",
+			tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token",
+			...options.config
+		};
+		this.logger = options.logger;
+		this.cacheEnabled = this.config.cache?.enabled !== false;
+		this.cacheTtlMs = (this.config.cache?.ttlSeconds ?? 300) * 1e3;
+		this.clientPromise = this.initClient();
+	}
+	async initClient() {
+		const nodeVault = await loadNodeVault();
+		const client = nodeVault({
+			apiVersion: "v1",
+			endpoint: this.config.address,
+			namespace: this.config.namespace
+		});
+		this.client = client;
+		return client;
+	}
+	async authenticate() {
+		if (this.authenticated) return;
+		const client = await this.clientPromise;
+		if (this.config.authMethod === "token") {
+			const token = process.env.VAULT_TOKEN;
+			if (!token) throw new Error("VAULT_TOKEN environment variable is required for token-based authentication");
+			client.token = token;
+			this.authenticated = true;
+			this.logger.info({ authMethod: "token" }, "Vault authenticated via token");
+			return;
+		}
+		const role = this.config.role;
+		if (!role) throw new Error("Vault role is required for Kubernetes authentication. Set vault.role in config or VAULT_AUTH_ROLE env var.");
+		let jwt;
+		try {
+			jwt = await readFile(this.config.tokenPath, "utf8");
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`Failed to read Kubernetes service account token from ${this.config.tokenPath}: ${message}`);
+		}
+		const result = await client.kubernetesLogin({
+			role,
+			jwt
+		});
+		client.token = result.auth.client_token;
+		this.authenticated = true;
+		this.logger.info({
+			authMethod: "kubernetes",
+			role,
+			leaseDuration: result.auth.lease_duration
+		}, "Vault authenticated via Kubernetes service account");
+	}
+	async getSecret(path) {
+		const cacheKey = path;
+		if (this.cacheEnabled) {
+			const cached = this.cache.get(cacheKey);
+			if (cached && cached.expiresAt > Date.now()) {
+				this.logger.debug({
+					path,
+					cache: "hit"
+				}, "Vault secret cache hit");
+				return cached.data;
+			}
+		}
+		await this.authenticate();
+		const client = await this.clientPromise;
+		const fullPath = `${this.config.mountPoint}/data/${path}`;
+		this.logger.debug({ path: fullPath }, "Reading secret from Vault");
+		const response = await client.read(fullPath);
+		const data = response.data.data;
+		if (this.cacheEnabled) {
+			this.cache.set(cacheKey, {
+				data,
+				expiresAt: Date.now() + this.cacheTtlMs
+			});
+			this.logger.debug({
+				path,
+				cache: "miss",
+				ttlMs: this.cacheTtlMs
+			}, "Vault secret cached");
+		}
+		return data;
+	}
+	async getSecretValue(path, key) {
+		const secrets = await this.getSecret(path);
+		return secrets[key];
+	}
+	isAuthenticated() {
+		return this.authenticated;
+	}
+	clearCache() {
+		this.cache.clear();
+		this.logger.debug({}, "Vault secret cache cleared");
+	}
+	async checkHealth() {
+		try {
+			await this.authenticate();
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+function createVaultClient(options) {
+	return new VaultClient(options);
+}
+
 //#endregion
 //#region src/foundation.ts
 const deprecationWarnings = new Set();
@@ -747,11 +878,12 @@ function warnDeprecation(oldPath, newPath, logger) {
 function createFoundation(input) {
 	const startTime = Date.now();
 	const config = parseConfig(input);
-	const { serviceName, serviceVersion, environment, features: featuresConfig, otel, logging: loggingConfig, requestLogging: requestLoggingConfig, redaction: redactionConfig, shutdown: shutdownConfig } = config;
+	const { serviceName, serviceVersion, environment, features: featuresConfig, otel, logging: loggingConfig, requestLogging: requestLoggingConfig, redaction: redactionConfig, shutdown: shutdownConfig, vault: vaultConfig } = config;
 	const features = {
 		tracing: featuresConfig.tracing ?? true,
 		metrics: featuresConfig.metrics ?? true,
-		logging: featuresConfig.logging ?? true
+		logging: featuresConfig.logging ?? true,
+		vault: vaultConfig.enabled ?? false
 	};
 	const contextManager = createContextManager();
 	let logger;
@@ -829,6 +961,22 @@ function createFoundation(input) {
 		metricsError = err.message;
 		logger.error({ error: metricsError }, "Metrics setup failed - continuing without metrics");
 	}
+	let vaultClient = null;
+	let vaultError;
+	if (features.vault) try {
+		vaultClient = createVaultClient({
+			config: vaultConfig,
+			logger
+		});
+		logger.info({
+			feature: "vault",
+			address: vaultConfig.address,
+			authMethod: vaultConfig.authMethod
+		}, "Vault client created (lazy auth on first secret read)");
+	} catch (err) {
+		vaultError = err.message;
+		logger.error({ error: vaultError }, "Vault setup failed - continuing without vault");
+	}
 	logger.info({
 		serviceName,
 		serviceVersion,
@@ -896,37 +1044,45 @@ function createFoundation(input) {
 		...options,
 		foundation
 	}) };
+	const secretsModule = vaultClient;
 	const buildHealthStatus = () => {
 		const tracingUp = !features.tracing || !tracingError && isTracingEnabled();
 		const metricsUp = !features.metrics || !metricsError && isMetricsEnabled();
 		const loggingUp = !loggingError;
-		const allUp = tracingUp && metricsUp && loggingUp;
-		const allDown = (!tracingUp || !features.tracing) && (!metricsUp || !features.metrics) && !loggingUp;
+		const vaultUp = !features.vault || !vaultError && !!vaultClient;
+		const allUp = tracingUp && metricsUp && loggingUp && vaultUp;
+		const allDown = (!tracingUp || !features.tracing) && (!metricsUp || !features.metrics) && (!vaultUp || !features.vault) && !loggingUp;
 		let status = "healthy";
 		if (!allUp) status = allDown ? "unhealthy" : "degraded";
+		const components = {
+			tracing: {
+				enabled: features.tracing,
+				status: !features.tracing ? "disabled" : tracingError ? "down" : "up",
+				message: tracingError
+			},
+			metrics: {
+				enabled: features.metrics,
+				status: !features.metrics ? "disabled" : metricsError ? "down" : "up",
+				message: metricsError
+			},
+			logging: {
+				enabled: features.logging,
+				status: loggingError ? "down" : "up",
+				message: loggingError
+			}
+		};
+		if (features.vault) components.vault = {
+			enabled: true,
+			status: vaultError ? "down" : "up",
+			message: vaultError
+		};
 		return {
 			status,
 			timestamp: new Date().toISOString(),
 			service: serviceName,
 			version: serviceVersion,
 			uptime: Math.floor((Date.now() - startTime) / 1e3),
-			components: {
-				tracing: {
-					enabled: features.tracing,
-					status: !features.tracing ? "disabled" : tracingError ? "down" : "up",
-					message: tracingError
-				},
-				metrics: {
-					enabled: features.metrics,
-					status: !features.metrics ? "disabled" : metricsError ? "down" : "up",
-					message: metricsError
-				},
-				logging: {
-					enabled: features.logging,
-					status: loggingError ? "down" : "up",
-					message: loggingError
-				}
-			}
+			components
 		};
 	};
 	const shutdownFn = async () => {
@@ -934,6 +1090,7 @@ function createFoundation(input) {
 		const promises = [];
 		if (features.tracing && isTracingEnabled()) promises.push(shutdownTracing());
 		if (features.metrics && isMetricsEnabled()) promises.push(shutdownMetrics());
+		if (vaultClient) vaultClient.clearCache();
 		await Promise.all(promises);
 		logger.info({}, "Foundation shutdown complete");
 	};
@@ -966,6 +1123,7 @@ function createFoundation(input) {
 		observability,
 		http: httpModule,
 		lifecycle,
+		secrets: secretsModule,
 		logger,
 		context: contextManager,
 		fastifyPlugin: createObservabilityPlugin({
@@ -1311,5 +1469,5 @@ var InMemoryObjectStore = class {
 };
 
 //#endregion
-export { AutoInstrumentationConfigSchema, AwsS3ObjectStore, FeaturesConfigSchema, FoundationConfigSchema, InMemoryObjectStore, LoggingConfigSchema, OtelConfigSchema, REDACT_PATHS, RedactionConfigSchema, RequestLoggingConfigSchema, ShutdownConfigSchema, SpanStatusCode, buildPinoRedactConfig, context, createContextManager, createFallbackLogger, createFoundation, createHttpClient, createLogger, createObservabilityPlugin, getActiveSpan, getDefaultOtelEndpoint, getGlobalLogger, getMeter, getTraceContext, getTracer, isMetricsEnabled, isTracingEnabled, metrics, parseConfig, propagation, sanitizeBody, setGlobalLogger, setupMetrics, setupObservability, setupTracing, shutdownMetrics, shutdownTracing, trace };
+export { AutoInstrumentationConfigSchema, AwsS3ObjectStore, FeaturesConfigSchema, FoundationConfigSchema, InMemoryObjectStore, LoggingConfigSchema, OtelConfigSchema, REDACT_PATHS, RedactionConfigSchema, RequestLoggingConfigSchema, ShutdownConfigSchema, SpanStatusCode, VaultCacheConfigSchema, VaultClient, VaultConfigSchema, buildPinoRedactConfig, context, createContextManager, createFallbackLogger, createFoundation, createHttpClient, createLogger, createObservabilityPlugin, createVaultClient, getActiveSpan, getDefaultOtelEndpoint, getGlobalLogger, getMeter, getTraceContext, getTracer, isMetricsEnabled, isTracingEnabled, metrics, parseConfig, propagation, sanitizeBody, setGlobalLogger, setupMetrics, setupObservability, setupTracing, shutdownMetrics, shutdownTracing, trace };
 //# sourceMappingURL=index.mjs.map