@clicadigital/vault-sdk 0.1.0 → 0.3.0

package/package.json

@@ -1,43 +1,43 @@
-{
-  "name": "@clicadigital/vault-sdk",
-  "version": "0.1.0",
-  "description": "SDK + CLI to ensure and pull env vars from Clica VPN Vault",
-  "type": "module",
-  "license": "UNLICENSED",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "vault-sdk": "./dist/cli.js"
-  },
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "bun": "./src/index.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "src"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "bun run build",
-    "vault": "bun run src/cli.ts"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "vault",
-    "env",
-    "secrets",
-    "kubernetes",
-    "clicadigital"
-  ],
-  "devDependencies": {
-    "@types/node": "^22.16.5",
-    "typescript": "^5.8.3"
-  }
-}
+{
+  "name": "@clicadigital/vault-sdk",
+  "version": "0.3.0",
+  "description": "SDK + CLI to load vault envs via cluster ServiceAccount (k3s/k8s)",
+  "type": "module",
+  "license": "UNLICENSED",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "vault-sdk": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "bun run build",
+    "vault": "bun run src/cli.ts"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "vault",
+    "env",
+    "secrets",
+    "kubernetes",
+    "clicadigital"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.16.5",
+    "typescript": "^5.8.3"
+  }
+}

package/src/cli.ts

@@ -1,132 +1,134 @@
-#!/usr/bin/env node
-import { createClientFromEnv } from "./client.js";
-import { createEnv, ensureEnvironment, pullVault } from "./index.js";
-
-type Flags = Record<string, string | boolean | string[]>;
-
-function parseArgs(argv: string[]): { cmd: string; flags: Flags } {
-  const [cmd = "help", ...rest] = argv;
-  const flags: Flags = {};
-  for (let i = 0; i < rest.length; i++) {
-    const token = rest[i];
-    if (!token?.startsWith("--")) continue;
-    const key = token.slice(2);
-    const next = rest[i + 1];
-    if (!next || next.startsWith("--")) {
-      flags[key] = true;
-      continue;
-    }
-    if (key === "var") {
-      const list = Array.isArray(flags.var) ? flags.var : [];
-      list.push(next);
-      flags.var = list;
-    } else {
-      flags[key] = next;
-    }
-    i++;
-  }
-  return { cmd, flags };
-}
-
-function str(flags: Flags, key: string, fallback?: string): string {
-  const v = flags[key];
-  if (typeof v === "string" && v.length > 0) return v;
-  if (fallback !== undefined) return fallback;
-  throw new Error(`Missing --${key}`);
-}
-
-function printHelp(): void {
-  console.log(`@clicadigital/vault-sdk — cria e carrega envs via URL do vault na VPN
-
-Usage:
-  vault-sdk create --project <name> --env <name> [--url <vpn-url>] [--var KEY=VAL]...
-  vault-sdk ensure --project <name> --env <name> [--url <vpn-url>]
-  vault-sdk pull   --project <name> --env <name> [--out .env] [--no-inject] [--url <vpn-url>]
-
-Env:
-  VAULT_URL       URL do vault no cluster/VPN (ex: http://vault-api:3001)
-  VAULT_PROJECT   default --project
-  VAULT_ENV       default --env
-
-Auth: nenhuma chave — acesso só via rede interna (pods / VPN).
-`);
-}
-
-function applyUrl(flags: Flags): void {
-  if (typeof flags.url === "string") process.env.VAULT_URL = flags.url;
-}
-
-function parseVarList(flags: Flags): Record<string, string> {
-  const out: Record<string, string> = {};
-  const list = Array.isArray(flags.var) ? flags.var : [];
-  for (const pair of list) {
-    const eq = pair.indexOf("=");
-    if (eq < 1) throw new Error(`Invalid --var ${pair} (use KEY=VALUE)`);
-    out[pair.slice(0, eq)] = pair.slice(eq + 1);
-  }
-  return out;
-}
-
-async function main(): Promise<void> {
-  const { cmd, flags } = parseArgs(process.argv.slice(2));
-
-  if (cmd === "help" || flags.help === true) {
-    printHelp();
-    return;
-  }
-
-  applyUrl(flags);
-
-  const project = str(flags, "project", process.env.VAULT_PROJECT);
-  const env = str(flags, "env", process.env.VAULT_ENV);
-  const url = typeof flags.url === "string" ? flags.url : undefined;
-  const client = url
-    ? createClientFromEnv({ ...process.env, VAULT_URL: url })
-    : undefined;
-
-  if (cmd === "create") {
-    const vars = parseVarList(flags);
-    const result = await createEnv({ project, env, url, vars, client });
-    console.log(JSON.stringify({ project, env, ...result }, null, 2));
-    return;
-  }
-
-  if (cmd === "ensure") {
-    const result = await ensureEnvironment({ project, env, client });
-    console.log(
-      JSON.stringify(
-        {
-          project,
-          env,
-          projectId: result.projectId,
-          environmentId: result.environmentId,
-          createdProject: result.createdProject,
-          createdEnvironment: result.createdEnvironment,
-        },
-        null,
-        2,
-      ),
-    );
-    return;
-  }
-
-  if (cmd === "pull") {
-    const out = typeof flags.out === "string" ? flags.out : undefined;
-    const inject = flags["no-inject"] !== true;
-    const result = await pullVault({ project, env, out, inject, client });
-    console.log(
-      `pulled ${Object.keys(result.vars).length} vars for ${project}/${env}` +
-        (result.out ? ` → ${result.out}` : "") +
-        (inject ? " (injected into process.env)" : ""),
-    );
-    return;
-  }
-
-  printHelp();
-  process.exit(1);
-}
-
-main().catch((err) => {
-  console.error(err instanceof Error ? err.message : err);
-  process.exit(1);
-});
+#!/usr/bin/env node
+import { createClientFromEnv } from "./client.js";
+import { createEnv, ensureEnvironment, pullVault } from "./index.js";
+
+type Flags = Record<string, string | boolean | string[]>;
+
+function parseArgs(argv: string[]): { cmd: string; flags: Flags } {
+  const [cmd = "help", ...rest] = argv;
+  const flags: Flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i];
+    if (!token?.startsWith("--")) continue;
+    const key = token.slice(2);
+    const next = rest[i + 1];
+    if (!next || next.startsWith("--")) {
+      flags[key] = true;
+      continue;
+    }
+    if (key === "var") {
+      const list = Array.isArray(flags.var) ? flags.var : [];
+      list.push(next);
+      flags.var = list;
+    } else {
+      flags[key] = next;
+    }
+    i++;
+  }
+  return { cmd, flags };
+}
+
+function str(flags: Flags, key: string, fallback?: string): string {
+  const v = flags[key];
+  if (typeof v === "string" && v.length > 0) return v;
+  if (fallback !== undefined) return fallback;
+  throw new Error(`Missing --${key}`);
+}
+
+function printHelp(): void {
+  console.log(`@clicadigital/vault-sdk — cria e carrega envs via URL do vault na VPN
+
+Usage:
+  vault-sdk create --project <name> --env <name> [--url <vpn-url>] [--var KEY=VAL]...
+  vault-sdk ensure --project <name> --env <name> [--url <vpn-url>]
+  vault-sdk pull   --project <name> --env <name> [--out .env] [--no-inject] [--url <vpn-url>]
+
+Env:
+  VAULT_URL            opcional; default k8s: http://vault-api-service.vault.svc.cluster.local:3001
+  VAULT_PROJECT        default --project
+  VAULT_ENV            default --env
+  VAULT_SA_TOKEN_PATH  path do token SA (default: /var/run/secrets/tokens/vault/token)
+
+Auth no k3s: ServiceAccount token (audience=vault) + NetworkPolicy.
+Local (VAULT_AUTH=none na API): sem token.
+`);
+}
+
+function applyUrl(flags: Flags): void {
+  if (typeof flags.url === "string") process.env.VAULT_URL = flags.url;
+}
+
+function parseVarList(flags: Flags): Record<string, string> {
+  const out: Record<string, string> = {};
+  const list = Array.isArray(flags.var) ? flags.var : [];
+  for (const pair of list) {
+    const eq = pair.indexOf("=");
+    if (eq < 1) throw new Error(`Invalid --var ${pair} (use KEY=VALUE)`);
+    out[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  return out;
+}
+
+async function main(): Promise<void> {
+  const { cmd, flags } = parseArgs(process.argv.slice(2));
+
+  if (cmd === "help" || flags.help === true) {
+    printHelp();
+    return;
+  }
+
+  applyUrl(flags);
+
+  const project = str(flags, "project", process.env.VAULT_PROJECT);
+  const env = str(flags, "env", process.env.VAULT_ENV);
+  const url = typeof flags.url === "string" ? flags.url : undefined;
+  const client = url
+    ? createClientFromEnv({ ...process.env, VAULT_URL: url })
+    : undefined;
+
+  if (cmd === "create") {
+    const vars = parseVarList(flags);
+    const result = await createEnv({ project, env, url, vars, client });
+    console.log(JSON.stringify({ project, env, ...result }, null, 2));
+    return;
+  }
+
+  if (cmd === "ensure") {
+    const result = await ensureEnvironment({ project, env, client });
+    console.log(
+      JSON.stringify(
+        {
+          project,
+          env,
+          projectId: result.projectId,
+          environmentId: result.environmentId,
+          createdProject: result.createdProject,
+          createdEnvironment: result.createdEnvironment,
+        },
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+
+  if (cmd === "pull") {
+    const out = typeof flags.out === "string" ? flags.out : undefined;
+    const inject = flags["no-inject"] !== true;
+    const result = await pullVault({ project, env, out, inject, client });
+    console.log(
+      `pulled ${Object.keys(result.vars).length} vars for ${project}/${env}` +
+        (result.out ? ` → ${result.out}` : "") +
+        (inject ? " (injected into process.env)" : ""),
+    );
+    return;
+  }
+
+  printHelp();
+  process.exit(1);
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+});

package/src/client.ts

@@ -1,74 +1,109 @@
-import type { EnvVar, ProjectTree } from "./types.js";
-
-export type VaultClientOptions = {
-  /** Base URL da API do vault na VPN, ex: http://vault-api.vpn.local:3001 */
-  baseUrl: string;
-  fetch?: typeof globalThis.fetch;
-};
-
-export class VaultClient {
-  readonly baseUrl: string;
-  private readonly fetchFn: typeof globalThis.fetch;
-
-  constructor(opts: VaultClientOptions) {
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
-  }
-
-  private async request<T>(path: string, init?: RequestInit): Promise<T> {
-    const res = await this.fetchFn(`${this.baseUrl}${path}`, {
-      ...init,
-      headers: {
-        "content-type": "application/json",
-        ...(init?.headers ?? {}),
-      },
-    });
-    if (!res.ok) {
-      const body = (await res.json().catch(() => null)) as { error?: string } | null;
-      throw new Error(body?.error ?? `Vault API ${res.status} ${path}`);
-    }
-    if (res.status === 204) return undefined as T;
-    return (await res.json()) as T;
-  }
-
-  listProjects(): Promise<ProjectTree[]> {
-    return this.request("/v1/projects");
-  }
-
-  createProject(name: string): Promise<{ id: string; name: string }> {
-    return this.request("/v1/projects", {
-      method: "POST",
-      body: JSON.stringify({ name }),
-    });
-  }
-
-  createEnvironment(projectId: string, name: string): Promise<{ ok: boolean }> {
-    return this.request(`/v1/projects/${projectId}/environments`, {
-      method: "POST",
-      body: JSON.stringify({ name }),
-    });
-  }
-
-  listVars(environmentId: string): Promise<EnvVar[]> {
-    return this.request(`/v1/environments/${environmentId}/vars`);
-  }
-
-  upsertVar(environmentId: string, key: string, value: string): Promise<{ ok: boolean }> {
-    return this.request(`/v1/environments/${environmentId}/vars`, {
-      method: "PUT",
-      body: JSON.stringify({ key, value }),
-    });
-  }
-}
-
-export function createClientFromEnv(
-  env: NodeJS.ProcessEnv = process.env,
-): VaultClient {
-  const baseUrl = env.VAULT_URL ?? env.VAULT_API_URL ?? env.API_URL;
-  if (!baseUrl) {
-    throw new Error(
-      "VAULT_URL is required (URL local da VPN, ex: http://vault-api:3001)",
-    );
-  }
-  return new VaultClient({ baseUrl });
-}
+import { readFileSync, existsSync } from "node:fs";
+import type { EnvVar, ProjectTree } from "./types.js";
+
+const DEFAULT_TOKEN_PATHS = [
+  "/var/run/secrets/tokens/vault/token",
+  "/var/run/secrets/kubernetes.io/serviceaccount/token",
+];
+
+/** DNS interno do Service no k3s (namespace `vault`). Override com VAULT_URL. */
+export const DEFAULT_VAULT_URL =
+  "http://vault-api-service.vault.svc.cluster.local:3001";
+
+export type VaultClientOptions = {
+  /** Base URL da API do vault na VPN. Default: DEFAULT_VAULT_URL */
+  baseUrl: string;
+  /** Bearer token (ServiceAccount projected). Se omitido, tenta ler do filesystem do pod. */
+  token?: string;
+  /** Paths para procurar o token SA (ordem de prioridade). */
+  tokenPaths?: string[];
+  fetch?: typeof globalThis.fetch;
+};
+
+function resolveToken(opts: VaultClientOptions): string | undefined {
+  if (opts.token) return opts.token;
+  const paths = opts.tokenPaths ?? DEFAULT_TOKEN_PATHS;
+  for (const path of paths) {
+    if (!existsSync(path)) continue;
+    try {
+      const token = readFileSync(path, "utf8").trim();
+      if (token) return token;
+    } catch {
+      // ignore unreadable path
+    }
+  }
+  return undefined;
+}
+
+export class VaultClient {
+  readonly baseUrl: string;
+  private readonly token: string | undefined;
+  private readonly fetchFn: typeof globalThis.fetch;
+
+  constructor(opts: VaultClientOptions) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.token = resolveToken(opts);
+    this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+
+  private async request<T>(path: string, init?: RequestInit): Promise<T> {
+    const headers: Record<string, string> = {
+      "content-type": "application/json",
+      ...(init?.headers as Record<string, string> | undefined),
+    };
+    if (this.token) headers.authorization = `Bearer ${this.token}`;
+
+    const res = await this.fetchFn(`${this.baseUrl}${path}`, {
+      ...init,
+      headers,
+    });
+    if (!res.ok) {
+      const body = (await res.json().catch(() => null)) as { error?: string } | null;
+      throw new Error(body?.error ?? `Vault API ${res.status} ${path}`);
+    }
+    if (res.status === 204) return undefined as T;
+    return (await res.json()) as T;
+  }
+
+  listProjects(): Promise<ProjectTree[]> {
+    return this.request("/v1/projects");
+  }
+
+  createProject(name: string): Promise<{ id: string; name: string }> {
+    return this.request("/v1/projects", {
+      method: "POST",
+      body: JSON.stringify({ name }),
+    });
+  }
+
+  createEnvironment(projectId: string, name: string): Promise<{ ok: boolean }> {
+    return this.request(`/v1/projects/${projectId}/environments`, {
+      method: "POST",
+      body: JSON.stringify({ name }),
+    });
+  }
+
+  listVars(environmentId: string): Promise<EnvVar[]> {
+    return this.request(`/v1/environments/${environmentId}/vars`);
+  }
+
+  upsertVar(environmentId: string, key: string, value: string): Promise<{ ok: boolean }> {
+    return this.request(`/v1/environments/${environmentId}/vars`, {
+      method: "PUT",
+      body: JSON.stringify({ key, value }),
+    });
+  }
+}
+
+export function createClientFromEnv(
+  env: NodeJS.ProcessEnv = process.env,
+): VaultClient {
+  const baseUrl =
+    env.VAULT_URL ?? env.VAULT_API_URL ?? env.API_URL ?? DEFAULT_VAULT_URL;
+  const tokenPath = env.VAULT_SA_TOKEN_PATH;
+  return new VaultClient({
+    baseUrl,
+    token: env.VAULT_SA_TOKEN,
+    tokenPaths: tokenPath ? [tokenPath, ...DEFAULT_TOKEN_PATHS] : undefined,
+  });
+}

package/src/dotenv.ts

@@ -1,22 +1,22 @@
-export function toDotEnv(vars: Record<string, string>): string {
-  return (
-    Object.entries(vars)
-      .sort(([a], [b]) => a.localeCompare(b))
-      .map(([key, value]) => `${key}=${escapeEnvValue(value)}`)
-      .join("\n") + "\n"
-  );
-}
-
-function escapeEnvValue(value: string): string {
-  if (value === "") return '""';
-  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value)) return value;
-  return JSON.stringify(value);
-}
-
-export function varsToRecord(
-  rows: { key: string; value: string }[],
-): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const row of rows) out[row.key] = row.value;
-  return out;
-}
+export function toDotEnv(vars: Record<string, string>): string {
+  return (
+    Object.entries(vars)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([key, value]) => `${key}=${escapeEnvValue(value)}`)
+      .join("\n") + "\n"
+  );
+}
+
+function escapeEnvValue(value: string): string {
+  if (value === "") return '""';
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value)) return value;
+  return JSON.stringify(value);
+}
+
+export function varsToRecord(
+  rows: { key: string; value: string }[],
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const row of rows) out[row.key] = row.value;
+  return out;
+}