@clicadigital/vault-sdk 0.1.0 → 0.4.0

package/src/cli.ts

@@ -1,132 +1,78 @@
-#!/usr/bin/env node
-import { createClientFromEnv } from "./client.js";
-import { createEnv, ensureEnvironment, pullVault } from "./index.js";
-
-type Flags = Record<string, string | boolean | string[]>;
-
-function parseArgs(argv: string[]): { cmd: string; flags: Flags } {
-  const [cmd = "help", ...rest] = argv;
-  const flags: Flags = {};
-  for (let i = 0; i < rest.length; i++) {
-    const token = rest[i];
-    if (!token?.startsWith("--")) continue;
-    const key = token.slice(2);
-    const next = rest[i + 1];
-    if (!next || next.startsWith("--")) {
-      flags[key] = true;
-      continue;
-    }
-    if (key === "var") {
-      const list = Array.isArray(flags.var) ? flags.var : [];
-      list.push(next);
-      flags.var = list;
-    } else {
-      flags[key] = next;
-    }
-    i++;
-  }
-  return { cmd, flags };
-}
-
-function str(flags: Flags, key: string, fallback?: string): string {
-  const v = flags[key];
-  if (typeof v === "string" && v.length > 0) return v;
-  if (fallback !== undefined) return fallback;
-  throw new Error(`Missing --${key}`);
-}
-
-function printHelp(): void {
-  console.log(`@clicadigital/vault-sdk — cria e carrega envs via URL do vault na VPN
-
-Usage:
-  vault-sdk create --project <name> --env <name> [--url <vpn-url>] [--var KEY=VAL]...
-  vault-sdk ensure --project <name> --env <name> [--url <vpn-url>]
-  vault-sdk pull   --project <name> --env <name> [--out .env] [--no-inject] [--url <vpn-url>]
-
-Env:
-  VAULT_URL       URL do vault no cluster/VPN (ex: http://vault-api:3001)
-  VAULT_PROJECT   default --project
-  VAULT_ENV       default --env
-
-Auth: nenhuma chave — acesso só via rede interna (pods / VPN).
-`);
-}
-
-function applyUrl(flags: Flags): void {
-  if (typeof flags.url === "string") process.env.VAULT_URL = flags.url;
-}
-
-function parseVarList(flags: Flags): Record<string, string> {
-  const out: Record<string, string> = {};
-  const list = Array.isArray(flags.var) ? flags.var : [];
-  for (const pair of list) {
-    const eq = pair.indexOf("=");
-    if (eq < 1) throw new Error(`Invalid --var ${pair} (use KEY=VALUE)`);
-    out[pair.slice(0, eq)] = pair.slice(eq + 1);
-  }
-  return out;
-}
-
-async function main(): Promise<void> {
-  const { cmd, flags } = parseArgs(process.argv.slice(2));
-
-  if (cmd === "help" || flags.help === true) {
-    printHelp();
-    return;
-  }
-
-  applyUrl(flags);
-
-  const project = str(flags, "project", process.env.VAULT_PROJECT);
-  const env = str(flags, "env", process.env.VAULT_ENV);
-  const url = typeof flags.url === "string" ? flags.url : undefined;
-  const client = url
-    ? createClientFromEnv({ ...process.env, VAULT_URL: url })
-    : undefined;
-
-  if (cmd === "create") {
-    const vars = parseVarList(flags);
-    const result = await createEnv({ project, env, url, vars, client });
-    console.log(JSON.stringify({ project, env, ...result }, null, 2));
-    return;
-  }
-
-  if (cmd === "ensure") {
-    const result = await ensureEnvironment({ project, env, client });
-    console.log(
-      JSON.stringify(
-        {
-          project,
-          env,
-          projectId: result.projectId,
-          environmentId: result.environmentId,
-          createdProject: result.createdProject,
-          createdEnvironment: result.createdEnvironment,
-        },
-        null,
-        2,
-      ),
-    );
-    return;
-  }
-
-  if (cmd === "pull") {
-    const out = typeof flags.out === "string" ? flags.out : undefined;
-    const inject = flags["no-inject"] !== true;
-    const result = await pullVault({ project, env, out, inject, client });
-    console.log(
-      `pulled ${Object.keys(result.vars).length} vars for ${project}/${env}` +
-        (result.out ? ` → ${result.out}` : "") +
-        (inject ? " (injected into process.env)" : ""),
-    );
-    return;
-  }
-
-  printHelp();
-  process.exit(1);
-}
-
-main().catch((err) => {
-  console.error(err instanceof Error ? err.message : err);
-  process.exit(1);
-});
+#!/usr/bin/env node
+import { pullVault } from "./index.js";
+
+type Flags = Record<string, string | boolean>;
+
+function parseArgs(argv: string[]): { cmd: string; flags: Flags } {
+  const [cmd = "help", ...rest] = argv;
+  const flags: Flags = {};
+  for (let i = 0; i < rest.length; i++) {
+    const token = rest[i];
+    if (!token?.startsWith("--")) continue;
+    const key = token.slice(2);
+    const next = rest[i + 1];
+    if (!next || next.startsWith("--")) {
+      flags[key] = true;
+      continue;
+    }
+    flags[key] = next;
+    i++;
+  }
+  return { cmd, flags };
+}
+
+function str(flags: Flags, key: string, fallback?: string): string {
+  const value = flags[key];
+  if (typeof value === "string" && value.length > 0) return value;
+  if (fallback !== undefined) return fallback;
+  throw new Error(`Missing --${key}`);
+}
+
+function printHelp(): void {
+  console.log(`@clicadigital/vault-sdk — carrega envs do vault
+
+Usage:
+  vault-sdk pull --project <name> --env <name> [--out .env] [--no-inject] [--url <vpn-url>]
+
+Env:
+  VAULT_URL            opcional; default k8s: http://vault-api-service.vault.svc.cluster.local:3001
+  VAULT_PROJECT        default --project
+  VAULT_ENV            default --env
+  VAULT_SA_TOKEN_PATH  path do token SA (default: /var/run/secrets/tokens/vault/token)
+
+No código: loadVault({ project, env }) injeta em process.env.
+Criar projeto, environment e allow é pela UI do vault.
+`);
+}
+
+async function main(): Promise<void> {
+  const { cmd, flags } = parseArgs(process.argv.slice(2));
+
+  if (cmd === "help" || flags.help === true) {
+    printHelp();
+    return;
+  }
+
+  if (typeof flags.url === "string") process.env.VAULT_URL = flags.url;
+
+  if (cmd !== "pull") {
+    printHelp();
+    process.exit(1);
+  }
+
+  const project = str(flags, "project", process.env.VAULT_PROJECT);
+  const env = str(flags, "env", process.env.VAULT_ENV);
+  const out = typeof flags.out === "string" ? flags.out : undefined;
+  const inject = flags["no-inject"] !== true;
+  const result = await pullVault({ project, env, out, inject });
+  console.log(
+    `pulled ${Object.keys(result.vars).length} vars for ${project}/${env}` +
+      (result.out ? ` → ${result.out}` : "") +
+      (inject ? " (injected into process.env)" : ""),
+  );
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+});

package/src/client.ts

@@ -1,74 +1,85 @@
-import type { EnvVar, ProjectTree } from "./types.js";
-
-export type VaultClientOptions = {
-  /** Base URL da API do vault na VPN, ex: http://vault-api.vpn.local:3001 */
-  baseUrl: string;
-  fetch?: typeof globalThis.fetch;
-};
-
-export class VaultClient {
-  readonly baseUrl: string;
-  private readonly fetchFn: typeof globalThis.fetch;
-
-  constructor(opts: VaultClientOptions) {
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
-  }
-
-  private async request<T>(path: string, init?: RequestInit): Promise<T> {
-    const res = await this.fetchFn(`${this.baseUrl}${path}`, {
-      ...init,
-      headers: {
-        "content-type": "application/json",
-        ...(init?.headers ?? {}),
-      },
-    });
-    if (!res.ok) {
-      const body = (await res.json().catch(() => null)) as { error?: string } | null;
-      throw new Error(body?.error ?? `Vault API ${res.status} ${path}`);
-    }
-    if (res.status === 204) return undefined as T;
-    return (await res.json()) as T;
-  }
-
-  listProjects(): Promise<ProjectTree[]> {
-    return this.request("/v1/projects");
-  }
-
-  createProject(name: string): Promise<{ id: string; name: string }> {
-    return this.request("/v1/projects", {
-      method: "POST",
-      body: JSON.stringify({ name }),
-    });
-  }
-
-  createEnvironment(projectId: string, name: string): Promise<{ ok: boolean }> {
-    return this.request(`/v1/projects/${projectId}/environments`, {
-      method: "POST",
-      body: JSON.stringify({ name }),
-    });
-  }
-
-  listVars(environmentId: string): Promise<EnvVar[]> {
-    return this.request(`/v1/environments/${environmentId}/vars`);
-  }
-
-  upsertVar(environmentId: string, key: string, value: string): Promise<{ ok: boolean }> {
-    return this.request(`/v1/environments/${environmentId}/vars`, {
-      method: "PUT",
-      body: JSON.stringify({ key, value }),
-    });
-  }
-}
-
-export function createClientFromEnv(
-  env: NodeJS.ProcessEnv = process.env,
-): VaultClient {
-  const baseUrl = env.VAULT_URL ?? env.VAULT_API_URL ?? env.API_URL;
-  if (!baseUrl) {
-    throw new Error(
-      "VAULT_URL is required (URL local da VPN, ex: http://vault-api:3001)",
-    );
-  }
-  return new VaultClient({ baseUrl });
-}
+import { readFileSync, existsSync } from "node:fs";
+import type { EnvVar, ProjectTree } from "./types.js";
+
+const DEFAULT_TOKEN_PATHS = [
+  "/var/run/secrets/tokens/vault/token",
+  "/var/run/secrets/kubernetes.io/serviceaccount/token",
+];
+
+/** DNS interno do Service no k3s (namespace `vault`). Override com VAULT_URL. */
+export const DEFAULT_VAULT_URL =
+  "http://vault-api-service.vault.svc.cluster.local:3001";
+
+export type VaultClientOptions = {
+  baseUrl: string;
+  token?: string;
+  tokenPaths?: string[];
+  fetch?: typeof globalThis.fetch;
+};
+
+function resolveToken(opts: VaultClientOptions): string | undefined {
+  if (opts.token) return opts.token;
+  const paths = opts.tokenPaths ?? DEFAULT_TOKEN_PATHS;
+  for (const path of paths) {
+    if (!existsSync(path)) continue;
+    try {
+      const token = readFileSync(path, "utf8").trim();
+      if (token) return token;
+    } catch {
+      // ignore unreadable path
+    }
+  }
+  return undefined;
+}
+
+export class VaultClient {
+  readonly baseUrl: string;
+  private readonly token: string | undefined;
+  private readonly fetchFn: typeof globalThis.fetch;
+
+  constructor(opts: VaultClientOptions) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.token = resolveToken(opts);
+    this.fetchFn = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+
+  private async request<T>(path: string, init?: RequestInit): Promise<T> {
+    const headers: Record<string, string> = {
+      "content-type": "application/json",
+      ...(init?.headers as Record<string, string> | undefined),
+    };
+    if (this.token) headers.authorization = `Bearer ${this.token}`;
+
+    const res = await this.fetchFn(`${this.baseUrl}${path}`, {
+      ...init,
+      headers,
+    });
+    if (!res.ok) {
+      const body = (await res.json().catch(() => null)) as { error?: string } | null;
+      throw new Error(body?.error ?? `Vault API ${res.status} ${path}`);
+    }
+    if (res.status === 204) return undefined as T;
+    return (await res.json()) as T;
+  }
+
+  listProjects(): Promise<ProjectTree[]> {
+    return this.request("/v1/projects");
+  }
+
+  listVars(environmentId: string): Promise<EnvVar[]> {
+    return this.request(`/v1/environments/${environmentId}/vars`);
+  }
+}
+
+export function createClientFromEnv(
+  env: NodeJS.ProcessEnv = process.env,
+): VaultClient {
+  const baseUrl =
+    env.VAULT_URL ?? env.VAULT_API_URL ?? env.API_URL ?? DEFAULT_VAULT_URL;
+  const tokenPath = env.VAULT_SA_TOKEN_PATH;
+  return new VaultClient({
+    baseUrl,
+    token: env.VAULT_SA_TOKEN,
+    tokenPaths: tokenPath ? [tokenPath, ...DEFAULT_TOKEN_PATHS] : undefined,
+  });
+}

package/src/dotenv.ts

@@ -1,22 +1,22 @@
-export function toDotEnv(vars: Record<string, string>): string {
-  return (
-    Object.entries(vars)
-      .sort(([a], [b]) => a.localeCompare(b))
-      .map(([key, value]) => `${key}=${escapeEnvValue(value)}`)
-      .join("\n") + "\n"
-  );
-}
-
-function escapeEnvValue(value: string): string {
-  if (value === "") return '""';
-  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value)) return value;
-  return JSON.stringify(value);
-}
-
-export function varsToRecord(
-  rows: { key: string; value: string }[],
-): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const row of rows) out[row.key] = row.value;
-  return out;
-}
+export function toDotEnv(vars: Record<string, string>): string {
+  return (
+    Object.entries(vars)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([key, value]) => `${key}=${escapeEnvValue(value)}`)
+      .join("\n") + "\n"
+  );
+}
+
+function escapeEnvValue(value: string): string {
+  if (value === "") return '""';
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value)) return value;
+  return JSON.stringify(value);
+}
+
+export function varsToRecord(
+  rows: { key: string; value: string }[],
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const row of rows) out[row.key] = row.value;
+  return out;
+}

package/src/index.ts

@@ -1,167 +1,47 @@
-import { writeFile } from "node:fs/promises";
-import { createClientFromEnv, VaultClient, type VaultClientOptions } from "./client.js";
-import { toDotEnv, varsToRecord } from "./dotenv.js";
-import type { EnvVar, ProjectTree } from "./types.js";
-
-export type { EnvVar, ProjectTree, ProjectTreeEnv } from "./types.js";
-export { VaultClient, createClientFromEnv, type VaultClientOptions };
-export { toDotEnv, varsToRecord };
-
-export type ResolveOptions = {
-  project: string;
-  env: string;
-  client?: VaultClient;
-};
-
-export type EnsureOptions = ResolveOptions & {
-  createProject?: boolean;
-};
-
-export type PullOptions = ResolveOptions & {
-  out?: string;
-  inject?: boolean;
-};
-
-export type CreateEnvOptions = {
-  project: string;
-  env: string;
-  /** URL da API do vault na VPN (cluster-internal) */
-  url?: string;
-  vars?: Record<string, string>;
-  client?: VaultClient;
-};
-
-async function findProject(
-  client: VaultClient,
-  name: string,
-): Promise<ProjectTree | undefined> {
-  const tree = await client.listProjects();
-  return tree.find((p) => p.name === name);
-}
-
-function resolveClient(opts: { client?: VaultClient; url?: string }): VaultClient {
-  if (opts.client) return opts.client;
-  if (opts.url) return new VaultClient({ baseUrl: opts.url });
-  return createClientFromEnv();
-}
-
-export async function resolveEnvironment(
-  opts: ResolveOptions,
-): Promise<{ projectId: string; environmentId: string }> {
-  const client = opts.client ?? createClientFromEnv();
-  const project = await findProject(client, opts.project);
-  if (!project) throw new Error(`Project not found: ${opts.project}`);
-  const environment = project.environments.find((e) => e.name === opts.env);
-  if (!environment) {
-    throw new Error(`Environment "${opts.env}" not found in project "${opts.project}"`);
-  }
-  return { projectId: project.id, environmentId: environment.id };
-}
-
-/** Garante projeto + environment na VPN (cria se não existir). */
-export async function ensureEnvironment(opts: EnsureOptions): Promise<{
-  projectId: string;
-  environmentId: string;
-  createdProject: boolean;
-  createdEnvironment: boolean;
-}> {
-  const client = opts.client ?? createClientFromEnv();
-  let createdProject = false;
-  let createdEnvironment = false;
-
-  let project = await findProject(client, opts.project);
-  if (!project) {
-    if (opts.createProject === false) {
-      throw new Error(`Project not found: ${opts.project}`);
-    }
-    await client.createProject(opts.project);
-    createdProject = true;
-    project = await findProject(client, opts.project);
-    if (!project) throw new Error(`Failed to create project: ${opts.project}`);
-  }
-
-  let environment = project.environments.find((e) => e.name === opts.env);
-  if (!environment) {
-    await client.createEnvironment(project.id, opts.env);
-    createdEnvironment = true;
-    const refreshed = await findProject(client, opts.project);
-    if (!refreshed) throw new Error(`Failed to reload project: ${opts.project}`);
-    project = refreshed;
-    environment = project.environments.find((e) => e.name === opts.env);
-    if (!environment) throw new Error(`Failed to create environment: ${opts.env}`);
-  }
-
-  return {
-    projectId: project.id,
-    environmentId: environment.id,
-    createdProject,
-    createdEnvironment,
-  };
-}
-
-/**
- * Cria (ou garante) o environment no vault via URL da VPN
- * e opcionalmente faz upsert das variáveis.
- */
-export async function createEnv(opts: CreateEnvOptions): Promise<{
-  projectId: string;
-  environmentId: string;
-  createdProject: boolean;
-  createdEnvironment: boolean;
-  upserted: string[];
-}> {
-  const client = resolveClient(opts);
-  const ensured = await ensureEnvironment({
-    project: opts.project,
-    env: opts.env,
-    client,
-  });
-
-  const upserted: string[] = [];
-  if (opts.vars) {
-    for (const [key, value] of Object.entries(opts.vars)) {
-      await client.upsertVar(ensured.environmentId, key, value);
-      upserted.push(key);
-    }
-  }
-
-  return { ...ensured, upserted };
-}
-
-export async function fetchVars(opts: ResolveOptions): Promise<EnvVar[]> {
-  const client = opts.client ?? createClientFromEnv();
-  const { environmentId } = await resolveEnvironment({ ...opts, client });
-  return client.listVars(environmentId);
-}
-
-export async function loadVault(
-  opts: ResolveOptions,
-): Promise<Record<string, string>> {
-  const rows = await fetchVars(opts);
-  const record = varsToRecord(rows);
-  for (const [key, value] of Object.entries(record)) {
-    process.env[key] = value;
-  }
-  return record;
-}
-
-export async function pullVault(opts: PullOptions): Promise<{
-  vars: Record<string, string>;
-  out?: string;
-}> {
-  const rows = await fetchVars(opts);
-  const vars = varsToRecord(rows);
-
-  if (opts.inject !== false) {
-    for (const [key, value] of Object.entries(vars)) {
-      process.env[key] = value;
-    }
-  }
-
-  const out = opts.out;
-  if (out) {
-    await writeFile(out, toDotEnv(vars), "utf8");
-  }
-
-  return out ? { vars, out } : { vars };
-}
+import { writeFile } from "node:fs/promises";
+import { createClientFromEnv } from "./client.js";
+import { toDotEnv, varsToRecord } from "./dotenv.js";
+
+export type LoadVaultOptions = {
+  project: string;
+  env: string;
+};
+
+async function readVars(opts: LoadVaultOptions): Promise<Record<string, string>> {
+  const client = createClientFromEnv();
+  const projects = await client.listProjects();
+  const project = projects.find((item) => item.name === opts.project);
+  if (!project) throw new Error(`Project not found: ${opts.project}`);
+
+  const environment = project.environments.find((item) => item.name === opts.env);
+  if (!environment) {
+    throw new Error(`Environment "${opts.env}" not found in project "${opts.project}"`);
+  }
+
+  const rows = await client.listVars(environment.id);
+  return varsToRecord(rows);
+}
+
+/** Lê o environment e injeta as variáveis em `process.env`. */
+export async function loadVault(opts: LoadVaultOptions): Promise<void> {
+  const vars = await readVars(opts);
+  for (const [key, value] of Object.entries(vars)) {
+    process.env[key] = value;
+  }
+}
+
+export async function pullVault(
+  opts: LoadVaultOptions & { out?: string; inject?: boolean },
+): Promise<{ vars: Record<string, string>; out?: string }> {
+  const vars = await readVars(opts);
+
+  if (opts.inject !== false) {
+    for (const [key, value] of Object.entries(vars)) {
+      process.env[key] = value;
+    }
+  }
+
+  const out = opts.out;
+  if (out) await writeFile(out, toDotEnv(vars), "utf8");
+  return out ? { vars, out } : { vars };
+}

package/src/types.ts

@@ -1,14 +1,14 @@
-export type ProjectTreeEnv = { id: string; name: string };
-
-export type ProjectTree = {
-  id: string;
-  name: string;
-  environments: ProjectTreeEnv[];
-};
-
-export type EnvVar = {
-  id: string;
-  key: string;
-  value: string;
-  updated_at: string;
-};
+export type ProjectTreeEnv = { id: string; name: string };
+
+export type ProjectTree = {
+  id: string;
+  name: string;
+  environments: ProjectTreeEnv[];
+};
+
+export type EnvVar = {
+  id: string;
+  key: string;
+  value: string;
+  updated_at: string;
+};