@crewhaus/secrets-manager 0.1.3 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/secrets-manager",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "Pluggable secrets backend with rotation + audit-log integration: env-var, file, vault",
   "main": "src/index.ts",
@@ -12,9 +12,9 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/audit-log": "0.1.3",
-    "@crewhaus/errors": "0.1.3",
-    "@crewhaus/logging": "0.1.3"
+    "@crewhaus/audit-log": "0.1.4",
+    "@crewhaus/errors": "0.1.4",
+    "@crewhaus/logging": "0.1.4"
   },
   "license": "Apache-2.0",
   "author": {

package/src/backends/file.test.ts

@@ -54,6 +54,9 @@ mock.module("node:fs", () => ({
     }
     fsState.renames.push({ from, to });
   },
+  mkdirSync: (p: string, _opts?: { recursive?: boolean; mode?: number }) => {
+    fsState.dirs.add(p);
+  },
   readdirSync: (p: string) => {
     if (!fsState.dirs.has(p)) {
       const err = new Error(`ENOENT: no such dir ${p}`) as NodeJS.ErrnoException;
@@ -152,6 +155,18 @@ describe("file backend — rotate()", () => {
     expect(backend.rotate("path/with/slash")).rejects.toBeInstanceOf(SecretsError);
     expect(fsState.writes.length).toBe(0);
   });
+
+  test("creates the root dir on first rotate instead of failing with ENOENT", async () => {
+    const freshRoot = "/fake/brand-new/secrets";
+    expect(fsState.dirs.has(freshRoot)).toBe(false);
+    const backend = createFileBackend({ rootDir: freshRoot });
+
+    const v = await backend.rotate("TOKEN", { newValue: "fresh" });
+
+    expect(v).toBe("fresh");
+    expect(fsState.dirs.has(freshRoot)).toBe(true);
+    expect(fsState.files.get(`${freshRoot}/TOKEN`)?.content).toBe("fresh");
+  });
 });
 
 describe("file backend — list()", () => {

package/src/backends/file.ts

@@ -6,7 +6,14 @@
  * trailing newline-stripping ambiguity). Whitespace is preserved as-is
  * for tokens that may legitimately contain it.
  */
-import { existsSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
 import { join } from "node:path";
 import { type SecretValue, type SecretsBackend, SecretsError } from "../index";
 
@@ -37,6 +44,11 @@ export function createFileBackend(opts: FileBackendOptions): SecretsBackend {
     async rotate(name: string, rotateOpts): Promise<SecretValue> {
       const p = pathFor(name);
       const newValue = rotateOpts?.newValue ?? generateRandomSecret();
+      // Create the secrets root on first use so a fresh checkout can rotate a
+      // secret without a raw ENOENT — recursive mkdir is a no-op when it
+      // already exists. 0o700 keeps the directory owner-only, consistent with
+      // the 0o600 secret files written into it.
+      mkdirSync(rootDir, { recursive: true, mode: 0o700 });
       const tmp = `${p}.tmp`;
       writeFileSync(tmp, newValue, { encoding: "utf8", mode: 0o600 });
       renameSync(tmp, p);