@crewhaus/secrets-manager 0.1.4 → 0.1.6

package/src/backends/file.test.ts

@@ -1,194 +0,0 @@
-/**
- * Section 27 — `file` backend coverage.
- *
- * `node:fs` is fully mocked with an in-memory store so no real disk I/O
- * occurs (no tmp dirs, no leaked handles, deterministic). `crypto` is the
- * real WebCrypto for the auto-generate path, but we only assert its shape
- * (64 hex chars), so it stays deterministic in intent. `mock.restore()` does
- * NOT undo `mock.module`, and Bun shares one module registry across all test
- * files (nondeterministic order) — so the `afterAll` below reinstalls the
- * real `node:fs`, keeping the in-memory fake from leaking into sibling files.
- */
-import { afterAll, afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
-
-// Captured BEFORE the mock below so afterAll can reinstall the real module.
-const realFs = require("node:fs") as typeof import("node:fs");
-
-/** In-memory filesystem state shared with the node:fs mock. */
-type FsState = {
-  files: Map<string, { content: string; mode?: number }>;
-  dirs: Set<string>;
-  writes: Array<{ path: string; content: string; mode?: number }>;
-  renames: Array<{ from: string; to: string }>;
-};
-
-let fsState: FsState;
-
-function freshState(): FsState {
-  return { files: new Map(), dirs: new Set(), writes: [], renames: [] };
-}
-
-// Initialise before the module under test is imported.
-fsState = freshState();
-
-mock.module("node:fs", () => ({
-  existsSync: (p: string) => fsState.files.has(p) || fsState.dirs.has(p),
-  readFileSync: (p: string, _enc?: string) => {
-    const f = fsState.files.get(p);
-    if (!f) {
-      const err = new Error(`ENOENT: no such file ${p}`) as NodeJS.ErrnoException;
-      err.code = "ENOENT";
-      throw err;
-    }
-    return f.content;
-  },
-  writeFileSync: (p: string, data: string, opts?: { mode?: number }) => {
-    fsState.files.set(p, { content: data, mode: opts?.mode });
-    fsState.writes.push({ path: p, content: data, mode: opts?.mode });
-  },
-  renameSync: (from: string, to: string) => {
-    const f = fsState.files.get(from);
-    if (f) {
-      fsState.files.set(to, f);
-      fsState.files.delete(from);
-    }
-    fsState.renames.push({ from, to });
-  },
-  mkdirSync: (p: string, _opts?: { recursive?: boolean; mode?: number }) => {
-    fsState.dirs.add(p);
-  },
-  readdirSync: (p: string) => {
-    if (!fsState.dirs.has(p)) {
-      const err = new Error(`ENOENT: no such dir ${p}`) as NodeJS.ErrnoException;
-      err.code = "ENOENT";
-      throw err;
-    }
-    const prefix = `${p}/`;
-    const out: string[] = [];
-    for (const key of fsState.files.keys()) {
-      if (key.startsWith(prefix)) out.push(key.slice(prefix.length));
-    }
-    return out;
-  },
-}));
-
-// Import AFTER the mock is registered so the SUT binds to the fake fs.
-const { createFileBackend } = await import("../backends/file");
-const { SecretsError } = await import("../index");
-
-const ROOT = "/fake/secrets";
-
-beforeEach(() => {
-  fsState = freshState();
-  fsState.dirs.add(ROOT);
-});
-
-afterEach(() => {
-  // Reset the in-memory store so each test starts from a clean slate.
-  fsState = freshState();
-});
-
-afterAll(() => {
-  // Reinstall the real module so the in-memory fake cannot outlive this file.
-  mock.module("node:fs", () => realFs);
-});
-
-describe("file backend — get()", () => {
-  test("returns file contents (utf8, whitespace preserved)", async () => {
-    fsState.files.set(`${ROOT}/API_KEY`, { content: "  secret with spaces \n" });
-    const backend = createFileBackend({ rootDir: ROOT });
-    expect(await backend.get("API_KEY")).toBe("  secret with spaces \n");
-  });
-
-  test("throws SecretsError when the file is missing, leaking neither name nor path", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-    expect(backend.get("MISSING")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("MISSING").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      expect(msg).toBe("secret file read failed (not found)");
-      // the secret name and the on-disk path must not appear in the message.
-      expect(msg).not.toContain("MISSING");
-      expect(msg).not.toContain(ROOT);
-    });
-  });
-
-  test("rejects path-traversal names before touching fs, without echoing the name", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-    expect(backend.get("../../etc/passwd")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("../../etc/passwd").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      expect(msg).toContain("invalid secret name");
-      expect(msg).not.toContain("../../etc/passwd");
-    });
-  });
-});
-
-describe("file backend — rotate()", () => {
-  test("writes to a .tmp file (mode 0o600) then renames atomically", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-
-    const v = await backend.rotate("TOKEN", { newValue: "fresh-token" });
-
-    expect(v).toBe("fresh-token");
-    // The committed file holds the new value...
-    expect(fsState.files.get(`${ROOT}/TOKEN`)?.content).toBe("fresh-token");
-    // ...written first to the tmp path with restrictive mode...
-    const tmpWrite = fsState.writes.find((w) => w.path === `${ROOT}/TOKEN.tmp`);
-    expect(tmpWrite).toBeDefined();
-    expect(tmpWrite?.mode).toBe(0o600);
-    // ...and committed via rename(tmp -> final).
-    expect(fsState.renames).toContainEqual({
-      from: `${ROOT}/TOKEN.tmp`,
-      to: `${ROOT}/TOKEN`,
-    });
-  });
-
-  test("auto-generates a 64-char hex secret when newValue is omitted", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-    const v = await backend.rotate("AUTO");
-    expect(v).toMatch(/^[a-f0-9]{64}$/);
-    expect(fsState.files.get(`${ROOT}/AUTO`)?.content).toBe(v);
-  });
-
-  test("rejects malformed names without writing", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-    expect(backend.rotate("path/with/slash")).rejects.toBeInstanceOf(SecretsError);
-    expect(fsState.writes.length).toBe(0);
-  });
-
-  test("creates the root dir on first rotate instead of failing with ENOENT", async () => {
-    const freshRoot = "/fake/brand-new/secrets";
-    expect(fsState.dirs.has(freshRoot)).toBe(false);
-    const backend = createFileBackend({ rootDir: freshRoot });
-
-    const v = await backend.rotate("TOKEN", { newValue: "fresh" });
-
-    expect(v).toBe("fresh");
-    expect(fsState.dirs.has(freshRoot)).toBe(true);
-    expect(fsState.files.get(`${freshRoot}/TOKEN`)?.content).toBe("fresh");
-  });
-});
-
-describe("file backend — list()", () => {
-  test("lists committed secrets, skipping .tmp and dotfiles", async () => {
-    fsState.files.set(`${ROOT}/A`, { content: "1" });
-    fsState.files.set(`${ROOT}/B`, { content: "2" });
-    fsState.files.set(`${ROOT}/C.tmp`, { content: "x" });
-    fsState.files.set(`${ROOT}/.hidden`, { content: "y" });
-    const backend = createFileBackend({ rootDir: ROOT });
-
-    const names = await backend.list?.();
-
-    expect([...(names ?? [])].sort()).toEqual(["A", "B"]);
-  });
-
-  test("returns [] when the root dir does not exist", async () => {
-    const backend = createFileBackend({ rootDir: "/fake/does-not-exist" });
-    expect(await backend.list?.()).toEqual([]);
-  });
-
-  test("returns [] when the root dir exists but is empty", async () => {
-    const backend = createFileBackend({ rootDir: ROOT });
-    expect(await backend.list?.()).toEqual([]);
-  });
-});

package/src/backends/file.ts

@@ -1,69 +0,0 @@
-/**
- * file backend — reads `<rootDir>/<name>` (mode 0o600 enforced on write).
- * Rotation is an atomic rewrite: write to `.<name>.tmp`, then rename.
- *
- * The file content is the raw secret value (no JSON wrapper, no
- * trailing newline-stripping ambiguity). Whitespace is preserved as-is
- * for tokens that may legitimately contain it.
- */
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  readdirSync,
-  renameSync,
-  writeFileSync,
-} from "node:fs";
-import { join } from "node:path";
-import { type SecretValue, type SecretsBackend, SecretsError } from "../index";
-
-export type FileBackendOptions = {
-  /** Default: `.crewhaus/secrets`. */
-  readonly rootDir: string;
-};
-
-export function createFileBackend(opts: FileBackendOptions): SecretsBackend {
-  const rootDir = opts.rootDir;
-
-  function pathFor(name: string): string {
-    if (!/^[A-Za-z0-9_.-]+$/.test(name)) {
-      throw new SecretsError("invalid secret name (must match [A-Za-z0-9_.-]+)");
-    }
-    return join(rootDir, name);
-  }
-
-  return {
-    id: "file",
-    async get(name: string): Promise<SecretValue> {
-      const p = pathFor(name);
-      if (!existsSync(p)) {
-        throw new SecretsError("secret file read failed (not found)");
-      }
-      return readFileSync(p, "utf8");
-    },
-    async rotate(name: string, rotateOpts): Promise<SecretValue> {
-      const p = pathFor(name);
-      const newValue = rotateOpts?.newValue ?? generateRandomSecret();
-      // Create the secrets root on first use so a fresh checkout can rotate a
-      // secret without a raw ENOENT — recursive mkdir is a no-op when it
-      // already exists. 0o700 keeps the directory owner-only, consistent with
-      // the 0o600 secret files written into it.
-      mkdirSync(rootDir, { recursive: true, mode: 0o700 });
-      const tmp = `${p}.tmp`;
-      writeFileSync(tmp, newValue, { encoding: "utf8", mode: 0o600 });
-      renameSync(tmp, p);
-      return newValue;
-    },
-    async list(): Promise<ReadonlyArray<string>> {
-      if (!existsSync(rootDir)) return [];
-      return readdirSync(rootDir).filter((f) => !f.endsWith(".tmp") && !f.startsWith("."));
-    },
-  };
-}
-
-function generateRandomSecret(): string {
-  // 32 bytes hex → 64 chars; sufficient for tokens.
-  const bytes = new Uint8Array(32);
-  crypto.getRandomValues(bytes);
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}

package/src/backends/vault.test.ts

@@ -1,242 +0,0 @@
-/**
- * Section 27 — `vault` backend coverage.
- *
- * No real network: every test injects a deterministic `fetchImpl` that
- * returns canned `Response`s. `VAULT_TOKEN` is saved in beforeEach and
- * restored in afterEach so the surrounding process env is never mutated
- * across tests. No real clock, no leaked handles.
- */
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createVaultBackend } from "../backends/vault";
-import { SecretsError } from "../index";
-
-const ADDR = "http://127.0.0.1:8200";
-
-/** Build a fetch stub plus a record of the calls it observed. */
-function stubFetch(responder: (url: string, init?: RequestInit) => Response) {
-  const calls: Array<{ url: string; init?: RequestInit }> = [];
-  const fetchImpl = (async (url: string, init?: RequestInit) => {
-    calls.push({ url, init });
-    return responder(url, init);
-  }) as unknown as typeof fetch;
-  return { fetchImpl, calls };
-}
-
-let savedToken: string | undefined;
-
-beforeEach(() => {
-  savedToken = process.env["VAULT_TOKEN"];
-  Reflect.deleteProperty(process.env, "VAULT_TOKEN");
-});
-
-afterEach(() => {
-  if (savedToken === undefined) {
-    Reflect.deleteProperty(process.env, "VAULT_TOKEN");
-  } else {
-    process.env["VAULT_TOKEN"] = savedToken;
-  }
-});
-
-describe("vault backend — id + token resolution", () => {
-  test("exposes the vault id", () => {
-    const backend = createVaultBackend({
-      addr: ADDR,
-      token: "t",
-      fetchImpl: (async () => new Response("{}")) as unknown as typeof fetch,
-    });
-    expect(backend.id).toBe("vault");
-  });
-
-  test("falls back to VAULT_TOKEN env when no constructor token is given", async () => {
-    process.env["VAULT_TOKEN"] = "env-token";
-    const { fetchImpl, calls } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: { value: "v" } } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, fetchImpl });
-
-    await backend.get("K");
-
-    const sentToken = (calls[0]?.init?.headers as Record<string, string>)?.["X-Vault-Token"];
-    expect(sentToken).toBe("env-token");
-  });
-
-  test("constructor token wins over VAULT_TOKEN env", async () => {
-    process.env["VAULT_TOKEN"] = "env-token";
-    const { fetchImpl, calls } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: { value: "v" } } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, token: "ctor-token", fetchImpl });
-
-    await backend.get("K");
-
-    const sentToken = (calls[0]?.init?.headers as Record<string, string>)?.["X-Vault-Token"];
-    expect(sentToken).toBe("ctor-token");
-  });
-
-  test("throws when neither constructor token nor VAULT_TOKEN is set", async () => {
-    const { fetchImpl } = stubFetch(() => new Response("{}"));
-    const backend = createVaultBackend({ addr: ADDR, fetchImpl });
-    expect(backend.get("K")).rejects.toBeInstanceOf(SecretsError);
-  });
-});
-
-describe("vault backend — dataUrl name validation", () => {
-  test("get rejects names with illegal characters (no fetch issued)", async () => {
-    const { fetchImpl, calls } = stubFetch(() => new Response("{}"));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("bad name!")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("bad name!").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      expect(msg).toContain("invalid secret name");
-      expect(msg).not.toContain("bad name!");
-    });
-    expect(calls.length).toBe(0);
-  });
-
-  test("rotate rejects names with illegal characters (no fetch issued)", async () => {
-    const { fetchImpl, calls } = stubFetch(() => new Response("{}"));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.rotate("space here")).rejects.toBeInstanceOf(SecretsError);
-    await backend.rotate("space here").catch(() => {});
-    expect(calls.length).toBe(0);
-  });
-
-  test("allows KV-v2 nested paths (slashes are legal)", async () => {
-    const { fetchImpl, calls } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: { value: "nested" } } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(await backend.get("app/db/password")).toBe("nested");
-    expect(calls[0]?.url).toBe(`${ADDR}/v1/secret/data/app/db/password`);
-  });
-
-  test("uses a custom mount point when provided", async () => {
-    const { fetchImpl, calls } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: { value: "v" } } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, mount: "kv2", token: "t", fetchImpl });
-    await backend.get("K");
-    expect(calls[0]?.url).toBe(`${ADDR}/v1/kv2/data/K`);
-  });
-});
-
-describe("vault backend — get() response handling", () => {
-  test("returns the KV-v2 value on 200", async () => {
-    const { fetchImpl } = stubFetch(
-      () =>
-        new Response(JSON.stringify({ data: { data: { value: "vault-secret" } } }), {
-          status: 200,
-        }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(await backend.get("K")).toBe("vault-secret");
-  });
-
-  test("throws SecretsError on 404 (missing secret) without leaking name or url", async () => {
-    const { fetchImpl } = stubFetch(() => new Response("not found", { status: 404 }));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("SENSITIVE_NAME")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("SENSITIVE_NAME").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      expect(msg).toContain("404");
-      expect(msg).not.toContain("SENSITIVE_NAME");
-      // the url embeds the name + addr; it must not appear either.
-      expect(msg).not.toContain(ADDR);
-    });
-  });
-
-  test("throws SecretsError on a non-ok, non-404 status (e.g. 500) with status but no name/body", async () => {
-    const { fetchImpl } = stubFetch(() => new Response("permission denied", { status: 500 }));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("SENSITIVE_NAME")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("SENSITIVE_NAME").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      // status is retained for debugging...
-      expect(msg).toContain("500");
-      // ...but the raw response body and the secret name are redacted.
-      expect(msg).not.toContain("permission denied");
-      expect(msg).not.toContain("SENSITIVE_NAME");
-    });
-  });
-
-  test("throws when KV-v2 body is missing data.data.value", async () => {
-    const { fetchImpl } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: {} } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("SENSITIVE_NAME")).rejects.toBeInstanceOf(SecretsError);
-    await backend.get("SENSITIVE_NAME").catch((e: unknown) => {
-      const msg = (e as Error).message;
-      expect(msg).toContain("missing data.data.value");
-      expect(msg).not.toContain("SENSITIVE_NAME");
-    });
-  });
-
-  test("throws when the value is present but not a string", async () => {
-    const { fetchImpl } = stubFetch(
-      () => new Response(JSON.stringify({ data: { data: { value: 42 } } }), { status: 200 }),
-    );
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("K")).rejects.toBeInstanceOf(SecretsError);
-  });
-
-  test("throws when the response is an empty object (no data key)", async () => {
-    const { fetchImpl } = stubFetch(() => new Response(JSON.stringify({}), { status: 200 }));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.get("K")).rejects.toBeInstanceOf(SecretsError);
-  });
-});
-
-describe("vault backend — rotate()", () => {
-  test("PUTs the supplied newValue and returns it", async () => {
-    let putBody = "";
-    const { fetchImpl, calls } = stubFetch((_url, init) => {
-      if (init?.method === "PUT") {
-        putBody = init.body as string;
-        return new Response("{}", { status: 204 });
-      }
-      return new Response("not found", { status: 404 });
-    });
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-
-    const v = await backend.rotate("KEY", { newValue: "fresh" });
-
-    expect(v).toBe("fresh");
-    expect(JSON.parse(putBody)).toEqual({ data: { value: "fresh" } });
-    const putCall = calls.find((c) => c.init?.method === "PUT");
-    const headers = putCall?.init?.headers as Record<string, string>;
-    expect(headers?.["X-Vault-Token"]).toBe("t");
-    expect(headers?.["Content-Type"]).toBe("application/json");
-  });
-
-  test("auto-generates a 64-char hex secret when newValue is omitted", async () => {
-    let putBody = "";
-    const { fetchImpl } = stubFetch((_url, init) => {
-      putBody = (init?.body as string) ?? "";
-      return new Response("{}", { status: 200 });
-    });
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-
-    const v = await backend.rotate("KEY");
-
-    expect(v).toMatch(/^[a-f0-9]{64}$/);
-    // the generated value is what got PUT to vault
-    expect(JSON.parse(putBody)).toEqual({ data: { value: v } });
-  });
-
-  test("throws SecretsError when the PUT is not ok, with status but no name/body", async () => {
-    const { fetchImpl } = stubFetch(() => new Response("sealed", { status: 503 }));
-    const backend = createVaultBackend({ addr: ADDR, token: "t", fetchImpl });
-    expect(backend.rotate("SENSITIVE_NAME", { newValue: "x" })).rejects.toBeInstanceOf(
-      SecretsError,
-    );
-    await backend.rotate("SENSITIVE_NAME", { newValue: "x" }).catch((e: unknown) => {
-      const msg = (e as Error).message;
-      // status is retained for debugging...
-      expect(msg).toContain("503");
-      // ...but the raw response body and the secret name are redacted.
-      expect(msg).not.toContain("sealed");
-      expect(msg).not.toContain("SENSITIVE_NAME");
-    });
-  });
-});

package/src/backends/vault.ts

@@ -1,85 +0,0 @@
-/**
- * vault backend — HashiCorp Vault KV v2 over HTTP. Reads
- * `<addr>/v1/<mount>/data/<name>` and writes via PUT to the same path.
- *
- * Auth: token via `VAULT_TOKEN` (or constructor option). The simplest
- * path that doesn't need approles or k8s service accounts.
- */
-import { type SecretValue, type SecretsBackend, SecretsError } from "../index";
-
-export type VaultBackendOptions = {
-  /** Vault address (e.g. `http://127.0.0.1:8200`). */
-  readonly addr: string;
-  /** KV v2 mount point (default: `secret`). */
-  readonly mount?: string;
-  /** Vault token. Falls back to `VAULT_TOKEN` env. */
-  readonly token?: string;
-  /** Optional fetch override for tests. */
-  readonly fetchImpl?: typeof fetch;
-};
-
-export function createVaultBackend(opts: VaultBackendOptions): SecretsBackend {
-  const mount = opts.mount ?? "secret";
-  const fetchImpl = opts.fetchImpl ?? fetch;
-
-  function getToken(): string {
-    const t = opts.token ?? process.env["VAULT_TOKEN"];
-    if (!t) {
-      throw new SecretsError(
-        "vault backend requires a token (constructor opts.token or VAULT_TOKEN env)",
-      );
-    }
-    return t;
-  }
-
-  function dataUrl(name: string): string {
-    if (!/^[A-Za-z0-9_/.-]+$/.test(name)) {
-      throw new SecretsError("invalid secret name for vault backend");
-    }
-    return `${opts.addr}/v1/${encodeURIComponent(mount)}/data/${name}`;
-  }
-
-  return {
-    id: "vault",
-    async get(name: string): Promise<SecretValue> {
-      const url = dataUrl(name);
-      const res = await fetchImpl(url, {
-        headers: { "X-Vault-Token": getToken() },
-      });
-      if (res.status === 404) {
-        throw new SecretsError("secret not found in vault (status 404)");
-      }
-      if (!res.ok) {
-        throw new SecretsError(`vault request failed (status ${res.status})`);
-      }
-      const body = (await res.json()) as { data?: { data?: { value?: string } } };
-      const v = body?.data?.data?.value;
-      if (typeof v !== "string") {
-        throw new SecretsError("vault response missing data.data.value (KV v2 expected)");
-      }
-      return v;
-    },
-    async rotate(name: string, rotateOpts): Promise<SecretValue> {
-      const url = dataUrl(name);
-      const newValue = rotateOpts?.newValue ?? generateRandomSecret();
-      const res = await fetchImpl(url, {
-        method: "PUT",
-        headers: {
-          "X-Vault-Token": getToken(),
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ data: { value: newValue } }),
-      });
-      if (!res.ok) {
-        throw new SecretsError(`vault request failed (status ${res.status})`);
-      }
-      return newValue;
-    },
-  };
-}
-
-function generateRandomSecret(): string {
-  const bytes = new Uint8Array(32);
-  crypto.getRandomValues(bytes);
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}