@kirschbaum-development/sst-laravel 0.2.11 → 0.2.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kirschbaum-development/sst-laravel",
-  "version": "0.2.11",
+  "version": "0.2.14",
   "type": "module",
   "description": "An unofficial extension of SST to deploy containerized Laravel applications to AWS Fargate.",
   "main": "laravel-sst.ts",

package/src/remote-env-file.ts

@@ -1,7 +1,4 @@
-import * as fs from 'fs';
-import * as path from 'path';
 import { CustomResourceOptions, Input, dynamic } from '@pulumi/pulumi';
-import { pullSecrets, toEnvFileContent } from './secrets-manager';
 
 export interface RemoteEnvFileLinkedSecret {
   name: Input<string>;
@@ -43,7 +40,9 @@ const provider: dynamic.ResourceProvider<ResolvedRemoteEnvFileInputs, ResolvedRe
 
   async diff(_, olds, news) {
     return {
-      changes: stableStringify(olds) !== stableStringify(news),
+      changes:
+        stableStringify(olds) !== stableStringify(news) ||
+        !(await matchesEnvironmentFile(news)),
     };
   },
 
@@ -67,7 +66,9 @@ export class RemoteEnvFile extends dynamic.Resource {
 }
 
 async function writeRemoteEnvironmentFile(inputs: ResolvedRemoteEnvFileInputs) {
-  const secrets = await pullSecrets(inputs.secretPath);
+  const fs = await import('node:fs');
+  const path = await import('node:path');
+  const secrets = await pullSecretsFromAws(inputs.secretPath);
 
   if (!secrets) {
     throw new Error(`RemoteEnvVault secret not found at ${inputs.secretPath}.`);
@@ -84,6 +85,93 @@ async function writeRemoteEnvironmentFile(inputs: ResolvedRemoteEnvFileInputs) {
   };
 }
 
+async function matchesEnvironmentFile(inputs: ResolvedRemoteEnvFileInputs) {
+  const fs = await import('node:fs');
+
+  if (!fs.existsSync(inputs.envFilePath)) {
+    return false;
+  }
+
+  const secrets = await pullSecretsFromAws(inputs.secretPath);
+
+  if (!secrets) {
+    return false;
+  }
+
+  const expected = buildEnvFileContent(secrets, inputs) + '\n';
+  const actual = fs.readFileSync(inputs.envFilePath, 'utf8');
+
+  return actual === expected;
+}
+
+async function pullSecretsFromAws(secretPath: string): Promise<Record<string, string> | null> {
+  const secretValue = await getSecretValue(secretPath);
+
+  if (!secretValue) {
+    return null;
+  }
+
+  const data = JSON.parse(secretValue);
+
+  if (isChunkedSecret(data)) {
+    return pullChunkedSecrets(secretPath, data.chunks);
+  }
+
+  return data;
+}
+
+async function pullChunkedSecrets(basePath: string, chunkCount: number): Promise<Record<string, string>> {
+  const allVars: Record<string, string> = {};
+  const chunkPromises = Array.from({ length: chunkCount }, (_, i) =>
+    getSecretValue(getChunkPath(basePath, i + 1))
+  );
+
+  const chunkValues = await Promise.all(chunkPromises);
+
+  for (let i = 0; i < chunkValues.length; i++) {
+    const chunkValue = chunkValues[i];
+
+    if (chunkValue) {
+      Object.assign(allVars, JSON.parse(chunkValue));
+    } else {
+      console.warn(`Warning: Chunk ${i + 1} not found at ${getChunkPath(basePath, i + 1)}`);
+    }
+  }
+
+  return allVars;
+}
+
+async function getSecretValue(secretPath: string): Promise<string | null> {
+  const { SecretsManagerClient, GetSecretValueCommand } = await import('@aws-sdk/client-secrets-manager');
+  const client = new SecretsManagerClient({});
+
+  try {
+    const response = await client.send(new GetSecretValueCommand({
+      SecretId: secretPath,
+    }));
+
+    return response.SecretString || null;
+  } catch (error) {
+    if (isResourceNotFound(error)) {
+      return null;
+    }
+
+    throw error;
+  }
+}
+
+function isChunkedSecret(data: any): data is { chunked: true; chunks: number } {
+  return data && typeof data === 'object' && data.chunked === true && typeof data.chunks === 'number';
+}
+
+function isResourceNotFound(error: unknown): boolean {
+  return !!error && typeof error === 'object' && 'name' in error && error.name === 'ResourceNotFoundException';
+}
+
+function getChunkPath(basePath: string, chunkIndex: number): string {
+  return `${basePath}/${chunkIndex}`;
+}
+
 function buildEnvFileContent(
   secrets: Record<string, string>,
   inputs: ResolvedRemoteEnvFileInputs,
@@ -125,6 +213,23 @@ function buildEnvFileContent(
   ].filter(Boolean).join('\n\n');
 }
 
+function toEnvFileContent(vars: Record<string, string>): string {
+  const sortedKeys = Object.keys(vars).sort();
+
+  return sortedKeys
+    .map((key) => {
+      const value = vars[key];
+
+      if (value.includes(' ') || value.includes('"') || value.includes("'") || value.includes('\n')) {
+        const escaped = value.replace(/"/g, '\\"');
+        return `${key}="${escaped}"`;
+      }
+
+      return `${key}=${value}`;
+    })
+    .join('\n');
+}
+
 function hasOwnVariable(vars: Record<string, string>, key: string) {
   return Object.prototype.hasOwnProperty.call(vars, key);
 }