@koralabs/kora-labs-common 6.7.1 → 6.7.3

package/aws/index.d.ts

@@ -1,3 +1,3 @@
-export { decryptKmsCiphertext, hydrateKmsEnvironment, loadAfterHydratingKmsEnvironment } from './kmsEnvironment';
+export { decryptKmsCiphertext, hydrateKmsEnvironment, isKmsDisabled, loadAfterHydratingKmsEnvironment } from './kmsEnvironment';
 export type { KmsClientLike } from './kmsEnvironment';
 export { signRs256, verifyRs256, isLocalJwtSigner } from './jwtSigner';

package/aws/index.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isLocalJwtSigner = exports.verifyRs256 = exports.signRs256 = exports.loadAfterHydratingKmsEnvironment = exports.hydrateKmsEnvironment = exports.decryptKmsCiphertext = void 0;
+exports.isLocalJwtSigner = exports.verifyRs256 = exports.signRs256 = exports.loadAfterHydratingKmsEnvironment = exports.isKmsDisabled = exports.hydrateKmsEnvironment = exports.decryptKmsCiphertext = void 0;
 var kmsEnvironment_1 = require("./kmsEnvironment");
 Object.defineProperty(exports, "decryptKmsCiphertext", { enumerable: true, get: function () { return kmsEnvironment_1.decryptKmsCiphertext; } });
 Object.defineProperty(exports, "hydrateKmsEnvironment", { enumerable: true, get: function () { return kmsEnvironment_1.hydrateKmsEnvironment; } });
+Object.defineProperty(exports, "isKmsDisabled", { enumerable: true, get: function () { return kmsEnvironment_1.isKmsDisabled; } });
 Object.defineProperty(exports, "loadAfterHydratingKmsEnvironment", { enumerable: true, get: function () { return kmsEnvironment_1.loadAfterHydratingKmsEnvironment; } });
 var jwtSigner_1 = require("./jwtSigner");
 Object.defineProperty(exports, "signRs256", { enumerable: true, get: function () { return jwtSigner_1.signRs256; } });

package/aws/kmsEnvironment.d.ts

@@ -1,6 +1,20 @@
 /// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
 import { KMSClient } from '@aws-sdk/client-kms';
 export type KmsClientLike = Pick<KMSClient, 'send'>;
+/**
+ * True when AWS KMS is intentionally disabled. On the self-hosted deployment there is no
+ * KMS — the environment is decrypted at DEPLOY time by SOPS/age (the bootstrap) and handed
+ * to the process as plaintext, so there is nothing to decrypt at runtime. Set
+ * KORA_KMS_DISABLED=true there. Legacy AWS deploys leave it unset and keep using KMS.
+ */
+export declare const isKmsDisabled: (env?: NodeJS.ProcessEnv) => boolean;
 export declare function decryptKmsCiphertext(ciphertext: string, client?: KmsClientLike): Promise<string>;
 export declare function hydrateKmsEnvironment({ env, client, keys }?: {
     env?: NodeJS.ProcessEnv;

package/aws/kmsEnvironment.js

@@ -1,8 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadAfterHydratingKmsEnvironment = exports.hydrateKmsEnvironment = exports.decryptKmsCiphertext = void 0;
+exports.loadAfterHydratingKmsEnvironment = exports.hydrateKmsEnvironment = exports.decryptKmsCiphertext = exports.isKmsDisabled = void 0;
 const client_kms_1 = require("@aws-sdk/client-kms");
 const KMS_ENV_BUNDLE_KEY = 'KMS_ENV_BUNDLE_ENC';
+const KMS_DISABLED_KEY = 'KORA_KMS_DISABLED';
+/**
+ * True when AWS KMS is intentionally disabled. On the self-hosted deployment there is no
+ * KMS — the environment is decrypted at DEPLOY time by SOPS/age (the bootstrap) and handed
+ * to the process as plaintext, so there is nothing to decrypt at runtime. Set
+ * KORA_KMS_DISABLED=true there. Legacy AWS deploys leave it unset and keep using KMS.
+ */
+const isKmsDisabled = (env = process.env) => env[KMS_DISABLED_KEY] === 'true' || env[KMS_DISABLED_KEY] === '1';
+exports.isKmsDisabled = isKmsDisabled;
 async function decryptKmsCiphertext(ciphertext, client = new client_kms_1.KMSClient({})) {
     const response = await client.send(new client_kms_1.DecryptCommand({
         CiphertextBlob: Buffer.from(ciphertext, 'base64')
@@ -13,11 +22,29 @@ async function decryptKmsCiphertext(ciphertext, client = new client_kms_1.KMSCli
     return Buffer.from(response.Plaintext).toString('utf8');
 }
 exports.decryptKmsCiphertext = decryptKmsCiphertext;
-async function hydrateKmsEnvironment({ env = process.env, client = new client_kms_1.KMSClient({}), keys } = {}) {
+async function hydrateKmsEnvironment({ env = process.env, client, keys } = {}) {
+    // Self-host: SOPS/age decrypts the env at deploy time, so the values are already
+    // plaintext and there is no KMS to call. Skip decryption entirely (don't even
+    // construct a KMS client). Warn — but don't fail — if a *_ENC ciphertext (or the
+    // bundle) is present without its plaintext counterpart: that means an encrypted value
+    // was left in the env instead of supplying the decrypted one via SOPS.
+    if ((0, exports.isKmsDisabled)(env)) {
+        const undecrypted = [
+            ...(env[KMS_ENV_BUNDLE_KEY] ? [KMS_ENV_BUNDLE_KEY] : []),
+            ...Object.keys(env).filter((k) => k.endsWith('_ENC') && k !== KMS_ENV_BUNDLE_KEY && !env[k.slice(0, -4)])
+        ];
+        if (undecrypted.length) {
+            // eslint-disable-next-line no-console
+            console.warn(`[kmsEnvironment] ${KMS_DISABLED_KEY} set — skipping AWS KMS; supply decrypted ` +
+                `values via SOPS at deploy. Left undecrypted: ${undecrypted.join(', ')}`);
+        }
+        return [];
+    }
     const hydratedKeys = [];
+    const kms = client !== null && client !== void 0 ? client : new client_kms_1.KMSClient({});
     const bundleCiphertext = env[KMS_ENV_BUNDLE_KEY];
     if (bundleCiphertext) {
-        const plaintext = await decryptKmsCiphertext(bundleCiphertext, client);
+        const plaintext = await decryptKmsCiphertext(bundleCiphertext, kms);
         let bundle;
         try {
             bundle = JSON.parse(plaintext);
@@ -51,7 +78,7 @@ async function hydrateKmsEnvironment({ env = process.env, client = new client_km
         if (!ciphertext) {
             continue;
         }
-        env[key] = await decryptKmsCiphertext(ciphertext, client);
+        env[key] = await decryptKmsCiphertext(ciphertext, kms);
         hydratedKeys.push(key);
     }
     return hydratedKeys;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@koralabs/kora-labs-common",
-    "version": "6.7.1",
+    "version": "6.7.3",
     "description": "Kora Labs Common Utilities",
     "main": "index.js",
     "types": "index.d.ts",