@middy/secrets-manager 5.0.0-alpha.0 → 5.0.0-alpha.2

package/README.md

@@ -19,8 +19,9 @@
   <a href="https://snyk.io/test/github/middyjs/middy">
     <img src="https://snyk.io/test/github/middyjs/middy/badge.svg" alt="Known Vulnerabilities" data-canonical-src="https://snyk.io/test/github/middyjs/middy" style="max-width:100%;">
   </a>
-  <a href="https://lgtm.com/projects/g/middyjs/middy/context:javascript">
-    <img src="https://img.shields.io/lgtm/grade/javascript/g/middyjs/middy.svg?logo=lgtm&logoWidth=18" alt="Language grade: JavaScript" style="max-width:100%;">
+  <a href="https://github.com/middyjs/middy/actions/workflows/sast.yml">
+    <img src="https://github.com/middyjs/middy/actions/workflows/sast.yml/badge.svg
+?branch=main&event=push" alt="CodeQL" style="max-width:100%;">
   </a>
   <a href="https://bestpractices.coreinfrastructure.org/projects/5280">
     <img src="https://bestpractices.coreinfrastructure.org/projects/5280/badge" alt="Core Infrastructure Initiative (CII) Best Practices"  style="max-width:100%;">

package/index.d.ts

@@ -3,20 +3,41 @@ import { Options as MiddyOptions } from '@middy/util'
 import { Context as LambdaContext } from 'aws-lambda'
 import { SecretsManagerClient, SecretsManagerClientConfig } from '@aws-sdk/client-secrets-manager'
 
-interface Options<AwsSecretsManagerClient = SecretsManagerClient>
-  extends MiddyOptions<
+export type SecretType<T> = string & { __returnType?: T }
+export declare function secret<T> (path: string): SecretType<T>
+
+interface SecretsManagerOptions<AwsSecretsManagerClient = SecretsManagerClient>
+  extends Omit<MiddyOptions<
   AwsSecretsManagerClient,
   SecretsManagerClientConfig
-  > {}
-
-export type Context<TOptions extends Options | undefined> = TOptions extends {
-  setToContext: true
+  >, 'fetchData'> {
+  fetchData?: { [key: string]: string | SecretType<unknown> }
 }
-  ? LambdaContext & Record<keyof TOptions['fetchData'], any>
-  : LambdaContext
 
-declare function secretsManager<TOptions extends Options | undefined> (
+export type Context<TOptions extends SecretsManagerOptions | undefined> =
+  TOptions extends { setToContext: true }
+    ? TOptions extends { fetchData: infer TFetchData }
+      ? LambdaContext & {
+        [Key in keyof TFetchData]: TFetchData[Key] extends SecretType<infer T>
+          ? T
+          : unknown
+      }
+      : never
+    : LambdaContext
+
+export type Internal<TOptions extends SecretsManagerOptions | undefined> =
+    TOptions extends SecretsManagerOptions
+      ? TOptions extends { fetchData: infer TFetchData }
+        ? {
+            [Key in keyof TFetchData]: TFetchData[Key] extends SecretType<infer T>
+              ? T
+              : unknown
+          }
+        : {}
+      : {}
+
+declare function secretsManager<TOptions extends SecretsManagerOptions | undefined> (
   options?: TOptions
-): middy.MiddlewareObj<unknown, any, Error, Context<TOptions>>
+): middy.MiddlewareObj<unknown, any, Error, Context<TOptions>, Internal<TOptions>>
 
 export default secretsManager

package/index.js

@@ -1,13 +1,15 @@
 import { canPrefetch, createPrefetchClient, createClient, getCache, getInternal, processCache, modifyCache, jsonSafeParse } from '@middy/util';
-import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
+import { SecretsManagerClient, DescribeSecretCommand, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
 const defaults = {
     AwsClient: SecretsManagerClient,
     awsClientOptions: {},
     awsClientAssumeRole: undefined,
     awsClientCapture: undefined,
     fetchData: {},
+    fetchRotationDate: false,
     disablePrefetch: false,
     cacheKey: 'secrets-manager',
+    cacheKeyExpiry: {},
     cacheExpiry: -1,
     setToContext: false
 };
@@ -20,9 +22,21 @@ const secretsManagerMiddleware = (opts = {})=>{
         const values = {};
         for (const internalKey of Object.keys(options.fetchData)){
             if (cachedValues[internalKey]) continue;
-            values[internalKey] = client.send(new GetSecretValueCommand({
-                SecretId: options.fetchData[internalKey]
-            })).then((resp)=>jsonSafeParse(resp.SecretString)).catch((e)=>{
+            values[internalKey] = Promise.resolve().then(()=>{
+                if (options.fetchRotationDate === true || options.fetchRotationDate?.[internalKey]) {
+                    return client.send(new DescribeSecretCommand({
+                        SecretId: options.fetchData[internalKey]
+                    })).then((resp)=>{
+                        if (options.cacheExpiry < 0) {
+                            options.cacheKeyExpiry[internalKey] = resp.NextRotationDate * 1000;
+                        } else {
+                            options.cacheKeyExpiry[internalKey] = Math.min(Math.max(resp.LastRotationDate, resp.LastChangedDate) * 1000 + options.cacheExpiry, resp.NextRotationDate * 1000);
+                        }
+                    });
+                }
+            }).then(()=>client.send(new GetSecretValueCommand({
+                    SecretId: options.fetchData[internalKey]
+                }))).then((resp)=>jsonSafeParse(resp.SecretString)).catch((e)=>{
                 const value = getCache(options.cacheKey).value ?? {};
                 value[internalKey] = undefined;
                 modifyCache(options.cacheKey, value);
@@ -31,26 +45,29 @@ const secretsManagerMiddleware = (opts = {})=>{
         }
         return values;
     };
-    let prefetch, client;
+    let client;
     if (canPrefetch(options)) {
         client = createPrefetchClient(options);
-        prefetch = processCache(options, fetch);
+        processCache(options, fetch);
     }
     const secretsManagerMiddlewareBefore = async (request)=>{
         if (!client) {
             client = await createClient(options, request);
         }
-        const { value  } = prefetch ?? processCache(options, fetch, request);
+        const { value } = processCache(options, fetch, request);
         Object.assign(request.internal, value);
         if (options.setToContext) {
             const data = await getInternal(Object.keys(options.fetchData), request);
             Object.assign(request.context, data);
         }
-        prefetch = null;
     };
     return {
         before: secretsManagerMiddlewareBefore
     };
 };
 export default secretsManagerMiddleware;
+// used for TS type inference (see index.d.ts)
+export function secret(name) {
+    return name;
+}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@middy/secrets-manager",
-  "version": "5.0.0-alpha.0",
+  "version": "5.0.0-alpha.2",
   "description": "Secrets Manager middleware for the middy framework",
   "type": "module",
   "engines": {
@@ -10,24 +10,18 @@
   "publishConfig": {
     "access": "public"
   },
-  "main": "./index.cjs",
   "module": "./index.js",
   "exports": {
     ".": {
       "import": {
         "types": "./index.d.ts",
         "default": "./index.js"
-      },
-      "require": {
-        "types": "./index.d.ts",
-        "default": "./index.cjs"
       }
     }
   },
   "types": "index.d.ts",
   "files": [
     "index.js",
-    "index.cjs",
     "index.d.ts"
   ],
   "scripts": {
@@ -64,13 +58,13 @@
     "url": "https://github.com/sponsors/willfarrell"
   },
   "dependencies": {
-    "@middy/util": "5.0.0-alpha.0"
+    "@middy/util": "5.0.0-alpha.2"
   },
   "devDependencies": {
     "@aws-sdk/client-secrets-manager": "^3.0.0",
-    "@middy/core": "5.0.0-alpha.0",
+    "@middy/core": "5.0.0-alpha.2",
     "@types/aws-lambda": "^8.10.101",
     "aws-xray-sdk": "^3.3.3"
   },
-  "gitHead": "08c35e3dba9efdad0b86666ce206ce302cc65d07"
+  "gitHead": "ebce8d5df8783077fa49ba62ee9be20e8486a7f1"
 }

package/index.cjs

@@ -1,64 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(module, "exports", {
-    enumerable: true,
-    get: ()=>_default
-});
-const _util = require("@middy/util");
-const _clientSecretsManager = require("@aws-sdk/client-secrets-manager");
-const defaults = {
-    AwsClient: _clientSecretsManager.SecretsManagerClient,
-    awsClientOptions: {},
-    awsClientAssumeRole: undefined,
-    awsClientCapture: undefined,
-    fetchData: {},
-    disablePrefetch: false,
-    cacheKey: 'secrets-manager',
-    cacheExpiry: -1,
-    setToContext: false
-};
-const secretsManagerMiddleware = (opts = {})=>{
-    const options = {
-        ...defaults,
-        ...opts
-    };
-    const fetch = (request, cachedValues = {})=>{
-        const values = {};
-        for (const internalKey of Object.keys(options.fetchData)){
-            if (cachedValues[internalKey]) continue;
-            values[internalKey] = client.send(new _clientSecretsManager.GetSecretValueCommand({
-                SecretId: options.fetchData[internalKey]
-            })).then((resp)=>(0, _util.jsonSafeParse)(resp.SecretString)).catch((e)=>{
-                const value = (0, _util.getCache)(options.cacheKey).value ?? {};
-                value[internalKey] = undefined;
-                (0, _util.modifyCache)(options.cacheKey, value);
-                throw e;
-            });
-        }
-        return values;
-    };
-    let prefetch, client;
-    if ((0, _util.canPrefetch)(options)) {
-        client = (0, _util.createPrefetchClient)(options);
-        prefetch = (0, _util.processCache)(options, fetch);
-    }
-    const secretsManagerMiddlewareBefore = async (request)=>{
-        if (!client) {
-            client = await (0, _util.createClient)(options, request);
-        }
-        const { value  } = prefetch ?? (0, _util.processCache)(options, fetch, request);
-        Object.assign(request.internal, value);
-        if (options.setToContext) {
-            const data = await (0, _util.getInternal)(Object.keys(options.fetchData), request);
-            Object.assign(request.context, data);
-        }
-        prefetch = null;
-    };
-    return {
-        before: secretsManagerMiddlewareBefore
-    };
-};
-const _default = secretsManagerMiddleware;
-