@middy/secrets-manager 6.1.6 → 6.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/index.d.ts +44 -33
- package/index.js +99 -99
- package/package.json +69 -72
package/index.d.ts
CHANGED
|
@@ -1,43 +1,54 @@
|
|
|
1
|
-
import
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
1
|
+
import type {
|
|
2
|
+
SecretsManagerClient,
|
|
3
|
+
SecretsManagerClientConfig,
|
|
4
|
+
} from "@aws-sdk/client-secrets-manager";
|
|
5
|
+
import type middy from "@middy/core";
|
|
6
|
+
import type { Options as MiddyOptions } from "@middy/util";
|
|
7
|
+
import type { Context as LambdaContext } from "aws-lambda";
|
|
5
8
|
|
|
6
|
-
export type SecretType<T> = string & { __returnType?: T }
|
|
7
|
-
export declare function secret<T>
|
|
9
|
+
export type SecretType<T> = string & { __returnType?: T };
|
|
10
|
+
export declare function secret<T>(path: string): SecretType<T>;
|
|
8
11
|
|
|
9
12
|
interface SecretsManagerOptions<AwsSecretsManagerClient = SecretsManagerClient>
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
13
|
+
extends Omit<
|
|
14
|
+
MiddyOptions<AwsSecretsManagerClient, SecretsManagerClientConfig>,
|
|
15
|
+
"fetchData"
|
|
16
|
+
> {
|
|
17
|
+
fetchData?: { [key: string]: string | SecretType<unknown> };
|
|
15
18
|
}
|
|
16
19
|
|
|
17
20
|
export type Context<TOptions extends SecretsManagerOptions | undefined> =
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
21
|
+
TOptions extends { setToContext: true }
|
|
22
|
+
? TOptions extends { fetchData: infer TFetchData }
|
|
23
|
+
? LambdaContext & {
|
|
24
|
+
[Key in keyof TFetchData]: TFetchData[Key] extends SecretType<infer T>
|
|
25
|
+
? T
|
|
26
|
+
: unknown;
|
|
27
|
+
}
|
|
28
|
+
: never
|
|
29
|
+
: LambdaContext;
|
|
27
30
|
|
|
28
31
|
export type Internal<TOptions extends SecretsManagerOptions | undefined> =
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
32
|
+
TOptions extends SecretsManagerOptions
|
|
33
|
+
? TOptions extends { fetchData: infer TFetchData }
|
|
34
|
+
? {
|
|
35
|
+
[Key in keyof TFetchData]: TFetchData[Key] extends SecretType<infer T>
|
|
36
|
+
? T
|
|
37
|
+
: unknown;
|
|
38
|
+
}
|
|
39
|
+
: {}
|
|
40
|
+
: {};
|
|
38
41
|
|
|
39
|
-
declare function secretsManager<
|
|
40
|
-
|
|
41
|
-
|
|
42
|
+
declare function secretsManager<
|
|
43
|
+
TOptions extends SecretsManagerOptions | undefined,
|
|
44
|
+
>(
|
|
45
|
+
options?: TOptions,
|
|
46
|
+
): middy.MiddlewareObj<
|
|
47
|
+
unknown,
|
|
48
|
+
any,
|
|
49
|
+
Error,
|
|
50
|
+
Context<TOptions>,
|
|
51
|
+
Internal<TOptions>
|
|
52
|
+
>;
|
|
42
53
|
|
|
43
|
-
export default secretsManager
|
|
54
|
+
export default secretsManager;
|
package/index.js
CHANGED
|
@@ -1,117 +1,117 @@
|
|
|
1
1
|
import {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
getInternal,
|
|
7
|
-
processCache,
|
|
8
|
-
modifyCache,
|
|
9
|
-
jsonSafeParse,
|
|
10
|
-
catchInvalidSignatureException
|
|
11
|
-
} from '@middy/util'
|
|
2
|
+
DescribeSecretCommand,
|
|
3
|
+
GetSecretValueCommand,
|
|
4
|
+
SecretsManagerClient,
|
|
5
|
+
} from "@aws-sdk/client-secrets-manager";
|
|
12
6
|
import {
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
7
|
+
canPrefetch,
|
|
8
|
+
catchInvalidSignatureException,
|
|
9
|
+
createClient,
|
|
10
|
+
createPrefetchClient,
|
|
11
|
+
getCache,
|
|
12
|
+
getInternal,
|
|
13
|
+
jsonSafeParse,
|
|
14
|
+
modifyCache,
|
|
15
|
+
processCache,
|
|
16
|
+
} from "@middy/util";
|
|
17
17
|
|
|
18
18
|
const defaults = {
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
}
|
|
19
|
+
AwsClient: SecretsManagerClient,
|
|
20
|
+
awsClientOptions: {},
|
|
21
|
+
awsClientAssumeRole: undefined,
|
|
22
|
+
awsClientCapture: undefined,
|
|
23
|
+
fetchData: {},
|
|
24
|
+
fetchRotationDate: false, // true: apply to all or {key: true} for individual
|
|
25
|
+
disablePrefetch: false,
|
|
26
|
+
cacheKey: "secrets-manager",
|
|
27
|
+
cacheKeyExpiry: {},
|
|
28
|
+
cacheExpiry: -1, // ignored when fetchRotationRules is true/object
|
|
29
|
+
setToContext: false,
|
|
30
|
+
};
|
|
31
31
|
|
|
32
32
|
const secretsManagerMiddleware = (opts = {}) => {
|
|
33
|
-
|
|
33
|
+
const options = { ...defaults, ...opts };
|
|
34
34
|
|
|
35
|
-
|
|
36
|
-
|
|
35
|
+
const fetchRequest = (request, cachedValues = {}) => {
|
|
36
|
+
const values = {};
|
|
37
37
|
|
|
38
|
-
|
|
39
|
-
|
|
38
|
+
for (const internalKey of Object.keys(options.fetchData)) {
|
|
39
|
+
if (cachedValues[internalKey]) continue;
|
|
40
40
|
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
41
|
+
values[internalKey] = Promise.resolve()
|
|
42
|
+
.then(() => {
|
|
43
|
+
if (
|
|
44
|
+
options.fetchRotationDate === true ||
|
|
45
|
+
options.fetchRotationDate?.[internalKey]
|
|
46
|
+
) {
|
|
47
|
+
const command = new DescribeSecretCommand({
|
|
48
|
+
SecretId: options.fetchData[internalKey],
|
|
49
|
+
});
|
|
50
|
+
return client
|
|
51
|
+
.send(command)
|
|
52
|
+
.catch((e) => catchInvalidSignatureException(e, client, command))
|
|
53
|
+
.then((resp) => {
|
|
54
|
+
if (options.cacheExpiry < 0) {
|
|
55
|
+
options.cacheKeyExpiry[internalKey] =
|
|
56
|
+
resp.NextRotationDate * 1000;
|
|
57
|
+
} else {
|
|
58
|
+
options.cacheKeyExpiry[internalKey] = Math.min(
|
|
59
|
+
Math.max(resp.LastRotationDate, resp.LastChangedDate) *
|
|
60
|
+
1000 +
|
|
61
|
+
options.cacheExpiry,
|
|
62
|
+
resp.NextRotationDate * 1000,
|
|
63
|
+
);
|
|
64
|
+
}
|
|
65
|
+
});
|
|
66
|
+
}
|
|
67
|
+
})
|
|
68
|
+
.then(() => {
|
|
69
|
+
const command = new GetSecretValueCommand({
|
|
70
|
+
SecretId: options.fetchData[internalKey],
|
|
71
|
+
});
|
|
72
|
+
return client
|
|
73
|
+
.send(command)
|
|
74
|
+
.catch((e) => catchInvalidSignatureException(e, client, command));
|
|
75
|
+
})
|
|
76
|
+
.then((resp) => jsonSafeParse(resp.SecretString))
|
|
77
|
+
.catch((e) => {
|
|
78
|
+
const value = getCache(options.cacheKey).value ?? {};
|
|
79
|
+
value[internalKey] = undefined;
|
|
80
|
+
modifyCache(options.cacheKey, value);
|
|
81
|
+
throw e;
|
|
82
|
+
});
|
|
83
|
+
}
|
|
84
|
+
return values;
|
|
85
|
+
};
|
|
86
86
|
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
87
|
+
let client;
|
|
88
|
+
if (canPrefetch(options)) {
|
|
89
|
+
client = createPrefetchClient(options);
|
|
90
|
+
processCache(options, fetchRequest);
|
|
91
|
+
}
|
|
92
92
|
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
93
|
+
const secretsManagerMiddlewareBefore = async (request) => {
|
|
94
|
+
if (!client) {
|
|
95
|
+
client = await createClient(options, request);
|
|
96
|
+
}
|
|
97
97
|
|
|
98
|
-
|
|
98
|
+
const { value } = processCache(options, fetchRequest, request);
|
|
99
99
|
|
|
100
|
-
|
|
100
|
+
Object.assign(request.internal, value);
|
|
101
101
|
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
102
|
+
if (options.setToContext) {
|
|
103
|
+
const data = await getInternal(Object.keys(options.fetchData), request);
|
|
104
|
+
Object.assign(request.context, data);
|
|
105
|
+
}
|
|
106
|
+
};
|
|
107
107
|
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
}
|
|
112
|
-
export default secretsManagerMiddleware
|
|
108
|
+
return {
|
|
109
|
+
before: secretsManagerMiddlewareBefore,
|
|
110
|
+
};
|
|
111
|
+
};
|
|
112
|
+
export default secretsManagerMiddleware;
|
|
113
113
|
|
|
114
114
|
// used for TS type inference (see index.d.ts)
|
|
115
|
-
export function secret
|
|
116
|
-
|
|
115
|
+
export function secret(name) {
|
|
116
|
+
return name;
|
|
117
117
|
}
|
package/package.json
CHANGED
|
@@ -1,74 +1,71 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
"aws-xray-sdk": "^3.3.3"
|
|
72
|
-
},
|
|
73
|
-
"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431"
|
|
2
|
+
"name": "@middy/secrets-manager",
|
|
3
|
+
"version": "6.2.1",
|
|
4
|
+
"description": "Secrets Manager middleware for the middy framework",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"engines": {
|
|
7
|
+
"node": ">=20"
|
|
8
|
+
},
|
|
9
|
+
"engineStrict": true,
|
|
10
|
+
"publishConfig": {
|
|
11
|
+
"access": "public"
|
|
12
|
+
},
|
|
13
|
+
"module": "./index.js",
|
|
14
|
+
"exports": {
|
|
15
|
+
".": {
|
|
16
|
+
"import": {
|
|
17
|
+
"types": "./index.d.ts",
|
|
18
|
+
"default": "./index.js"
|
|
19
|
+
},
|
|
20
|
+
"require": {
|
|
21
|
+
"default": "./index.js"
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
},
|
|
25
|
+
"types": "index.d.ts",
|
|
26
|
+
"files": ["index.js", "index.d.ts"],
|
|
27
|
+
"scripts": {
|
|
28
|
+
"test": "npm run test:unit && npm run test:fuzz",
|
|
29
|
+
"test:unit": "node --test",
|
|
30
|
+
"test:fuzz": "node --test index.fuzz.js",
|
|
31
|
+
"test:perf": "node --test index.perf.js"
|
|
32
|
+
},
|
|
33
|
+
"license": "MIT",
|
|
34
|
+
"keywords": [
|
|
35
|
+
"Lambda",
|
|
36
|
+
"Middleware",
|
|
37
|
+
"Serverless",
|
|
38
|
+
"Framework",
|
|
39
|
+
"AWS",
|
|
40
|
+
"AWS Lambda",
|
|
41
|
+
"Middy",
|
|
42
|
+
"Secrets Manager"
|
|
43
|
+
],
|
|
44
|
+
"author": {
|
|
45
|
+
"name": "Middy contributors",
|
|
46
|
+
"url": "https://github.com/middyjs/middy/graphs/contributors"
|
|
47
|
+
},
|
|
48
|
+
"repository": {
|
|
49
|
+
"type": "git",
|
|
50
|
+
"url": "git+https://github.com/middyjs/middy.git",
|
|
51
|
+
"directory": "packages/secrets-manager"
|
|
52
|
+
},
|
|
53
|
+
"bugs": {
|
|
54
|
+
"url": "https://github.com/middyjs/middy/issues"
|
|
55
|
+
},
|
|
56
|
+
"homepage": "https://middy.js.org",
|
|
57
|
+
"funding": {
|
|
58
|
+
"type": "github",
|
|
59
|
+
"url": "https://github.com/sponsors/willfarrell"
|
|
60
|
+
},
|
|
61
|
+
"dependencies": {
|
|
62
|
+
"@middy/util": "6.2.1"
|
|
63
|
+
},
|
|
64
|
+
"devDependencies": {
|
|
65
|
+
"@aws-sdk/client-secrets-manager": "^3.0.0",
|
|
66
|
+
"@middy/core": "6.2.1",
|
|
67
|
+
"@types/aws-lambda": "^8.10.101",
|
|
68
|
+
"aws-xray-sdk": "^3.3.3"
|
|
69
|
+
},
|
|
70
|
+
"gitHead": "7a6c0fbb8ab71d6a2171e678697de9f237568431"
|
|
74
71
|
}
|