@raketa-cloud/admin 1.9.1 → 1.9.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raketa-cloud/admin",
-  "version": "1.9.1",
+  "version": "1.9.3",
   "main": "src/index.js",
   "files": [
     "src/",

package/src/helpers/reports/googleAuth.js

@@ -1,9 +1,9 @@
 // Service-account auth for the GA4 Data API (the Insights tab).
 //
 // GA is per-property authorized: it rejects API keys and needs a principal. The
-// key file at config.ga.serviceAccountPath (GOOGLE_APPLICATION_CREDENTIALS)
-// provides one with no human in the loop — sign a JWT with it, swap that for an
-// access token. Nothing is persisted, so a restart costs one token exchange.
+// key at config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) provides one
+// with no human in the loop — sign a JWT with it, swap that for an access token.
+// Nothing is persisted, so a restart costs one token exchange.
 //
 // The key's client_email needs Viewer access on the GA property.
 import { createSign } from "node:crypto";
@@ -18,44 +18,93 @@ const SCOPE = "https://www.googleapis.com/auth/analytics.readonly";
 const TOKEN_LIFETIME_S = 3600;
 const EXPIRY_SKEW_MS = 60 * 1000;
 
-// Parsed key files by path, access tokens by client_email, plus the in-flight
-// token exchange per client_email (see accessToken).
+// Parsed keys by credential source, access tokens by client_email, plus the
+// in-flight token exchange per client_email (see accessToken).
 const keyCache = new Map();
 const tokenCache = new Map();
 const pendingTokens = new Map();
 
-// True when a key path is configured — gates the Insights tab, so an
+const credentialSource = (ga = {}) => ga.serviceAccount;
+
+// True when a credential is configured — gates the Insights tab, so an
 // unconfigured admin sees no GA UI at all.
 export const serviceAccountConfigured = (ga = {}) =>
-  Boolean(ga.serviceAccountPath);
+  Boolean(credentialSource(ga));
+
+// GOOGLE_APPLICATION_CREDENTIALS now holds the whole key JSON rather than a path
+// to it, so a source can be: an already-parsed object, the JSON itself, that
+// JSON base64-encoded (what most hosts accept without quoting headaches), or a
+// file path.
+function parseCredentialSource(source) {
+  if (typeof source === "object") return { key: source, label: "config" };
+
+  const value = source.trim();
+
+  if (value.startsWith("{")) {
+    try {
+      return {
+        key: JSON.parse(value),
+        label: "GOOGLE_APPLICATION_CREDENTIALS",
+      };
+    } catch (err) {
+      throw new Error(
+        `Could not parse the service-account key JSON in GOOGLE_APPLICATION_CREDENTIALS: ${err.message}`,
+      );
+    }
+  }
 
-function serviceAccountKey(ga = {}) {
-  const path = ga.serviceAccountPath;
+  const decoded = decodeBase64Json(value);
+  if (decoded) {
+    return {
+      key: decoded,
+      label: "GOOGLE_APPLICATION_CREDENTIALS (base64)",
+    };
+  }
 
-  if (!path) {
+  try {
+    return { key: JSON.parse(readFileSync(value, "utf8")), label: value };
+  } catch (err) {
     throw new Error(
-      "Google service-account key is not set. Point GOOGLE_APPLICATION_CREDENTIALS at the key file (surfaced via config.ga.serviceAccountPath).",
+      `Could not read the service-account key at ${value}: ${err.message}`,
     );
   }
+}
 
-  if (keyCache.has(path)) return keyCache.get(path);
+// Only claims a value as base64 when it decodes to a JSON object — anything
+// else is a path, and a path must keep reporting a read error, not a parse one.
+function decodeBase64Json(value) {
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(value)) return null;
 
-  let key;
   try {
-    key = JSON.parse(readFileSync(path, "utf8"));
-  } catch (err) {
+    const decoded = Buffer.from(value, "base64").toString("utf8").trim();
+    return decoded.startsWith("{") ? JSON.parse(decoded) : null;
+  } catch {
+    return null;
+  }
+}
+
+function serviceAccountKey(ga = {}) {
+  const source = credentialSource(ga);
+
+  if (!source) {
     throw new Error(
-      `Could not read the service-account key at ${path}: ${err.message}`,
+      "Google service-account key is not set. Put the key JSON in GOOGLE_APPLICATION_CREDENTIALS (surfaced via config.ga.serviceAccount).",
     );
   }
 
+  if (typeof source === "string" && keyCache.has(source)) {
+    return keyCache.get(source);
+  }
+
+  const { key, label } = parseCredentialSource(source);
+
   if (!key.client_email || !key.private_key) {
     throw new Error(
-      `The service-account key at ${path} has no client_email / private_key.`,
+      `The service-account key from ${label} has no client_email / private_key.`,
     );
   }
 
-  keyCache.set(path, key);
+  if (typeof source === "string") keyCache.set(source, key);
   return key;
 }
 

package/src/helpers/reports/reportsUtils.js

@@ -135,7 +135,7 @@ async function fetchQuickInsights(ctx, resource, resourceType) {
   try {
     if (!gaEnabled(ctx)) {
       throw new Error(
-        "Google Analytics is not configured. Set config.ga.propertyId and config.ga.serviceAccountPath (GOOGLE_APPLICATION_CREDENTIALS) to enable reports.",
+        "Google Analytics is not configured. Set config.ga.propertyId and config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) to enable reports.",
       );
     }
     const pagePath = gaPagePath(ctx, resource, resourceType);

package/src/tests/handlers/resources/ReportsAPIHandler.test/show.test.js

@@ -15,7 +15,8 @@ import ReportsAPIHandler from "../../../../handlers/resources/ReportsAPIHandler"
 
 import Factory from "../../../support/factory";
 
-const SERVICE_ACCOUNT_PATH = "/tmp/service-account.json";
+const SERVICE_ACCOUNT =
+  '{"client_email":"reports@project.iam.gserviceaccount.com","private_key":"pem"}';
 
 describe("Reports API Handler", () => {
   function buildCtx(resource, { ga, reports = true } = {}) {
@@ -63,7 +64,7 @@ describe("Reports API Handler", () => {
     const ctx = buildCtx(resource, {
       ga: {
         propertyId: "1234",
-        serviceAccountPath: SERVICE_ACCOUNT_PATH,
+        serviceAccount: SERVICE_ACCOUNT,
         apiKey: "crux-key",
       },
     });
@@ -98,7 +99,7 @@ describe("Reports API Handler", () => {
   test("does not cache the assembled payload", async () => {
     const resource = Factory.build("resource", { translations: {} });
     const ctx = buildCtx(resource, {
-      ga: { propertyId: "1234", serviceAccountPath: SERVICE_ACCOUNT_PATH },
+      ga: { propertyId: "1234", serviceAccount: SERVICE_ACCOUNT },
     });
 
     jest.spyOn(ctx.client.resources, "find").mockImplementation(() => resource);
@@ -117,7 +118,7 @@ describe("Reports API Handler", () => {
   test("passes a failed side through as an error", async () => {
     const resource = Factory.build("resource", { translations: {} });
     const ctx = buildCtx(resource, {
-      ga: { propertyId: "1234", serviceAccountPath: SERVICE_ACCOUNT_PATH },
+      ga: { propertyId: "1234", serviceAccount: SERVICE_ACCOUNT },
     });
 
     jest.spyOn(ctx.client.resources, "find").mockImplementation(() => resource);

package/src/tests/handlers/resources/ResourcesHandler.test/show_reports.test.js

@@ -46,7 +46,7 @@ describe("Resources Handler show reports section", () => {
     const resource = Factory.build("resource", { translations: {} });
     const ctx = buildCtx(resource, {
       propertyId: "1234",
-      serviceAccountPath: "/tmp/service-account.json",
+      serviceAccount: "{}",
       apiKey: "crux-key",
     });
     mockClient(ctx, resource);
@@ -65,7 +65,7 @@ describe("Resources Handler show reports section", () => {
     const resource = Factory.build("resource", { translations: {} });
     const ctx = buildCtx(resource, {
       propertyId: "1234",
-      serviceAccountPath: "/tmp/service-account.json",
+      serviceAccount: "{}",
     });
     mockClient(ctx, resource);
 

package/src/tests/helpers/reports/quick-insights.test.js

@@ -14,31 +14,31 @@ import {
 } from "../../../helpers/reports/quick-insights";
 import localCache from "../../../localCache";
 
-// One throwaway RSA key written to a temp file — the module reads the key from
-// ga.serviceAccountPath, exactly like it does in the app.
+// One throwaway RSA key. The app passes the whole key JSON through
+// ga.serviceAccount, so that is the form used here; the same key is also written
+// to a temp file, since that config value also accepts a path.
 const { privateKey } = generateKeyPairSync("rsa", {
   modulusLength: 2048,
   privateKeyEncoding: { type: "pkcs8", format: "pem" },
   publicKeyEncoding: { type: "spki", format: "pem" },
 });
 
+const keyJson = JSON.stringify({
+  type: "service_account",
+  client_email: "reports@project.iam.gserviceaccount.com",
+  private_key_id: "key-1",
+  private_key: privateKey,
+});
+
 const dir = mkdtempSync(join(tmpdir(), "quick-insights-"));
 const keyPath = join(dir, "service-account.json");
 const missingPath = join(dir, "nope.json");
 const brokenPath = join(dir, "broken.json");
 
-writeFileSync(
-  keyPath,
-  JSON.stringify({
-    type: "service_account",
-    client_email: "reports@project.iam.gserviceaccount.com",
-    private_key_id: "key-1",
-    private_key: privateKey,
-  }),
-);
+writeFileSync(keyPath, keyJson);
 writeFileSync(brokenPath, JSON.stringify({ client_email: "a@b.c" }));
 
-const GA = { propertyId: "1234", serviceAccountPath: keyPath };
+const GA = { propertyId: "1234", serviceAccount: keyJson };
 
 const reportBody = {
   rows: [
@@ -80,13 +80,13 @@ describe("quick-insights auth", () => {
     delete global.fetch;
   });
 
-  test("serviceAccountConfigured follows the key path", () => {
+  test("serviceAccountConfigured follows the credential", () => {
     expect(serviceAccountConfigured(GA)).toBe(true);
     expect(serviceAccountConfigured({})).toBe(false);
     expect(serviceAccountConfigured()).toBe(false);
   });
 
-  test("signs a JWT from the key file and calls the Data API with it", async () => {
+  test("signs a JWT from the key JSON and calls the Data API with it", async () => {
     mockGoogle();
 
     const result = await runPageReport({
@@ -129,6 +129,29 @@ describe("quick-insights auth", () => {
     expect(result.rows).toEqual([{ date: "2026-07-01", views: 4 }]);
   });
 
+  // Hosts that dislike raw JSON in an env var get the base64 form; a path is
+  // still accepted for anything pointing at a key file.
+  test.each([
+    ["base64 key JSON", Buffer.from(keyJson).toString("base64")],
+    ["a key file path", keyPath],
+  ])("accepts %s", async (_label, serviceAccount) => {
+    mockGoogle();
+
+    const result = await runPageReport({
+      pagePath: "/pricing",
+      startDate: "2026-07-01",
+      endDate: "2026-07-01",
+      ga: { propertyId: "1234", serviceAccount },
+    });
+
+    const [, tokenOptions] = global.fetch.mock.calls[0];
+    const [, claims] = Object.fromEntries(tokenOptions.body).assertion.split(
+      ".",
+    );
+    expect(decode(claims).iss).toBe("reports@project.iam.gserviceaccount.com");
+    expect(result.rows).toEqual([{ date: "2026-07-01", views: 4 }]);
+  });
+
   test("reuses the access token across reports", async () => {
     mockGoogle();
 
@@ -203,7 +226,7 @@ describe("quick-insights auth", () => {
     await expect(runPageReport(args)).rejects.toThrow(/GA Data API 403/);
   });
 
-  test("reports unusable key paths", async () => {
+  test("reports unusable credentials", async () => {
     // The property id is checked while building the request URL, so every case
     // here keeps it set — otherwise that error would mask the key one.
     mockGoogle();
@@ -220,13 +243,25 @@ describe("quick-insights auth", () => {
     await expect(
       runPageReport({
         ...args,
-        ga: { propertyId: "1234", serviceAccountPath: missingPath },
+        ga: { propertyId: "1234", serviceAccount: '{"client_email":' },
+      }),
+    ).rejects.toThrow(/Could not parse the service-account key JSON/);
+    await expect(
+      runPageReport({
+        ...args,
+        ga: { propertyId: "1234", serviceAccount: '{"client_email":"a@b.c"}' },
+      }),
+    ).rejects.toThrow(/no client_email \/ private_key/);
+    await expect(
+      runPageReport({
+        ...args,
+        ga: { propertyId: "1234", serviceAccount: missingPath },
       }),
     ).rejects.toThrow(/Could not read the service-account key/);
     await expect(
       runPageReport({
         ...args,
-        ga: { propertyId: "1234", serviceAccountPath: brokenPath },
+        ga: { propertyId: "1234", serviceAccount: brokenPath },
       }),
     ).rejects.toThrow(/no client_email \/ private_key/);
   });
@@ -239,7 +274,7 @@ describe("quick-insights auth", () => {
         pagePath: "/pricing",
         startDate: "2026-07-01",
         endDate: "2026-07-01",
-        ga: { serviceAccountPath: keyPath },
+        ga: { serviceAccount: keyJson },
       }),
     ).rejects.toThrow(/GA property id is not set/);
   });

package/src/views/resources/translations/create_form.ejs

@@ -94,7 +94,7 @@
               const date = new Date();
 
 
-              date.setDate(date.getDate() + 2);
+              date.setDate(date.getDate() + 3);
 
               // Skip weekends.
               while(date.getDay() === 0 || date.getDay() === 6) {