@rytass/secret-adapter-vault-nestjs 0.4.1 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -29
- package/index.cjs.js +5 -5
- package/module.js +1 -1
- package/package.json +2 -2
- package/service.js +5 -5
package/README.md
CHANGED
|
@@ -47,9 +47,9 @@ import { VaultModule } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
47
47
|
@Module({
|
|
48
48
|
imports: [
|
|
49
49
|
VaultModule.forRoot({
|
|
50
|
-
path: '/secret/data/myapp',
|
|
51
|
-
fallbackFile: '.env',
|
|
52
|
-
})
|
|
50
|
+
path: '/secret/data/myapp', // Vault path for secrets
|
|
51
|
+
fallbackFile: '.env', // Optional: fallback env file
|
|
52
|
+
}),
|
|
53
53
|
],
|
|
54
54
|
})
|
|
55
55
|
export class AppModule {}
|
|
@@ -67,8 +67,8 @@ import { VaultModule } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
67
67
|
imports: [
|
|
68
68
|
VaultModule.forRoot({
|
|
69
69
|
path: '/secret/data/myapp',
|
|
70
|
-
fallbackFile: '.env'
|
|
71
|
-
})
|
|
70
|
+
fallbackFile: '.env',
|
|
71
|
+
}),
|
|
72
72
|
],
|
|
73
73
|
})
|
|
74
74
|
export class AppModule {}
|
|
@@ -94,7 +94,7 @@ export class ConfigurationService {
|
|
|
94
94
|
host,
|
|
95
95
|
port,
|
|
96
96
|
username,
|
|
97
|
-
password
|
|
97
|
+
password,
|
|
98
98
|
};
|
|
99
99
|
}
|
|
100
100
|
|
|
@@ -185,7 +185,7 @@ export class ResilientConfigService {
|
|
|
185
185
|
|
|
186
186
|
return {
|
|
187
187
|
apiUrl,
|
|
188
|
-
apiKey
|
|
188
|
+
apiKey,
|
|
189
189
|
};
|
|
190
190
|
}
|
|
191
191
|
}
|
|
@@ -201,8 +201,8 @@ Specify a fallback environment file for when Vault is unavailable:
|
|
|
201
201
|
imports: [
|
|
202
202
|
VaultModule.forRoot({
|
|
203
203
|
path: '/secret/data/production',
|
|
204
|
-
fallbackFile: '.env.production'
|
|
205
|
-
})
|
|
204
|
+
fallbackFile: '.env.production', // Fallback to .env.production file
|
|
205
|
+
}),
|
|
206
206
|
],
|
|
207
207
|
})
|
|
208
208
|
export class AppModule {}
|
|
@@ -220,7 +220,7 @@ import { VaultModule, VaultService } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
220
220
|
@Module({
|
|
221
221
|
imports: [
|
|
222
222
|
VaultModule.forRoot({
|
|
223
|
-
path: '/secret/data/database'
|
|
223
|
+
path: '/secret/data/database',
|
|
224
224
|
}),
|
|
225
225
|
TypeOrmModule.forRootAsync({
|
|
226
226
|
imports: [VaultModule],
|
|
@@ -234,8 +234,8 @@ import { VaultModule, VaultService } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
234
234
|
database: await vault.get<string>('DB_NAME'),
|
|
235
235
|
synchronize: false,
|
|
236
236
|
logging: true,
|
|
237
|
-
})
|
|
238
|
-
})
|
|
237
|
+
}),
|
|
238
|
+
}),
|
|
239
239
|
],
|
|
240
240
|
})
|
|
241
241
|
export class DatabaseModule {}
|
|
@@ -251,7 +251,7 @@ import { VaultModule, VaultService } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
251
251
|
@Module({
|
|
252
252
|
imports: [
|
|
253
253
|
VaultModule.forRoot({
|
|
254
|
-
path: '/secret/data/auth'
|
|
254
|
+
path: '/secret/data/auth',
|
|
255
255
|
}),
|
|
256
256
|
JwtModule.registerAsync({
|
|
257
257
|
imports: [VaultModule],
|
|
@@ -259,10 +259,10 @@ import { VaultModule, VaultService } from '@rytass/secret-adapter-vault-nestjs';
|
|
|
259
259
|
useFactory: async (vault: VaultService) => ({
|
|
260
260
|
secret: await vault.get<string>('JWT_SECRET'),
|
|
261
261
|
signOptions: {
|
|
262
|
-
expiresIn: await vault.get<string>('JWT_EXPIRY') || '1h'
|
|
263
|
-
}
|
|
264
|
-
})
|
|
265
|
-
})
|
|
262
|
+
expiresIn: (await vault.get<string>('JWT_EXPIRY')) || '1h',
|
|
263
|
+
},
|
|
264
|
+
}),
|
|
265
|
+
}),
|
|
266
266
|
],
|
|
267
267
|
})
|
|
268
268
|
export class AuthModule {}
|
|
@@ -285,7 +285,7 @@ async function bootstrap() {
|
|
|
285
285
|
host: await vault.get<string>('REDIS_HOST'),
|
|
286
286
|
port: await vault.get<number>('REDIS_PORT'),
|
|
287
287
|
password: await vault.get<string>('REDIS_PASSWORD'),
|
|
288
|
-
}
|
|
288
|
+
},
|
|
289
289
|
});
|
|
290
290
|
|
|
291
291
|
await app.startAllMicroservices();
|
|
@@ -303,7 +303,7 @@ export class SafeConfigService {
|
|
|
303
303
|
async getSensitiveConfig() {
|
|
304
304
|
try {
|
|
305
305
|
const secret = await this.vault.get<string>('SENSITIVE_KEY');
|
|
306
|
-
|
|
306
|
+
|
|
307
307
|
if (!secret) {
|
|
308
308
|
throw new Error('Sensitive key not found');
|
|
309
309
|
}
|
|
@@ -312,7 +312,7 @@ export class SafeConfigService {
|
|
|
312
312
|
} catch (error) {
|
|
313
313
|
// When Vault is down, it falls back to env vars automatically
|
|
314
314
|
console.error('Failed to retrieve secret:', error);
|
|
315
|
-
|
|
315
|
+
|
|
316
316
|
// You can implement additional fallback logic
|
|
317
317
|
return process.env.FALLBACK_SENSITIVE_KEY || 'default-value';
|
|
318
318
|
}
|
|
@@ -367,13 +367,13 @@ export class ConfigService {
|
|
|
367
367
|
|
|
368
368
|
```typescript
|
|
369
369
|
// auth.module.ts
|
|
370
|
-
VaultModule.forRoot({ path: '/secret/data/auth' })
|
|
370
|
+
VaultModule.forRoot({ path: '/secret/data/auth' });
|
|
371
371
|
|
|
372
|
-
// database.module.ts
|
|
373
|
-
VaultModule.forRoot({ path: '/secret/data/database' })
|
|
372
|
+
// database.module.ts
|
|
373
|
+
VaultModule.forRoot({ path: '/secret/data/database' });
|
|
374
374
|
|
|
375
375
|
// api.module.ts
|
|
376
|
-
VaultModule.forRoot({ path: '/secret/data/external-apis' })
|
|
376
|
+
VaultModule.forRoot({ path: '/secret/data/external-apis' });
|
|
377
377
|
```
|
|
378
378
|
|
|
379
379
|
### 4. Use Environment-Specific Paths
|
|
@@ -385,8 +385,8 @@ const environment = process.env.NODE_ENV || 'development';
|
|
|
385
385
|
imports: [
|
|
386
386
|
VaultModule.forRoot({
|
|
387
387
|
path: `/secret/data/${environment}`,
|
|
388
|
-
fallbackFile: `.env.${environment}
|
|
389
|
-
})
|
|
388
|
+
fallbackFile: `.env.${environment}`,
|
|
389
|
+
}),
|
|
390
390
|
],
|
|
391
391
|
})
|
|
392
392
|
export class AppModule {}
|
|
@@ -401,6 +401,7 @@ export class AppModule {}
|
|
|
401
401
|
Configure the Vault module.
|
|
402
402
|
|
|
403
403
|
**Options:**
|
|
404
|
+
|
|
404
405
|
- `path` (string, required): Vault secret path from root
|
|
405
406
|
- `fallbackFile` (string, optional): Path to fallback environment file
|
|
406
407
|
|
|
@@ -411,6 +412,7 @@ Configure the Vault module.
|
|
|
411
412
|
Retrieve a secret value.
|
|
412
413
|
|
|
413
414
|
**Parameters:**
|
|
415
|
+
|
|
414
416
|
- `key`: Secret key name
|
|
415
417
|
|
|
416
418
|
**Returns:** Promise resolving to the secret value
|
|
@@ -420,6 +422,7 @@ Retrieve a secret value.
|
|
|
420
422
|
Store a secret value.
|
|
421
423
|
|
|
422
424
|
**Parameters:**
|
|
425
|
+
|
|
423
426
|
- `key`: Secret key name
|
|
424
427
|
- `value`: Value to store
|
|
425
428
|
- `syncToOnline`: Whether to sync immediately to Vault (default: false)
|
|
@@ -429,6 +432,7 @@ Store a secret value.
|
|
|
429
432
|
Delete a secret.
|
|
430
433
|
|
|
431
434
|
**Parameters:**
|
|
435
|
+
|
|
432
436
|
- `key`: Secret key name
|
|
433
437
|
- `syncToOnline`: Whether to sync deletion to Vault (default: false)
|
|
434
438
|
|
|
@@ -439,7 +443,7 @@ Delete a secret.
|
|
|
439
443
|
@Injectable()
|
|
440
444
|
export class OldService {
|
|
441
445
|
constructor(private config: ConfigService) {}
|
|
442
|
-
|
|
446
|
+
|
|
443
447
|
getValue() {
|
|
444
448
|
return this.config.get('MY_KEY');
|
|
445
449
|
}
|
|
@@ -449,7 +453,7 @@ export class OldService {
|
|
|
449
453
|
@Injectable()
|
|
450
454
|
export class NewService {
|
|
451
455
|
constructor(private vault: VaultService) {}
|
|
452
|
-
|
|
456
|
+
|
|
453
457
|
async getValue() {
|
|
454
458
|
return this.vault.get<string>('MY_KEY');
|
|
455
459
|
}
|
|
@@ -461,6 +465,7 @@ export class NewService {
|
|
|
461
465
|
### Vault Connection Issues
|
|
462
466
|
|
|
463
467
|
If you see fallback warnings:
|
|
468
|
+
|
|
464
469
|
1. Check `VAULT_HOST` is accessible
|
|
465
470
|
2. Verify `VAULT_ACCOUNT` and `VAULT_PASSWORD` are correct
|
|
466
471
|
3. Ensure `VAULT_PATH` exists in Vault
|
|
@@ -479,4 +484,4 @@ const config = await vault.get<AppConfig>('APP_CONFIG');
|
|
|
479
484
|
|
|
480
485
|
## License
|
|
481
486
|
|
|
482
|
-
MIT
|
|
487
|
+
MIT
|
package/index.cjs.js
CHANGED
|
@@ -23,12 +23,11 @@ function _ts_param(paramIndex, decorator) {
|
|
|
23
23
|
class VaultService {
|
|
24
24
|
config;
|
|
25
25
|
manager;
|
|
26
|
-
|
|
27
|
-
|
|
26
|
+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
27
|
+
onReadyCallbacks = [];
|
|
28
|
+
fallbackToEnvFile = false;
|
|
28
29
|
constructor(config, path){
|
|
29
30
|
this.config = config;
|
|
30
|
-
this.onReadyCallbacks = [];
|
|
31
|
-
this.fallbackToEnvFile = false;
|
|
32
31
|
const host = config.get('VAULT_HOST');
|
|
33
32
|
const user = config.get('VAULT_ACCOUNT');
|
|
34
33
|
const pass = config.get('VAULT_PASSWORD');
|
|
@@ -42,7 +41,7 @@ class VaultService {
|
|
|
42
41
|
account: user,
|
|
43
42
|
password: pass
|
|
44
43
|
},
|
|
45
|
-
onError: (
|
|
44
|
+
onError: (_err)=>{
|
|
46
45
|
this.fallbackToEnvFile = true;
|
|
47
46
|
this.onReadyCallbacks.forEach((done)=>done(config));
|
|
48
47
|
},
|
|
@@ -59,6 +58,7 @@ class VaultService {
|
|
|
59
58
|
return this.manager.get(key);
|
|
60
59
|
}
|
|
61
60
|
return new Promise((resolve)=>{
|
|
61
|
+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
62
62
|
this.onReadyCallbacks.push((dataSource = this.manager)=>{
|
|
63
63
|
resolve(dataSource.get(key));
|
|
64
64
|
});
|
package/module.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { Global, Module } from '@nestjs/common';
|
|
2
|
-
import {
|
|
2
|
+
import { ConfigService, ConfigModule } from '@nestjs/config';
|
|
3
3
|
import { VAULT_PATH_TOKEN } from './constants.js';
|
|
4
4
|
import { VaultService } from './service.js';
|
|
5
5
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@rytass/secret-adapter-vault-nestjs",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.2",
|
|
4
4
|
"description": "Rytass Sceret Vault nestjs adapter",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"rytass",
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"reflect-metadata": "*"
|
|
25
25
|
},
|
|
26
26
|
"dependencies": {
|
|
27
|
-
"@rytass/secret-adapter-vault": "^0.4.
|
|
27
|
+
"@rytass/secret-adapter-vault": "^0.4.2",
|
|
28
28
|
"regenerator-runtime": "^0.14.1"
|
|
29
29
|
},
|
|
30
30
|
"main": "./index.cjs.js",
|
package/service.js
CHANGED
|
@@ -20,12 +20,11 @@ function _ts_param(paramIndex, decorator) {
|
|
|
20
20
|
class VaultService {
|
|
21
21
|
config;
|
|
22
22
|
manager;
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
24
|
+
onReadyCallbacks = [];
|
|
25
|
+
fallbackToEnvFile = false;
|
|
25
26
|
constructor(config, path){
|
|
26
27
|
this.config = config;
|
|
27
|
-
this.onReadyCallbacks = [];
|
|
28
|
-
this.fallbackToEnvFile = false;
|
|
29
28
|
const host = config.get('VAULT_HOST');
|
|
30
29
|
const user = config.get('VAULT_ACCOUNT');
|
|
31
30
|
const pass = config.get('VAULT_PASSWORD');
|
|
@@ -39,7 +38,7 @@ class VaultService {
|
|
|
39
38
|
account: user,
|
|
40
39
|
password: pass
|
|
41
40
|
},
|
|
42
|
-
onError: (
|
|
41
|
+
onError: (_err)=>{
|
|
43
42
|
this.fallbackToEnvFile = true;
|
|
44
43
|
this.onReadyCallbacks.forEach((done)=>done(config));
|
|
45
44
|
},
|
|
@@ -56,6 +55,7 @@ class VaultService {
|
|
|
56
55
|
return this.manager.get(key);
|
|
57
56
|
}
|
|
58
57
|
return new Promise((resolve)=>{
|
|
58
|
+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
59
59
|
this.onReadyCallbacks.push((dataSource = this.manager)=>{
|
|
60
60
|
resolve(dataSource.get(key));
|
|
61
61
|
});
|