@squiz/dx-common-lib 1.69.1 → 1.71.0

package/lib/util/isReadable.js.map

@@ -1 +1 @@
-{"version":3,"file":"isReadable.js","sourceRoot":"","sources":["../../src/util/isReadable.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AACxB,wDAA2B;AAC3B,2BAA+B;AAExB,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAY;IAC7D,IAAI;QACF,MAAM,kBAAG,CAAC,MAAM,CAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,cAAS,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;KACb;IAAC,MAAM;QACN,OAAO,KAAK,CAAC;KACd;AACH,CAAC;AAPD,gCAOC"}
+{"version":3,"file":"isReadable.js","sourceRoot":"","sources":["../../src/util/isReadable.ts"],"names":[],"mappings":";;;;;AAIA,gCAOC;AAXD,gDAAwB;AACxB,wDAA2B;AAC3B,2BAA+B;AAExB,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAY;IAC7D,IAAI,CAAC;QACH,MAAM,kBAAG,CAAC,MAAM,CAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,cAAS,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/lib/util/joinAbsoluteUrlPath.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.joinAbsoluteUrlPath = void 0;
+exports.joinAbsoluteUrlPath = joinAbsoluteUrlPath;
 function joinAbsoluteUrlPath(...args) {
     const [rootUrl] = args;
     /**
@@ -16,7 +16,6 @@ function joinAbsoluteUrlPath(...args) {
         return url.pathname.replace(/(^\/|\/$)/g, '');
     }
 }
-exports.joinAbsoluteUrlPath = joinAbsoluteUrlPath;
 function getSanitisedString(subdirs) {
     return subdirs.map((dir) => dir.replace(/(^\.\/+)|(^\/+|\/+$)/g, '')).join('/');
 }

package/lib/util/joinAbsoluteUrlPath.js.map

@@ -1 +1 @@
-{"version":3,"file":"joinAbsoluteUrlPath.js","sourceRoot":"","sources":["../../src/util/joinAbsoluteUrlPath.ts"],"names":[],"mappings":";;;AAAA,SAAgB,mBAAmB,CAAC,GAAG,IAAc;IACnD,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEpE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE;QAC1B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;KACvB;SAAM;QACL,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;KAC/C;AACH,CAAC;AAdD,kDAcC;AAED,SAAS,kBAAkB,CAAC,OAAiB;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"joinAbsoluteUrlPath.js","sourceRoot":"","sources":["../../src/util/joinAbsoluteUrlPath.ts"],"names":[],"mappings":";;AAAA,kDAcC;AAdD,SAAgB,mBAAmB,CAAC,GAAG,IAAc;IACnD,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAEpE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAiB;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC"}

package/lib/util/never.js

@@ -1,9 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.never = void 0;
+exports.never = never;
 function never(a) {
     // this should never be executed. This is a compile time check
     throw new Error(`value ${a} is not valid`);
 }
-exports.never = never;
 //# sourceMappingURL=never.js.map

package/lib/util/never.js.map

@@ -1 +1 @@
-{"version":3,"file":"never.js","sourceRoot":"","sources":["../../src/util/never.ts"],"names":[],"mappings":";;;AAAA,SAAgB,KAAK,CAAC,CAAQ;IAC5B,8DAA8D;IAC9D,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC7C,CAAC;AAHD,sBAGC"}
+{"version":3,"file":"never.js","sourceRoot":"","sources":["../../src/util/never.ts"],"names":[],"mappings":";;AAAA,sBAGC;AAHD,SAAgB,KAAK,CAAC,CAAQ;IAC5B,8DAA8D;IAC9D,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC7C,CAAC"}

package/lib/util/parseEnvVarForVar.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseEnvVarForVar = void 0;
+exports.parseEnvVarForVar = parseEnvVarForVar;
 function parseEnvVarForVar(varName, defaultValue = undefined) {
     if (process.env[varName] === undefined) {
         if (defaultValue !== undefined) {
@@ -11,5 +11,4 @@ function parseEnvVarForVar(varName, defaultValue = undefined) {
     // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
     return process.env[varName];
 }
-exports.parseEnvVarForVar = parseEnvVarForVar;
 //# sourceMappingURL=parseEnvVarForVar.js.map

package/lib/util/parseEnvVarForVar.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseEnvVarForVar.js","sourceRoot":"","sources":["../../src/util/parseEnvVarForVar.ts"],"names":[],"mappings":";;;AAAA,SAAgB,iBAAiB,CAAC,OAAe,EAAE,eAAmC,SAAS;IAC7F,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE;QACtC,IAAI,YAAY,KAAK,SAAS,EAAE;YAC9B,OAAO,YAAY,CAAC;SACrB;QAED,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,cAAc,CAAC,CAAC;KACxD;IAED,oEAAoE;IACpE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;AAC/B,CAAC;AAXD,8CAWC"}
+{"version":3,"file":"parseEnvVarForVar.js","sourceRoot":"","sources":["../../src/util/parseEnvVarForVar.ts"],"names":[],"mappings":";;AAAA,8CAWC;AAXD,SAAgB,iBAAiB,CAAC,OAAe,EAAE,eAAmC,SAAS;IAC7F,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,cAAc,CAAC,CAAC;IACzD,CAAC;IAED,oEAAoE;IACpE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;AAC/B,CAAC"}

package/lib/zip/zipDirectory.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zipDirectory = void 0;
+exports.zipDirectory = zipDirectory;
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const archiver_1 = __importDefault(require("archiver"));
@@ -28,5 +28,4 @@ function zipDirectory(sourceDirectory, outputDirectory) {
         archive.finalize();
     });
 }
-exports.zipDirectory = zipDirectory;
 //# sourceMappingURL=zipDirectory.js.map

package/lib/zip/zipDirectory.js.map

@@ -1 +1 @@
-{"version":3,"file":"zipDirectory.js","sourceRoot":"","sources":["../../src/zip/zipDirectory.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AACxB,4CAAoB;AAEpB,wDAAgC;AAEhC,SAAgB,YAAY,CAAC,eAAuB,EAAE,eAAuB;IAC3E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,aAAa,GAAG,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,YAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,EAAE;YAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,8BAA8B;SACnD,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;YACjB,OAAO,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,GAAG;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG;YAC/B,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAzBD,oCAyBC"}
+{"version":3,"file":"zipDirectory.js","sourceRoot":"","sources":["../../src/zip/zipDirectory.ts"],"names":[],"mappings":";;;;;AAKA,oCAyBC;AA9BD,gDAAwB;AACxB,4CAAoB;AAEpB,wDAAgC;AAEhC,SAAgB,YAAY,CAAC,eAAuB,EAAE,eAAuB;IAC3E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,aAAa,GAAG,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,YAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,IAAA,kBAAQ,EAAC,KAAK,EAAE;YAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,8BAA8B;SACnD,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;YACjB,OAAO,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,GAAG;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG;YAC/B,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@squiz/dx-common-lib",
-  "version": "1.69.1",
+  "version": "1.71.0",
   "description": "",
   "main": "lib/index.js",
   "private": false,
@@ -30,10 +30,10 @@
     "@types/fs-extra": "11.0.1",
     "@types/jest": "28.1.8",
     "@types/lodash.clonedeep": "4.5.7",
-    "@types/node": "20.12.4",
+    "@types/node": "22.10.5",
     "dotenv": "16.0.3",
     "jest": "29.4.1",
     "ts-jest": "29.0.5",
-    "typescript": "4.9.4"
+    "typescript": "^5.7.2"
   }
 }

package/src/api-key-validation/ApiKeyValidationService.ts

@@ -5,4 +5,6 @@ export interface ApiKeyValidationService {
    * @deprecated Suggest moving towards using JWT authentication.
    */
   getInterServiceKeys(): string[];
+
+  getEsiSecretToken(): string;
 }

package/src/api-key-validation/CloudflareApiKeyService.spec.ts

@@ -15,13 +15,31 @@ describe('CloudflareApiKeyService', () => {
       sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: 'bad json' }));
 
       await expect(service.refreshApiKeys()).rejects.toThrowError(
-        new Error('failed to decode cloudflare api key values'),
+        new Error('Failed to decode cloudflare api key values: Invalid JSON'),
+      );
+    });
+
+    it('should throw an error if the secret value missing "inter-service-keys" value', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"esi-secret-token": "foo"}' }));
+
+      await expect(service.refreshApiKeys()).rejects.toThrowError(
+        new Error('Failed to decode cloudflare api key values: Missing all required keys'),
+      );
+    });
+
+    it('should throw an error if the secret value missing "esi-secret-token" value', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys": []}' }));
+
+      await expect(service.refreshApiKeys()).rejects.toThrowError(
+        new Error('Failed to decode cloudflare api key values: Missing all required keys'),
       );
     });
 
     it('should make a request to the aws secrets manager when refreshing the keys', async () => {
       sendSpy.mockClear();
-      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+      );
       await service.refreshApiKeys();
 
       expect(sendSpy.mock.lastCall[0].input).toEqual({ SecretId: 'my-secret-name' });
@@ -30,7 +48,9 @@ describe('CloudflareApiKeyService', () => {
 
     it('should start a refresh timer once called, but only once', (done) => {
       sendSpy.mockClear();
-      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"]}' }));
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":["my-new-key"], "esi-secret-token": "foo"}' }),
+      );
       const spy = jest.spyOn(service, 'refreshApiKeys');
 
       expect(spy).not.toBeCalled();
@@ -50,7 +70,9 @@ describe('CloudflareApiKeyService', () => {
   describe('interServiceKeyIsValid', () => {
     describe('when there are no api keys', () => {
       beforeAll(async () => {
-        sendSpy.mockImplementation(() => Promise.resolve({ SecretString: '{"inter-service-keys":[]}' }));
+        sendSpy.mockImplementation(() =>
+          Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+        );
         await service.refreshApiKeys();
       });
 
@@ -65,7 +87,8 @@ describe('CloudflareApiKeyService', () => {
       beforeAll(async () => {
         sendSpy.mockImplementation(() =>
           Promise.resolve({
-            SecretString: '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"]}',
+            SecretString:
+              '{"keys":["my-key", "my-other-key"], "inter-service-keys":["my-inter-service-key"], "esi-secret-token": "foo"}',
           }),
         );
         await service.refreshApiKeys();
@@ -76,4 +99,28 @@ describe('CloudflareApiKeyService', () => {
       });
     });
   });
+
+  describe('getInterServiceKeys', () => {
+    it('should return "esi-secret-token" from the secret manager', async () => {
+      sendSpy.mockClear();
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":["some-key"], "esi-secret-token": "foo"}' }),
+      );
+      await service.refreshApiKeys();
+
+      expect(service.getInterServiceKeys()).toEqual(['some-key']);
+    });
+  });
+
+  describe('getEsiSecretToken', () => {
+    it('should return "esi-secret-token" from the secret manager', async () => {
+      sendSpy.mockClear();
+      sendSpy.mockImplementationOnce(() =>
+        Promise.resolve({ SecretString: '{"inter-service-keys":[], "esi-secret-token": "foo"}' }),
+      );
+      await service.refreshApiKeys();
+
+      expect(service.getEsiSecretToken()).toEqual('foo');
+    });
+  });
 });

package/src/api-key-validation/CloudflareApiKeyService.ts

@@ -9,10 +9,12 @@ import { getLogger, Logger } from '@squiz/dx-logger-lib';
 
 export interface CloudFlareKeys {
   'inter-service-keys': string[];
+  'esi-secret-token': string;
 }
 
 let validKeys: CloudFlareKeys = {
   'inter-service-keys': [],
+  'esi-secret-token': '',
 };
 
 let refreshInterval: ReturnType<typeof setInterval>;
@@ -61,17 +63,19 @@ export class CloudflareApiKeyService implements ApiKeyValidationService {
 
     try {
       if (!secretValue.SecretString) {
-        throw new Error('cloudflare api key SecretString undefined');
+        throw new Error('Cloudflare api key SecretString undefined');
       }
-      const secret = JSON.parse(secretValue.SecretString);
-
-      if (secret['inter-service-keys']) {
-        return secret;
+      try {
+        const secret = JSON.parse(secretValue.SecretString) as CloudFlareKeys;
+        if (secret['inter-service-keys'] && secret['esi-secret-token']) {
+          return secret;
+        }
+      } catch (e) {
+        throw new Error('Invalid JSON');
       }
-
-      throw new Error('api keys retrieved and decoded successfully but contained no values');
+      throw new Error('Missing all required keys');
     } catch (e) {
-      throw new Error('failed to decode cloudflare api key values');
+      throw new Error(`Failed to decode cloudflare api key values: ${(e as Error).message}`);
     }
   }
 
@@ -92,4 +96,8 @@ export class CloudflareApiKeyService implements ApiKeyValidationService {
   public getInterServiceKeys(): string[] {
     return validKeys['inter-service-keys'];
   }
+
+  public getEsiSecretToken(): string {
+    return validKeys['esi-secret-token'];
+  }
 }

package/src/api-key-validation/DevelopmentApiKeyService.spec.ts

@@ -20,4 +20,17 @@ describe('DevelopmentApiKeyService', () => {
       expect(service.interServiceKeyIsValid('invalid-api-key')).toEqual(false);
     });
   });
+
+  describe('getInterServiceKeys', () => {
+    it('should return a fixed value', async () => {
+      console.log(service.getInterServiceKeys());
+      expect(service.getInterServiceKeys()).toEqual(['inter-service-api-key']);
+    });
+  });
+
+  describe('getEsiSecretToken', () => {
+    it('should return a fixed value', async () => {
+      expect(service.getEsiSecretToken()).toEqual('cf-secret-token');
+    });
+  });
 });

package/src/api-key-validation/DevelopmentApiKeyService.ts

@@ -2,6 +2,8 @@ import { getLogger, Logger } from '@squiz/dx-logger-lib';
 import { ApiKeyValidationService } from './ApiKeyValidationService';
 import { IncomingMessage } from 'http';
 
+export const DEVELOPMENT_ESI_SECRET = `cf-secret-token`;
+
 export class DevelopmentApiKeyService implements ApiKeyValidationService {
   private logger: Logger;
 
@@ -22,4 +24,8 @@ export class DevelopmentApiKeyService implements ApiKeyValidationService {
   public getInterServiceKeys(): string[] {
     return ['inter-service-api-key'];
   }
+
+  public getEsiSecretToken(): string {
+    return DEVELOPMENT_ESI_SECRET;
+  }
 }

package/src/edge-components-secret-key-service/DevelopmentEdgeComponentsSecretKeyService.spec.ts

@@ -0,0 +1,11 @@
+import { DevelopmentEdgeComponentsSecretKeyService } from './DevelopmentEdgeComponentsSecretKeyService';
+
+describe('DevelopmentEdgeComponentsSecretKeyService', () => {
+  describe('getSecretKey', () => {
+    it('should return secret key set', async () => {
+      const service = new DevelopmentEdgeComponentsSecretKeyService('secret-key-value');
+      await service.loadSecretKey();
+      expect(service.getSecretKey()).toBe('secret-key-value');
+    });
+  });
+});

package/src/edge-components-secret-key-service/DevelopmentEdgeComponentsSecretKeyService.ts

@@ -0,0 +1,13 @@
+import { EdgeComponentsSecretKeyService } from './EdgeComponentsSecretKeyService';
+
+export class DevelopmentEdgeComponentsSecretKeyService implements EdgeComponentsSecretKeyService {
+  constructor(protected secretValue: string) {}
+
+  public async loadSecretKey() {
+    // no-op
+  }
+
+  public getSecretKey(): string {
+    return this.secretValue;
+  }
+}

package/src/edge-components-secret-key-service/EdgeComponentsSecretKeyService.ts

@@ -0,0 +1,4 @@
+export interface EdgeComponentsSecretKeyService {
+  loadSecretKey(): Promise<void>;
+  getSecretKey(): string | undefined;
+}

package/src/edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService.spec.ts

@@ -0,0 +1,47 @@
+import { GetSecretValueCommand, SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
+import { ProductionEdgeComponentsSecretKeyService } from './ProductionEdgeComponentsSecretKeyService';
+
+const sendSpy = jest.spyOn(SecretsManagerClient.prototype, 'send');
+
+describe('ProductionEdgeComponentsSecretKeyService', () => {
+  const service = new ProductionEdgeComponentsSecretKeyService('my-secret-name');
+
+  describe('loadSecretKey', () => {
+    it('should throw an error if the secret value is not in the expected format', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"foo":"key-val"}' }));
+
+      await expect(service.loadSecretKey()).rejects.toThrowError(
+        new Error(`Invalid secret my-secret-name: Property 'key' missing in the object`),
+      );
+      expect(service.getSecretKey()).toBe(undefined);
+    });
+
+    it('should throw an error if the secret value is invalid JSON', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: 'bad json' }));
+
+      await expect(service.loadSecretKey()).rejects.toThrowError(
+        new Error(`Invalid secret my-secret-name: Unexpected token 'b', "bad json" is not valid JSON`),
+      );
+      expect(service.getSecretKey()).toBe(undefined);
+    });
+
+    it('should throw an error if the secret value is undefined', async () => {
+      sendSpy.mockImplementationOnce(() => Promise.resolve({}));
+
+      await expect(service.loadSecretKey()).rejects.toThrowError(
+        new Error(`Failed to fetch secret key my-secret-name: Secret key my-secret-name is not defined`),
+      );
+      expect(service.getSecretKey()).toBe(undefined);
+    });
+
+    it('should make a request to the aws secrets manager when loading the keys', async () => {
+      sendSpy.mockClear();
+      sendSpy.mockImplementationOnce(() => Promise.resolve({ SecretString: '{"key":"key-val"}' }));
+      await service.loadSecretKey();
+
+      expect(sendSpy.mock.lastCall[0].input).toEqual({ SecretId: 'my-secret-name' });
+      expect(sendSpy.mock.lastCall[0]).toBeInstanceOf(GetSecretValueCommand);
+      expect(service.getSecretKey()).toBe('key-val');
+    });
+  });
+});

package/src/edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService.ts

@@ -0,0 +1,63 @@
+import {
+  GetSecretValueCommand,
+  GetSecretValueCommandOutput,
+  SecretsManagerClient,
+} from '@aws-sdk/client-secrets-manager';
+import { getLogger, Logger } from '@squiz/dx-logger-lib';
+import { EdgeComponentsSecretKeyService } from './EdgeComponentsSecretKeyService';
+
+export type EdgeComponentsSecretKeyType = {
+  key: string;
+};
+
+export class ProductionEdgeComponentsSecretKeyService implements EdgeComponentsSecretKeyService {
+  protected secretsClient: SecretsManagerClient;
+  protected logger: Logger;
+  protected secretKey?: string;
+
+  constructor(protected secretName: string, logger?: Logger) {
+    this.secretsClient = new SecretsManagerClient({});
+
+    if (!logger) {
+      logger = getLogger({ name: 'SecretKeyService' });
+    }
+
+    this.logger = logger;
+  }
+
+  protected async fetchSecret(): Promise<string> {
+    let secretValue: GetSecretValueCommandOutput;
+    try {
+      secretValue = await this.secretsClient.send(
+        new GetSecretValueCommand({
+          SecretId: this.secretName,
+        }),
+      );
+      if (secretValue.SecretString === undefined) {
+        throw new Error(`Secret key ${this.secretName} is not defined`);
+      }
+    } catch (e: any) {
+      throw new Error(`Failed to fetch secret key ${this.secretName}: ${e.message}`);
+    }
+
+    try {
+      const secret = JSON.parse(secretValue.SecretString) as EdgeComponentsSecretKeyType;
+      if (secret.key === undefined) {
+        throw new Error(`Property 'key' missing in the object`);
+      }
+      return secret.key;
+    } catch (e) {
+      throw new Error(`Invalid secret ${this.secretName}: ${(e as Error).message}`);
+    }
+  }
+
+  public async loadSecretKey() {
+    this.logger.info(`Fetching secret ${this.secretName}`);
+    this.secretKey = await this.fetchSecret();
+    this.logger.info(`Found secret ${this.secretName}`);
+  }
+
+  public getSecretKey(): string | undefined {
+    return this.secretKey;
+  }
+}

package/src/edge-components-secret-key-service/getEdgeComponentsSecretService.spec.ts

@@ -0,0 +1,39 @@
+import { ProductionEdgeComponentsSecretKeyService } from './ProductionEdgeComponentsSecretKeyService';
+import { DevelopmentEdgeComponentsSecretKeyService } from './DevelopmentEdgeComponentsSecretKeyService';
+import { getEdgeComponentsSecretService } from './getEdgeComponentsSecretService';
+
+describe('getEdgeComponentsSecretService', () => {
+  it('should return an instance of DevelopmentEdgeComponentsSecretKeyService when NODE_ENV is development', () => {
+    process.env.NODE_ENV = 'development';
+    expect(getEdgeComponentsSecretService({})).toBeInstanceOf(DevelopmentEdgeComponentsSecretKeyService);
+  });
+
+  it('should return an instance of DevelopmentEdgeComponentsSecretKeyService when NODE_ENV is development - secret supplied', () => {
+    process.env.NODE_ENV = 'development';
+    expect(getEdgeComponentsSecretService({ secretValue: 'some-val' })).toBeInstanceOf(
+      DevelopmentEdgeComponentsSecretKeyService,
+    );
+  });
+
+  it('should return an instance of ProductionEdgeComponentsSecretKeyService when NODE_ENV is production', () => {
+    process.env.NODE_ENV = 'production';
+    expect(getEdgeComponentsSecretService({ secretName: 'foo' })).toBeInstanceOf(
+      ProductionEdgeComponentsSecretKeyService,
+    );
+  });
+
+  it('should throw an error if no prodEnv values available', () => {
+    process.env.NODE_ENV = 'production';
+    expect(() => getEdgeComponentsSecretService({})).toThrow(
+      new Error(`Need to specify 'secretName' for production env`),
+    );
+  });
+
+  it('should throw an error if NODE_ENV is anything other than development or production', () => {
+    process.env.NODE_ENV = 'something invalid';
+
+    expect(() => getEdgeComponentsSecretService({})).toThrow(
+      new Error(`NODE_ENV env var can only be values "production" or "development"`),
+    );
+  });
+});

package/src/edge-components-secret-key-service/getEdgeComponentsSecretService.ts

@@ -0,0 +1,21 @@
+import { getNodeEnv } from '../util';
+import { DevelopmentEdgeComponentsSecretKeyService } from './DevelopmentEdgeComponentsSecretKeyService';
+import { ProductionEdgeComponentsSecretKeyService } from './ProductionEdgeComponentsSecretKeyService';
+import { EdgeComponentsSecretKeyService } from './EdgeComponentsSecretKeyService';
+
+export function getEdgeComponentsSecretService(config: {
+  secretName?: string;
+  secretValue?: string;
+}): EdgeComponentsSecretKeyService {
+  const env = getNodeEnv();
+
+  switch (env) {
+    case 'development':
+      return new DevelopmentEdgeComponentsSecretKeyService(config.secretValue ?? '');
+    case 'production':
+      if (config.secretName === undefined) {
+        throw new Error(`Need to specify 'secretName' for production env`);
+      }
+      return new ProductionEdgeComponentsSecretKeyService(config.secretName);
+  }
+}

package/src/esi-mac-token-generator/EsiMacTokenGenerator.spec.ts

@@ -0,0 +1,25 @@
+import { EsiMacTokenGenerator } from './EsiMacTokenGenerator';
+
+describe('EsiMacTokenGenerator', () => {
+  it('should return an valid MAC', async () => {
+    const secret = 'some-secret';
+    const service = new EsiMacTokenGenerator(secret);
+
+    const requestUrl = 'http://some.url';
+    const esiUrl = 'http://some.esi.url';
+    const mac = await service.generateMac(requestUrl, esiUrl);
+
+    expect(mac).toEqual('NvARK6dlXV0dnVlnTSxTbGaT+VuDDIVY8FFdzBsf2c4=');
+
+    // verify the code
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+      'sign',
+      'verify',
+    ]);
+
+    const signature = `${requestUrl}|${esiUrl}`;
+    const verify = await crypto.subtle.verify('HMAC', key, Buffer.from(mac, 'base64'), encoder.encode(signature));
+    expect(verify).toEqual(true);
+  });
+});

package/src/esi-mac-token-generator/EsiMacTokenGenerator.ts

@@ -0,0 +1,28 @@
+export class EsiMacTokenGenerator {
+  private key: CryptoKey | undefined = undefined;
+  private encoder: TextEncoder;
+
+  constructor(private secret: string) {
+    this.encoder = new TextEncoder();
+  }
+
+  public async generateMac(requestUrl: string, esiUrl: string): Promise<string> {
+    const signatureString = `${requestUrl}|${esiUrl}`;
+    const key = await this.getKey();
+    const mac = await crypto.subtle.sign('HMAC', key, this.encoder.encode(signatureString));
+    return Buffer.from(mac).toString('base64');
+  }
+
+  private async getKey() {
+    if (this.key === undefined) {
+      this.key = await crypto.subtle.importKey(
+        'raw',
+        this.encoder.encode(this.secret),
+        { name: 'HMAC', hash: 'SHA-256' },
+        false,
+        ['sign', 'verify'],
+      );
+    }
+    return this.key;
+  }
+}

package/src/index.ts

@@ -10,3 +10,8 @@ export * from './api-key-validation/DevelopmentApiKeyService';
 export * from './api-key-validation/getApiKeyService';
 export * from './cache';
 export * from './json-order';
+export * from './edge-components-secret-key-service/DevelopmentEdgeComponentsSecretKeyService';
+export * from './edge-components-secret-key-service/ProductionEdgeComponentsSecretKeyService';
+export * from './edge-components-secret-key-service/EdgeComponentsSecretKeyService';
+export * from './edge-components-secret-key-service/getEdgeComponentsSecretService';
+export * from './esi-mac-token-generator/EsiMacTokenGenerator';