@terreno/api 0.3.1 → 0.4.0

package/dist/configurationPlugin.js

@@ -0,0 +1,285 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configurationPlugin = void 0;
+var errors_1 = require("./errors");
+var logger_1 = require("./logger");
+// ---------------------------------------------------------------------------
+// Plugin
+// ---------------------------------------------------------------------------
+/**
+ * Mongoose schema plugin that adds singleton configuration behavior.
+ *
+ * Adds:
+ * - Pre-save hook enforcing exactly one document
+ * - `getConfig()` static: fetches or creates the singleton (full doc or keyed value)
+ * - `updateConfig(updates)` static: patches the singleton
+ * - `getSecretFields()` static: returns metadata for fields with `secret: true`
+ * - `resolveSecrets(provider?)` static: fetches secret values, using the plugin provider by default
+ *
+ * Mark fields as secrets using schema path options:
+ * ```typescript
+ * const configSchema = new Schema({
+ *   apiKey: {
+ *     type: String,
+ *     description: "Third-party API key",
+ *     secret: true,
+ *     secretName: "my-api-key",
+ *   },
+ * });
+ * configSchema.plugin(configurationPlugin, {secretProvider: new EnvSecretProvider()});
+ * ```
+ */
+var configurationPlugin = function (schema, options) {
+    var pluginOptions = options !== null && options !== void 0 ? options : {};
+    // Add a sentinel field with a unique index to enforce singleton at the DB level.
+    // All config documents get _singleton: "config", and the unique index prevents duplicates.
+    schema.add({
+        _singleton: { default: "config", immutable: true, select: false, type: String },
+    });
+    schema.index({ _singleton: 1 }, { unique: true });
+    // Enforce singleton: only one document allowed (application-level guard)
+    schema.pre("save", function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var existing;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!this.isNew) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.constructor.findOne({})];
+                    case 1:
+                        existing = _a.sent();
+                        if (existing) {
+                            throw new errors_1.APIError({
+                                status: 409,
+                                title: "Only one configuration document is allowed. Use updateConfig() instead.",
+                            });
+                        }
+                        _a.label = 2;
+                    case 2: return [2 /*return*/];
+                }
+            });
+        });
+    });
+    // Prevent hard deletion of the singleton (soft deletes via isDeletedPlugin still work)
+    var createHardDeleteError = function () {
+        return new errors_1.APIError({
+            status: 400,
+            title: "Cannot hard-delete the configuration document. Use updateConfig() or soft delete instead.",
+        });
+    };
+    schema.pre("deleteOne", { document: true, query: true }, function () {
+        throw createHardDeleteError();
+    });
+    schema.pre("deleteMany", function () {
+        throw createHardDeleteError();
+    });
+    schema.pre("findOneAndDelete", function () {
+        throw createHardDeleteError();
+    });
+    // Static: get the singleton configuration document or a value at a path (race-safe via upsert)
+    schema.statics.getConfig = function (key) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config, err_1, parts, value, parts_1, parts_1_1, part;
+            var e_1, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, this.findOne({})];
+                    case 1:
+                        config = _b.sent();
+                        if (!!config) return [3 /*break*/, 8];
+                        _b.label = 2;
+                    case 2:
+                        _b.trys.push([2, 4, , 8]);
+                        // Use `new` + `save` instead of `create({})` so Mongoose initializes
+                        // nested subdocument defaults (create({}) skips them).
+                        config = new this();
+                        return [4 /*yield*/, config.save()];
+                    case 3:
+                        _b.sent();
+                        return [3 /*break*/, 8];
+                    case 4:
+                        err_1 = _b.sent();
+                        if (!((err_1 === null || err_1 === void 0 ? void 0 : err_1.status) === 409)) return [3 /*break*/, 6];
+                        return [4 /*yield*/, this.findOne({})];
+                    case 5:
+                        config = _b.sent();
+                        return [3 /*break*/, 7];
+                    case 6: throw err_1;
+                    case 7: return [3 /*break*/, 8];
+                    case 8:
+                        if (key === undefined) {
+                            return [2 /*return*/, config];
+                        }
+                        parts = key.split(".");
+                        value = config.toObject();
+                        try {
+                            for (parts_1 = __values(parts), parts_1_1 = parts_1.next(); !parts_1_1.done; parts_1_1 = parts_1.next()) {
+                                part = parts_1_1.value;
+                                if (value == null || typeof value !== "object") {
+                                    return [2 /*return*/, undefined];
+                                }
+                                value = value[part];
+                            }
+                        }
+                        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                        finally {
+                            try {
+                                if (parts_1_1 && !parts_1_1.done && (_a = parts_1.return)) _a.call(parts_1);
+                            }
+                            finally { if (e_1) throw e_1.error; }
+                        }
+                        return [2 /*return*/, value];
+                }
+            });
+        });
+    };
+    // Static: update the singleton configuration document (race-safe)
+    schema.statics.updateConfig = function (updates) {
+        return __awaiter(this, void 0, void 0, function () {
+            var config;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.getConfig()];
+                    case 1:
+                        config = _a.sent();
+                        Object.assign(config, updates);
+                        return [4 /*yield*/, config.save()];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/, config];
+                }
+            });
+        });
+    };
+    // Static: discover secret fields from schema options
+    schema.statics.getSecretFields = function () {
+        var secrets = [];
+        var discoverSecrets = function (s, prefix) {
+            s.eachPath(function (pathName, schemaType) {
+                var _a;
+                var opts = schemaType.options;
+                if ((opts === null || opts === void 0 ? void 0 : opts.secret) === true) {
+                    secrets.push({
+                        path: prefix ? "".concat(prefix, ".").concat(pathName) : pathName,
+                        secretName: (_a = opts.secretName) !== null && _a !== void 0 ? _a : pathName,
+                        secretProvider: opts.secretProvider,
+                    });
+                }
+                // Recurse into subschemas
+                if (schemaType.schema) {
+                    discoverSecrets(schemaType.schema, prefix ? "".concat(prefix, ".").concat(pathName) : pathName);
+                }
+            });
+        };
+        discoverSecrets(this.schema, "");
+        return secrets;
+    };
+    // Static: resolve secret values from a provider
+    schema.statics.resolveSecrets = function (provider) {
+        return __awaiter(this, void 0, void 0, function () {
+            var resolvedProvider, secrets, resolved, results, failCount, results_1, results_1_1, result;
+            var e_2, _a;
+            var _this = this;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        resolvedProvider = provider !== null && provider !== void 0 ? provider : pluginOptions.secretProvider;
+                        if (!resolvedProvider) {
+                            logger_1.logger.warn("resolveSecrets called with no provider. Pass a SecretProvider to resolveSecrets() or configurationPlugin options.");
+                            return [2 /*return*/, new Map()];
+                        }
+                        secrets = this.getSecretFields();
+                        resolved = new Map();
+                        return [4 /*yield*/, Promise.allSettled(secrets.map(function (meta) { return __awaiter(_this, void 0, void 0, function () {
+                                var value;
+                                return __generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0: return [4 /*yield*/, resolvedProvider.getSecret(meta.secretName)];
+                                        case 1:
+                                            value = _a.sent();
+                                            if (value !== null) {
+                                                resolved.set(meta.path, value);
+                                            }
+                                            return [2 /*return*/];
+                                    }
+                                });
+                            }); }))];
+                    case 1:
+                        results = _b.sent();
+                        failCount = 0;
+                        try {
+                            for (results_1 = __values(results), results_1_1 = results_1.next(); !results_1_1.done; results_1_1 = results_1.next()) {
+                                result = results_1_1.value;
+                                if (result.status === "rejected") {
+                                    failCount++;
+                                    logger_1.logger.error("Failed to resolve secret: ".concat(result.reason));
+                                }
+                            }
+                        }
+                        catch (e_2_1) { e_2 = { error: e_2_1 }; }
+                        finally {
+                            try {
+                                if (results_1_1 && !results_1_1.done && (_a = results_1.return)) _a.call(results_1);
+                            }
+                            finally { if (e_2) throw e_2.error; }
+                        }
+                        if (failCount > 0) {
+                            logger_1.logger.warn("".concat(failCount, "/").concat(secrets.length, " secrets failed to resolve"));
+                        }
+                        else if (secrets.length > 0) {
+                            logger_1.logger.info("Resolved ".concat(resolved.size, "/").concat(secrets.length, " secrets from ").concat(resolvedProvider.name));
+                        }
+                        return [2 /*return*/, resolved];
+                }
+            });
+        });
+    };
+};
+exports.configurationPlugin = configurationPlugin;

package/dist/configurationPlugin.test.d.ts

@@ -0,0 +1 @@
+export {};