@usebruno/filestore 0.10.0 → 0.12.0

package/src/utils/secretsJsonToEnvironments.spec.ts

@@ -0,0 +1,211 @@
+import { migrateSecretsJsonToEnvironments } from './secretsJsonToEnvironments';
+import type { Environment as BrunoEnvironment } from '@usebruno/schema-types/collection/environment';
+
+const env = (name: string, overrides: Partial<BrunoEnvironment> = {}): BrunoEnvironment => ({
+  uid: `uid-${name}`,
+  name,
+  variables: [],
+  color: null,
+  ...overrides
+});
+
+// collects the nested external-secrets fields and strips the randomly generated uid
+// so they can be compared by value
+const withoutUids = (environment: any) => ({
+  secretProviderType: environment.externalSecrets?.type,
+  variables: (environment.externalSecrets?.variables || []).map(({ uid, ...rest }: any) => rest)
+});
+
+describe('migrateSecretsJsonToEnvironments', () => {
+  it('sets an external secrets group from a vault secrets.json file, preserving existing variables', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [
+          {
+            environment: 'test',
+            secrets: [
+              { name: 'cloudSecret', path: 'secret/data/cloud' },
+              { name: 'dbPassword', path: 'secret/data/db-password', enabled: false }
+            ]
+          }
+        ]
+      },
+      environments: [
+        env('test', { variables: [{ uid: 'v1', name: 'existing', value: 'keep-me', type: 'text', enabled: true }] })
+      ]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(result[0].environment.variables).toEqual([
+      { uid: 'v1', name: 'existing', value: 'keep-me', type: 'text', enabled: true }
+    ]);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [
+        { name: 'cloudSecret', path: 'secret/data/cloud', enabled: true },
+        { name: 'dbPassword', path: 'secret/data/db-password', enabled: false }
+      ]
+    });
+  });
+
+  it('sets a hashicorp-vault-cloud group when cli.type is vault-cloud', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        cli: { type: 'vault-cloud' },
+        data: [{ environment: 'test', secrets: [{ name: 'cloudSecret', path: 'app/secret' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-cloud',
+      variables: [{ name: 'cloudSecret', path: 'app/secret', enabled: true }]
+    });
+  });
+
+  it('sets a hashicorp-vault-server group when cli.type is vault-server', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        cli: { type: 'vault-server' },
+        data: [{ environment: 'test', secrets: [{ name: 'serverSecret', path: 'secret/data/x' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(withoutUids(result[0].environment).secretProviderType)
+      .toBe('hashicorp-vault-server');
+  });
+
+  it('sets an aws-secrets-manager group from an aws secrets.json file', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'aws-secrets-manager',
+        data: [{ environment: 'test', secrets: [{ name: 'awsSecret', secretName: 'my-aws-secret' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'aws-secrets-manager',
+      variables: [{ name: 'awsSecret', secretName: 'my-aws-secret', enabled: true }]
+    });
+  });
+
+  it('sets an azure-key-vault group from an azure secrets.json file', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'azure-key-vault',
+        data: [{ environment: 'test', secrets: [{ name: 'azureSecret', vaultName: 'my-key-vault' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'azure-key-vault',
+      variables: [{ name: 'azureSecret', vaultName: 'my-key-vault', enabled: true }]
+    });
+  });
+
+  it('applies the provider type to every environment, with empty variables when there is no matching entry', () => {
+    const test = env('test');
+    const prod = env('prod');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [{ environment: 'test', secrets: [{ name: 'a', path: 'p/a' }] }]
+      },
+      environments: [test, prod]
+    });
+
+    // `test` gets the type and its secret...
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [{ name: 'a', path: 'p/a', enabled: true }]
+    });
+
+    // ...and `prod` (no matching entry) gets the same type with no variables.
+    expect(result[1].changed).toBe(true);
+    expect(withoutUids(result[1].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: []
+    });
+  });
+
+  it('applies the provider type with empty variables when secrets.json data is empty', () => {
+    const test = env('test');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: { type: 'vault', data: [] },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: []
+    });
+  });
+
+  it('leaves environments unchanged when no provider type can be resolved', () => {
+    const test = env('test');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: { type: 'unknown-provider', data: [{ environment: 'test', secrets: [{ name: 'a', path: 'p/a' }] }] },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(false);
+    expect(result[0].environment).toBe(test);
+  });
+
+  it('skips environments that already have external secret variables', () => {
+    const test = env('test', {
+      externalSecrets: {
+        type: 'hashicorp-vault-server',
+        variables: [{ uid: 'e1', name: 'existing', path: 'secret/data/existing', enabled: true }]
+      }
+    });
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [{ environment: 'test', secrets: [{ name: 'incoming', path: 'secret/data/incoming' }] }]
+      },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(false);
+    expect(result[0].environment).toBe(test);
+  });
+
+  it('skips secrets with a missing identifier', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [
+          {
+            environment: 'test',
+            secrets: [
+              { name: 'good', path: 'p/good' },
+              { name: 'bad', path: '' }
+            ]
+          }
+        ]
+      },
+      environments: [env('test')]
+    });
+
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [{ name: 'good', path: 'p/good', enabled: true }]
+    });
+  });
+});

package/src/utils/secretsJsonToEnvironments.ts

@@ -0,0 +1,129 @@
+import type {
+  Environment as BrunoEnvironment,
+  ExternalSecrets as BrunoExternalSecrets,
+  ExternalSecretProviderType,
+  HashicorpVaultEnvironmentVariable,
+  AwsSecretsManagerEnvironmentVariable,
+  AzureKeyVaultEnvironmentVariable
+} from '@usebruno/schema-types/collection/environment';
+import { uuid } from './index';
+
+type LegacySecretsJsonSecret = {
+  name?: string;
+  path?: string;
+  secretName?: string;
+  vaultName?: string;
+  enabled?: boolean;
+};
+
+export interface SecretsJsonData {
+  type?: string;
+  data?: { environment: string; type?: string; secrets: LegacySecretsJsonSecret[] }[];
+  cli?: { type?: string };
+}
+
+export interface EnvironmentFileResult {
+  name: string;
+  environment: BrunoEnvironment;
+  changed: boolean;
+}
+
+// secrets.json is the legacy format being migrated away from; its provider group lives in
+// `type` (`'vault' | 'aws-secrets-manager' | 'azure-key-vault'`). `'vault'` doesn't distinguish
+// cloud vs server — that split lives in the legacy `cli.type` (`vault-cloud`/`vault-server`).
+// Fall back to server when no cli config is present.
+const resolveSecretProviderType = (
+  secretsJsonData: SecretsJsonData
+): ExternalSecretProviderType | null => {
+  const fileType = secretsJsonData?.type;
+  if (fileType === 'aws-secrets-manager') return 'aws-secrets-manager';
+  if (fileType === 'azure-key-vault') return 'azure-key-vault';
+  if (fileType === 'vault') {
+    return secretsJsonData?.cli?.type === 'vault-cloud' ? 'hashicorp-vault-cloud' : 'hashicorp-vault-server';
+  }
+  return null;
+};
+
+// Builds the environment's external-secrets group for the given provider type. Invalid/empty
+// secrets are filtered out; the group is still returned with an empty `variables` list so the
+// provider type lands on the environment even when it has no usable secrets.
+const buildExternalSecrets = (
+  secrets: LegacySecretsJsonSecret[] | undefined,
+  type: ExternalSecretProviderType
+): BrunoExternalSecrets | null => {
+  if (type === 'aws-secrets-manager') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.secretName === 'string' && s.secretName.length > 0)
+      .map((s): AwsSecretsManagerEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        secretName: s.secretName as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  if (type === 'azure-key-vault') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.vaultName === 'string' && s.vaultName.length > 0)
+      .map((s): AzureKeyVaultEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        vaultName: s.vaultName as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  if (type === 'hashicorp-vault-cloud' || type === 'hashicorp-vault-server') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.path === 'string' && s.path.length > 0)
+      .map((s): HashicorpVaultEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        path: s.path as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  return null;
+};
+
+/**
+ * Applies the secrets.json provider `type` to every environment's `externalSecrets`, moving each
+ * environment's matching secrets onto it. The provider type lands on every environment that
+ * doesn't already have `externalSecrets` — including ones with no matching secrets.json entry or
+ * only invalid secrets (those get the type with an empty `variables` list). Environments that
+ * already carry `externalSecrets` are returned unchanged, as is everything when no provider type
+ * can be resolved. Format-agnostic and pure; file IO is the caller's responsibility.
+ */
+export const migrateSecretsJsonToEnvironments = ({
+  secretsJsonData,
+  environments
+}: {
+  secretsJsonData: SecretsJsonData;
+  environments: BrunoEnvironment[];
+}): EnvironmentFileResult[] => {
+  const secretProviderType = resolveSecretProviderType(secretsJsonData);
+
+  return environments.map((environment) => {
+    const unchanged = { name: environment.name, environment, changed: false };
+
+    if (environment.externalSecrets || !secretProviderType) {
+      return unchanged;
+    }
+
+    const entry = secretsJsonData?.data?.find((d) => d?.environment === environment.name);
+    const externalSecrets = buildExternalSecrets(entry?.secrets, secretProviderType);
+    if (!externalSecrets) {
+      return unchanged;
+    }
+
+    return {
+      name: environment.name,
+      environment: {
+        ...environment,
+        externalSecrets
+      },
+      changed: true
+    };
+  });
+};

package/src/workers/WorkerQueue/index.ts

@@ -1,10 +1,18 @@
 import { Worker } from 'node:worker_threads';
 
+type WorkerTaskType
+  = | 'parse'
+    | 'stringify'
+    | 'parseFolder'
+    | 'stringifyFolder'
+    | 'parseEnvironment'
+    | 'stringifyEnvironment';
+
 interface QueuedTask {
   priority: number;
   scriptPath: string;
   data: any;
-  taskType: 'parse' | 'stringify';
+  taskType: WorkerTaskType;
   resolve?: (value: any) => void;
   reject?: (reason?: any) => void;
 }
@@ -58,7 +66,7 @@ class WorkerQueue {
     }
   }
 
-  async runWorker({ scriptPath, data, taskType }: { scriptPath: string; data: any; taskType: 'parse' | 'stringify' }) {
+  async runWorker({ scriptPath, data, taskType }: { scriptPath: string; data: any; taskType: WorkerTaskType }) {
     return new Promise(async (resolve, reject) => {
       let worker = await this.getWorkerForScriptPath(scriptPath);
 

package/src/workers/index.ts

@@ -55,7 +55,15 @@ class BruParserWorker {
     return queueForSize?.workerQueue ?? this.workerQueues[this.workerQueues.length - 1].workerQueue;
   }
 
-  private async enqueueTask({ data, taskType, format = DEFAULT_COLLECTION_FORMAT }: { data: any; taskType: 'parse' | 'stringify'; format?: CollectionFormat }): Promise<any> {
+  private async enqueueTask({
+    data,
+    taskType,
+    format = DEFAULT_COLLECTION_FORMAT
+  }: {
+    data: any;
+    taskType: 'parse' | 'stringify' | 'parseFolder' | 'stringifyFolder' | 'parseEnvironment' | 'stringifyEnvironment';
+    format?: CollectionFormat;
+  }): Promise<any> {
     const size = getSize(data);
     const workerQueue = this.getWorkerQueue(size);
     const workerScriptPath = path.join(__dirname, './workers/worker-script.js');
@@ -76,6 +84,22 @@ class BruParserWorker {
     return this.enqueueTask({ data, taskType: 'stringify', format });
   }
 
+  async parseFolder(data: any, format: CollectionFormat = DEFAULT_COLLECTION_FORMAT): Promise<any> {
+    return this.enqueueTask({ data, taskType: 'parseFolder', format });
+  }
+
+  async stringifyFolder(data: any, format: CollectionFormat = DEFAULT_COLLECTION_FORMAT): Promise<any> {
+    return this.enqueueTask({ data, taskType: 'stringifyFolder', format });
+  }
+
+  async parseEnvironment(data: any, format: CollectionFormat = DEFAULT_COLLECTION_FORMAT): Promise<any> {
+    return this.enqueueTask({ data, taskType: 'parseEnvironment', format });
+  }
+
+  async stringifyEnvironment(data: any, format: CollectionFormat = DEFAULT_COLLECTION_FORMAT): Promise<any> {
+    return this.enqueueTask({ data, taskType: 'stringifyEnvironment', format });
+  }
+
   async cleanup(): Promise<void> {
     const cleanupPromises = this.workerQueues.map(({ workerQueue }) =>
       workerQueue.cleanup()

package/src/workers/worker-script.ts

@@ -1,39 +1,63 @@
 import { parentPort } from 'node:worker_threads';
-import { parseBruRequest, stringifyBruRequest } from '../formats/bru';
-import { parseYmlItem, stringifyYmlItem } from '../formats/yml';
+import {
+  parseBruRequest,
+  parseBruCollection,
+  parseBruEnvironment,
+  stringifyBruRequest,
+  stringifyBruCollection,
+  stringifyBruEnvironment
+} from '../formats/bru';
+import {
+  parseYmlItem,
+  parseYmlFolder,
+  parseYmlEnvironment,
+  stringifyYmlItem,
+  stringifyYmlFolder,
+  stringifyYmlEnvironment
+} from '../formats/yml';
 import { CollectionFormat } from '../types';
 import { DEFAULT_COLLECTION_FORMAT } from '../constants';
 
+type TaskType
+  = | 'parse'
+    | 'stringify'
+    | 'parseFolder'
+    | 'stringifyFolder'
+    | 'parseEnvironment'
+    | 'stringifyEnvironment';
+
 interface WorkerMessage {
-  taskType: 'parse' | 'stringify';
+  taskType: TaskType;
   data: {
     data: any;
     format?: CollectionFormat;
   };
 }
 
+const runTask = (taskType: TaskType, data: any, format: CollectionFormat): any => {
+  switch (taskType) {
+    case 'parse':
+      return format === 'yml' ? parseYmlItem(data) : parseBruRequest(data);
+    case 'stringify':
+      return format === 'yml' ? stringifyYmlItem(data) : stringifyBruRequest(data);
+    case 'parseFolder':
+      return format === 'yml' ? parseYmlFolder(data) : parseBruCollection(data);
+    case 'stringifyFolder':
+      return format === 'yml' ? stringifyYmlFolder(data) : stringifyBruCollection(data, true);
+    case 'parseEnvironment':
+      return format === 'yml' ? parseYmlEnvironment(data) : parseBruEnvironment(data);
+    case 'stringifyEnvironment':
+      return format === 'yml' ? stringifyYmlEnvironment(data) : stringifyBruEnvironment(data);
+    default:
+      throw new Error(`Unknown task type: ${taskType}`);
+  }
+};
+
 parentPort?.on('message', async (message: WorkerMessage) => {
   try {
     const { taskType, data: messageData } = message;
     const { data, format = DEFAULT_COLLECTION_FORMAT } = messageData;
-    let result: any;
-
-    if (taskType === 'parse') {
-      if (format === 'yml') {
-        result = parseYmlItem(data);
-      } else {
-        result = parseBruRequest(data);
-      }
-    } else if (taskType === 'stringify') {
-      if (format === 'yml') {
-        result = stringifyYmlItem(data);
-      } else {
-        result = stringifyBruRequest(data);
-      }
-    } else {
-      throw new Error(`Unknown task type: ${taskType}`);
-    }
-
+    const result = runTask(taskType, data, format);
     parentPort?.postMessage(result);
   } catch (error: any) {
     console.error('Worker error:', error);

package/dist/formats/bru/tests/example-status-swap.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=example-status-swap.spec.d.ts.map

package/dist/formats/bru/tests/example-status-swap.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"example-status-swap.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/example-status-swap.spec.js"],"names":[],"mappings":""}

package/dist/formats/bru/tests/fixtures/oauth2-additional-params.d.ts

@@ -1,57 +0,0 @@
-export function getBruJsonWithAdditionalParams(grantType: any): {
-    meta: {
-        name: string;
-        type: string;
-        seq: number;
-    };
-    http: {
-        method: string;
-        url: string;
-    };
-    auth: {
-        oauth2: {
-            grantType: any;
-        };
-    };
-    oauth2_additional_parameters_auth_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_auth_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_bodyvalues: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_bodyvalues: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-};
-//# sourceMappingURL=oauth2-additional-params.d.ts.map

package/dist/formats/bru/tests/fixtures/oauth2-additional-params.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-additional-params.d.ts","sourceRoot":"","sources":["../../../../../src/formats/bru/tests/fixtures/oauth2-additional-params.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+GE"}

package/dist/formats/bru/tests/oauth2-additional-params.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth2-additional-params.spec.d.ts.map

package/dist/formats/bru/tests/oauth2-additional-params.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-additional-params.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/oauth2-additional-params.spec.js"],"names":[],"mappings":""}

package/dist/formats/bru/tests/request-parse-and-redact-body-data.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=request-parse-and-redact-body-data.spec.d.ts.map

package/dist/formats/bru/tests/request-parse-and-redact-body-data.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-parse-and-redact-body-data.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/request-parse-and-redact-body-data.spec.js"],"names":[],"mappings":""}

package/dist/formats/yml/tests/parseEnvironment.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=parseEnvironment.spec.d.ts.map

package/dist/formats/yml/tests/parseEnvironment.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parseEnvironment.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/yml/tests/parseEnvironment.spec.js"],"names":[],"mappings":""}

package/dist/formats/yml/tests/variables.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=variables.spec.d.ts.map

package/dist/formats/yml/tests/variables.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"variables.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/yml/tests/variables.spec.js"],"names":[],"mappings":""}