@usebruno/filestore 0.9.0 → 0.11.0

package/src/utils/secretsJsonToEnvironments.spec.ts

@@ -0,0 +1,211 @@
+import { migrateSecretsJsonToEnvironments } from './secretsJsonToEnvironments';
+import type { Environment as BrunoEnvironment } from '@usebruno/schema-types/collection/environment';
+
+const env = (name: string, overrides: Partial<BrunoEnvironment> = {}): BrunoEnvironment => ({
+  uid: `uid-${name}`,
+  name,
+  variables: [],
+  color: null,
+  ...overrides
+});
+
+// collects the nested external-secrets fields and strips the randomly generated uid
+// so they can be compared by value
+const withoutUids = (environment: any) => ({
+  secretProviderType: environment.externalSecrets?.type,
+  variables: (environment.externalSecrets?.variables || []).map(({ uid, ...rest }: any) => rest)
+});
+
+describe('migrateSecretsJsonToEnvironments', () => {
+  it('sets an external secrets group from a vault secrets.json file, preserving existing variables', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [
+          {
+            environment: 'test',
+            secrets: [
+              { name: 'cloudSecret', path: 'secret/data/cloud' },
+              { name: 'dbPassword', path: 'secret/data/db-password', enabled: false }
+            ]
+          }
+        ]
+      },
+      environments: [
+        env('test', { variables: [{ uid: 'v1', name: 'existing', value: 'keep-me', type: 'text', enabled: true }] })
+      ]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(result[0].environment.variables).toEqual([
+      { uid: 'v1', name: 'existing', value: 'keep-me', type: 'text', enabled: true }
+    ]);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [
+        { name: 'cloudSecret', path: 'secret/data/cloud', enabled: true },
+        { name: 'dbPassword', path: 'secret/data/db-password', enabled: false }
+      ]
+    });
+  });
+
+  it('sets a hashicorp-vault-cloud group when cli.type is vault-cloud', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        cli: { type: 'vault-cloud' },
+        data: [{ environment: 'test', secrets: [{ name: 'cloudSecret', path: 'app/secret' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-cloud',
+      variables: [{ name: 'cloudSecret', path: 'app/secret', enabled: true }]
+    });
+  });
+
+  it('sets a hashicorp-vault-server group when cli.type is vault-server', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        cli: { type: 'vault-server' },
+        data: [{ environment: 'test', secrets: [{ name: 'serverSecret', path: 'secret/data/x' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(withoutUids(result[0].environment).secretProviderType)
+      .toBe('hashicorp-vault-server');
+  });
+
+  it('sets an aws-secrets-manager group from an aws secrets.json file', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'aws-secrets-manager',
+        data: [{ environment: 'test', secrets: [{ name: 'awsSecret', secretName: 'my-aws-secret' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'aws-secrets-manager',
+      variables: [{ name: 'awsSecret', secretName: 'my-aws-secret', enabled: true }]
+    });
+  });
+
+  it('sets an azure-key-vault group from an azure secrets.json file', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'azure-key-vault',
+        data: [{ environment: 'test', secrets: [{ name: 'azureSecret', vaultName: 'my-key-vault' }] }]
+      },
+      environments: [env('test')]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'azure-key-vault',
+      variables: [{ name: 'azureSecret', vaultName: 'my-key-vault', enabled: true }]
+    });
+  });
+
+  it('applies the provider type to every environment, with empty variables when there is no matching entry', () => {
+    const test = env('test');
+    const prod = env('prod');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [{ environment: 'test', secrets: [{ name: 'a', path: 'p/a' }] }]
+      },
+      environments: [test, prod]
+    });
+
+    // `test` gets the type and its secret...
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [{ name: 'a', path: 'p/a', enabled: true }]
+    });
+
+    // ...and `prod` (no matching entry) gets the same type with no variables.
+    expect(result[1].changed).toBe(true);
+    expect(withoutUids(result[1].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: []
+    });
+  });
+
+  it('applies the provider type with empty variables when secrets.json data is empty', () => {
+    const test = env('test');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: { type: 'vault', data: [] },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(true);
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: []
+    });
+  });
+
+  it('leaves environments unchanged when no provider type can be resolved', () => {
+    const test = env('test');
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: { type: 'unknown-provider', data: [{ environment: 'test', secrets: [{ name: 'a', path: 'p/a' }] }] },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(false);
+    expect(result[0].environment).toBe(test);
+  });
+
+  it('skips environments that already have external secret variables', () => {
+    const test = env('test', {
+      externalSecrets: {
+        type: 'hashicorp-vault-server',
+        variables: [{ uid: 'e1', name: 'existing', path: 'secret/data/existing', enabled: true }]
+      }
+    });
+
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [{ environment: 'test', secrets: [{ name: 'incoming', path: 'secret/data/incoming' }] }]
+      },
+      environments: [test]
+    });
+
+    expect(result[0].changed).toBe(false);
+    expect(result[0].environment).toBe(test);
+  });
+
+  it('skips secrets with a missing identifier', () => {
+    const result = migrateSecretsJsonToEnvironments({
+      secretsJsonData: {
+        type: 'vault',
+        data: [
+          {
+            environment: 'test',
+            secrets: [
+              { name: 'good', path: 'p/good' },
+              { name: 'bad', path: '' }
+            ]
+          }
+        ]
+      },
+      environments: [env('test')]
+    });
+
+    expect(withoutUids(result[0].environment)).toEqual({
+      secretProviderType: 'hashicorp-vault-server',
+      variables: [{ name: 'good', path: 'p/good', enabled: true }]
+    });
+  });
+});

package/src/utils/secretsJsonToEnvironments.ts

@@ -0,0 +1,129 @@
+import type {
+  Environment as BrunoEnvironment,
+  ExternalSecrets as BrunoExternalSecrets,
+  ExternalSecretProviderType,
+  HashicorpVaultEnvironmentVariable,
+  AwsSecretsManagerEnvironmentVariable,
+  AzureKeyVaultEnvironmentVariable
+} from '@usebruno/schema-types/collection/environment';
+import { uuid } from './index';
+
+type LegacySecretsJsonSecret = {
+  name?: string;
+  path?: string;
+  secretName?: string;
+  vaultName?: string;
+  enabled?: boolean;
+};
+
+export interface SecretsJsonData {
+  type?: string;
+  data?: { environment: string; type?: string; secrets: LegacySecretsJsonSecret[] }[];
+  cli?: { type?: string };
+}
+
+export interface EnvironmentFileResult {
+  name: string;
+  environment: BrunoEnvironment;
+  changed: boolean;
+}
+
+// secrets.json is the legacy format being migrated away from; its provider group lives in
+// `type` (`'vault' | 'aws-secrets-manager' | 'azure-key-vault'`). `'vault'` doesn't distinguish
+// cloud vs server — that split lives in the legacy `cli.type` (`vault-cloud`/`vault-server`).
+// Fall back to server when no cli config is present.
+const resolveSecretProviderType = (
+  secretsJsonData: SecretsJsonData
+): ExternalSecretProviderType | null => {
+  const fileType = secretsJsonData?.type;
+  if (fileType === 'aws-secrets-manager') return 'aws-secrets-manager';
+  if (fileType === 'azure-key-vault') return 'azure-key-vault';
+  if (fileType === 'vault') {
+    return secretsJsonData?.cli?.type === 'vault-cloud' ? 'hashicorp-vault-cloud' : 'hashicorp-vault-server';
+  }
+  return null;
+};
+
+// Builds the environment's external-secrets group for the given provider type. Invalid/empty
+// secrets are filtered out; the group is still returned with an empty `variables` list so the
+// provider type lands on the environment even when it has no usable secrets.
+const buildExternalSecrets = (
+  secrets: LegacySecretsJsonSecret[] | undefined,
+  type: ExternalSecretProviderType
+): BrunoExternalSecrets | null => {
+  if (type === 'aws-secrets-manager') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.secretName === 'string' && s.secretName.length > 0)
+      .map((s): AwsSecretsManagerEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        secretName: s.secretName as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  if (type === 'azure-key-vault') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.vaultName === 'string' && s.vaultName.length > 0)
+      .map((s): AzureKeyVaultEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        vaultName: s.vaultName as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  if (type === 'hashicorp-vault-cloud' || type === 'hashicorp-vault-server') {
+    const variables = (secrets || [])
+      .filter((s) => s?.name && typeof s.path === 'string' && s.path.length > 0)
+      .map((s): HashicorpVaultEnvironmentVariable => ({
+        uid: uuid(),
+        name: s.name as string,
+        path: s.path as string,
+        enabled: s.enabled !== false
+      }));
+    return { type, variables };
+  }
+  return null;
+};
+
+/**
+ * Applies the secrets.json provider `type` to every environment's `externalSecrets`, moving each
+ * environment's matching secrets onto it. The provider type lands on every environment that
+ * doesn't already have `externalSecrets` — including ones with no matching secrets.json entry or
+ * only invalid secrets (those get the type with an empty `variables` list). Environments that
+ * already carry `externalSecrets` are returned unchanged, as is everything when no provider type
+ * can be resolved. Format-agnostic and pure; file IO is the caller's responsibility.
+ */
+export const migrateSecretsJsonToEnvironments = ({
+  secretsJsonData,
+  environments
+}: {
+  secretsJsonData: SecretsJsonData;
+  environments: BrunoEnvironment[];
+}): EnvironmentFileResult[] => {
+  const secretProviderType = resolveSecretProviderType(secretsJsonData);
+
+  return environments.map((environment) => {
+    const unchanged = { name: environment.name, environment, changed: false };
+
+    if (environment.externalSecrets || !secretProviderType) {
+      return unchanged;
+    }
+
+    const entry = secretsJsonData?.data?.find((d) => d?.environment === environment.name);
+    const externalSecrets = buildExternalSecrets(entry?.secrets, secretProviderType);
+    if (!externalSecrets) {
+      return unchanged;
+    }
+
+    return {
+      name: environment.name,
+      environment: {
+        ...environment,
+        externalSecrets
+      },
+      changed: true
+    };
+  });
+};

package/dist/formats/bru/tests/example-status-swap.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=example-status-swap.spec.d.ts.map

package/dist/formats/bru/tests/example-status-swap.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"example-status-swap.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/example-status-swap.spec.js"],"names":[],"mappings":""}

package/dist/formats/bru/tests/fixtures/oauth2-additional-params.d.ts

@@ -1,57 +0,0 @@
-export function getBruJsonWithAdditionalParams(grantType: any): {
-    meta: {
-        name: string;
-        type: string;
-        seq: number;
-    };
-    http: {
-        method: string;
-        url: string;
-    };
-    auth: {
-        oauth2: {
-            grantType: any;
-        };
-    };
-    oauth2_additional_parameters_auth_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_auth_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_access_token_req_bodyvalues: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_headers: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_queryparams: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-    oauth2_additional_parameters_refresh_token_req_bodyvalues: {
-        name: string;
-        value: string;
-        enabled: boolean;
-    }[];
-};
-//# sourceMappingURL=oauth2-additional-params.d.ts.map

package/dist/formats/bru/tests/fixtures/oauth2-additional-params.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-additional-params.d.ts","sourceRoot":"","sources":["../../../../../src/formats/bru/tests/fixtures/oauth2-additional-params.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+GE"}

package/dist/formats/bru/tests/oauth2-additional-params.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=oauth2-additional-params.spec.d.ts.map

package/dist/formats/bru/tests/oauth2-additional-params.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-additional-params.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/oauth2-additional-params.spec.js"],"names":[],"mappings":""}

package/dist/formats/bru/tests/request-parse-and-redact-body-data.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=request-parse-and-redact-body-data.spec.d.ts.map

package/dist/formats/bru/tests/request-parse-and-redact-body-data.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-parse-and-redact-body-data.spec.d.ts","sourceRoot":"","sources":["../../../../src/formats/bru/tests/request-parse-and-redact-body-data.spec.js"],"names":[],"mappings":""}