@wavo-cloud/aws-secrets-manager-helper 0.1.8 → 0.1.11

package/app/utils/awsSecretsManager.js

@@ -7,6 +7,13 @@ const client = new AWS.SecretsManager({
   region: secretsManagerRegion,
 })
 
+/**
+ * Right now, we have client lists that tell our systems where a clients secrets are
+ * We should be using tags (ie all production client lists have a tag saying its a production client
+ * or test client etc)
+ * These tags will also hold the organization name so that client secrets can still be found by name
+ */
+
 /**
  * Attempts to parse secret
  * @param {String} secretString - The stringified secret
@@ -70,6 +77,28 @@ async function getSecretValue(secretId) {
   }
 }
 
+/**
+ * Gets secret tags from aws secrets manager
+ * Returns Array of tags
+ * @param {String} secretId - The ID of an existing secret
+ */
+async function getSecretTags(secretId) {
+  let promiseError
+  const data = await client
+    .describeSecret({ SecretId: secretId })
+    .promise()
+    .catch(error => {
+      promiseError = error
+    })
+
+  if (promiseError) {
+    handleAWSPromiseError(promiseError)
+  } else if ('Tags' in data) {
+    return data.Tags
+  }
+  return []
+}
+
 /**
  * Gets the secret keying where client secrets are stored
  * Returns JSON where JSON is the secret
@@ -92,8 +121,13 @@ async function getClientSecret(clientId, clientIdsSecretIdOverride = null) {
  * Gets all client secrets holding their API keys
  * Returns [{ clientId: String, secretId: String, ...secret }]
  * Skips all that are missing a region or organization
+ * If activeOnly flag, it only returns active client secrets
+ * This is true by default
  */
-async function getAllClientSecrets(clientIdsSecretIdOverride = null) {
+async function getAllClientSecrets(
+  clientIdsSecretIdOverride = null,
+  activeOnly = true
+) {
   const clientSecretIds = await getClientSecretIds(clientIdsSecretIdOverride)
   if (!clientSecretIds) return []
   const parsedClientSecrets = await Promise.all(
@@ -101,11 +135,21 @@ async function getAllClientSecrets(clientIdsSecretIdOverride = null) {
       const result = await getSecretValue(clientSecretIds[clientId])
       result.id = clientId
       result.secretId = clientSecretIds[clientId]
+      const tags = await getSecretTags(clientSecretIds[clientId])
+      const isActiveOrganizationTag = tags.find(
+        tag => tag.Key === 'is_active_organization'
+      ) || { Value: 'false' }
+      result.isActiveOrganization = isActiveOrganizationTag.Value
       return result
     })
   )
   return parsedClientSecrets.filter(clientSecret => {
-    if (clientSecret.organization && clientSecret.region && !clientSecret.error)
+    if (
+      clientSecret.organization &&
+      clientSecret.region &&
+      !clientSecret.error &&
+      (!activeOnly || clientSecret.isActiveOrganization)
+    )
       return true
     return false
   })
@@ -117,7 +161,7 @@ async function getAllClientSecrets(clientIdsSecretIdOverride = null) {
  * @param {String} secretDescription - The description of the secret
  * @param {String} secretValue - The JSON string secret value
  */
-async function createSecret(secretName, secretDescription, secretValue) {
+async function createSecret(secretName, secretDescription, secretValue, tags) {
   let promiseError
   if (typeof secretValue !== 'string')
     throw new Error('Secret value must be a JSON string.')
@@ -131,6 +175,7 @@ async function createSecret(secretName, secretDescription, secretValue) {
       Name: secretName,
       Description: secretDescription,
       SecretString: secretValue,
+      Tags: tags,
     })
     .promise()
     .catch(error => {
@@ -164,6 +209,50 @@ async function editSecret(secretName, secretValue) {
   else return data
 }
 
+/**
+ * Removes a set of tags from a secret
+ * @param {String} secretName - The friendly name of the secret
+ * @param {Object} tagNames - An array of strings representing tags to remove
+ */
+async function removeTags(secretName, tagNames) {
+  let promiseError
+  const data = await client
+    .untagResource({
+      SecretId: secretName,
+      TagKeys: tagNames,
+    })
+    .promise()
+    .catch(error => {
+      promiseError = error
+    })
+
+  if (promiseError) handleAWSPromiseError(promiseError)
+  else return data
+}
+
+/**
+ * Appends a set of tags to a secret
+ * @param {String} secretName - The friendly name of the secret
+ * @param {Object} tags - An array of objects representing tags to add
+ * Object structure:
+ * { Key: 'key', Value: 'value' }
+ */
+async function appendTags(secretName, tags) {
+  let promiseError
+  const data = await client
+    .tagResource({
+      SecretId: secretName,
+      Tags: tags,
+    })
+    .promise()
+    .catch(error => {
+      promiseError = error
+    })
+
+  if (promiseError) handleAWSPromiseError(promiseError)
+  else return data
+}
+
 /**
  * Adds a client to the client list and does data validation
  * @param {String} clientId - The ID of the client
@@ -172,14 +261,16 @@ async function editSecret(secretName, secretValue) {
  * @param {String} region - The sub location of the organization's data in S3
  * @param {Object} keyValuePairs - The secret to store for the client
  */
-async function createClient(
+async function createClient({
   clientId,
   clientName,
   organization,
   region,
   keyValuePairs,
-  clientIdsSecretIdOverride = null
-) {
+  clientIdsSecretIdOverride = null,
+  isSelfServe = false,
+  isActiveOrganization = false,
+}) {
   if (!clientId || !clientName || !organization || !region)
     throw new Error('Client ID, name, organization, and region are required.')
   const regex = new RegExp('^[a-z0-9-_]*$')
@@ -203,7 +294,17 @@ async function createClient(
       organization,
       region,
       ...keyValuePairs,
-    })
+    }),
+    [
+      {
+        Key: 'self_serve',
+        Value: isSelfServe.toString(),
+      },
+      {
+        Key: 'is_active_organization',
+        Value: isActiveOrganization.toString(),
+      },
+    ]
   )
   // add to client list
   const editClientListResults = await editSecret(
@@ -225,14 +326,14 @@ async function createClient(
  * @param {String} region - The sub location of the organization's data in S3
  * @param {Object} keyValuePairs - The secret to store for the client
  */
-async function setClient(
+async function setClient({
   clientId,
   clientName,
   organization,
   region,
   keyValuePairs,
-  clientIdsSecretIdOverride = null
-) {
+  clientIdsSecretIdOverride = null,
+}) {
   if (!clientId || !clientName || !organization || !region)
     throw new Error('Client ID, name, organization, and region are required.')
   const regex = new RegExp('^[a-z0-9-_]*$')
@@ -271,12 +372,12 @@ async function setClient(
  * @param {Object} keyValuePairsToAdd
  * @param {Array} keysToDelete
  */
-async function editClient(
+async function editClient({
   clientId,
   keyValuePairsToAdd,
   keysToDelete,
-  clientIdsSecretIdOverride
-) {
+  clientIdsSecretIdOverride,
+}) {
   if (!clientId) throw new Error('Client ID is required.')
   if (
     keysToDelete.some(key =>
@@ -313,12 +414,36 @@ async function editClient(
   return { editClientResults }
 }
 
+async function setClientActiveStatus({
+  clientId,
+  newActiveStatus,
+  clientIdsSecretIdOverride,
+}) {
+  if (!clientId) throw new Error('Client ID is required.')
+  if (newActiveStatus === null || newActiveStatus === undefined)
+    throw new Error('New active status is required.')
+  if (typeof newActiveStatus !== 'boolean')
+    throw new Error('New active status must be a boolean')
+  // get client secret location
+  const currentClientList = await getClientSecretIds(clientIdsSecretIdOverride)
+  const clientSecretId = currentClientList[clientId]
+  await removeTags(clientSecretId, ['is_active_organization'])
+  await appendTags(clientSecretId, [
+    {
+      Key: 'is_active_organization',
+      Value: newActiveStatus.toString(),
+    },
+  ])
+}
+
 module.exports = {
   getClientSecretIds,
   getClientSecret,
   getAllClientSecrets,
   getSecretValue,
+  getSecretTags,
   createClient,
   setClient,
   editClient,
+  setClientActiveStatus,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wavo-cloud/aws-secrets-manager-helper",
-  "version": "0.1.8",
+  "version": "0.1.11",
   "description": "Wavo Cloud Infallible AWS Secrets Manager Helper",
   "license": "UNLICENSED",
   "repository": {

package/test/aws.test.js

@@ -3,9 +3,11 @@ const {
   getAllClientSecrets,
   getClientSecretIds,
   getSecretValue,
+  getSecretTags,
   createClient,
   setClient,
   editClient,
+  setClientActiveStatus,
 } = require('../app/utils/awsSecretsManager')
 const { deleteClient } = require('../app/utils/awsSecretsManagerDeleteHelper')
 const expect = require('chai').expect
@@ -25,33 +27,56 @@ describe('Test Secrets Manager Helper', async () => {
   })
 
   it('should create a new client', async () => {
-    const createClientResult = await createClient(
-      'test_client_id',
-      'test_client_name',
-      'test_organization',
-      'test_region',
-      { test_secret_key: 'test_secret_value' },
-      clientIdsSecretId
-    )
+    const createClientResult = await createClient({
+      clientId: 'test_client_id',
+      clientName: 'test_client_name',
+      organization: 'test_organization',
+      region: 'test_region',
+      keyValuePairs: { test_secret_key: 'test_secret_value' },
+      clientIdsSecretIdOverride: clientIdsSecretId,
+      isSelfServe: true,
+      isActiveOrganization: true,
+    })
     expect(createClientResult.createSecretResults.Name).to.equal(
       'test_organization/ad_platforms/api'
     )
 
+    const newClientTags = await getSecretTags('test_organization/ad_platforms/api')
+    const isActiveOrganizationTag = newClientTags.find(
+      tag => tag.Key === 'is_active_organization'
+    )
+    expect(isActiveOrganizationTag.Value === 'true')
+
     const clientList = await getClientSecretIds(clientIdsSecretId)
     expect(clientList['test_client_id']).to.equal(
       'test_organization/ad_platforms/api'
     )
   })
 
-  it('should set a client', async () => {
-    await setClient(
-      'test_client_id',
-      'test_client_name_2',
-      'test_organization',
-      'test_region_new',
-      { test_secret_key_new: 'test_secret_value_new', to_delete: 'to_delete' },
-      clientIdsSecretId
+  it('should change the clients active status to false', async () => {
+    await setClientActiveStatus({
+      clientId: 'test_client_id',
+      newActiveStatus: false,
+      clientIdsSecretIdOverride: clientIdsSecretId,
+    })
+
+    const clientTags = await getSecretTags('test_organization/ad_platforms/api')
+    const isActiveOrganizationTag = clientTags.find(
+      tag => tag.Key === 'is_active_organization'
     )
+    expect(isActiveOrganizationTag.Value === 'falsey')
+
+  })
+
+  it('should set a client', async () => {
+    await setClient({
+      clientId: 'test_client_id',
+      clientName: 'test_client_name_2',
+      organization: 'test_organization',
+      region: 'test_region_new',
+      keyValuePairs: { test_secret_key_new: 'test_secret_value_new', to_delete: 'to_delete' },
+      clientIdsSecretIdOverride: clientIdsSecretId
+    })
 
     const testSecret = await getSecretValue(
       'test_organization/ad_platforms/api'
@@ -65,16 +90,16 @@ describe('Test Secrets Manager Helper', async () => {
   })
 
   it('should edit, add, and delete a client key/value secret', async () => {
-    await editClient(
-      'test_client_id',
-      {
+    await editClient({
+      clientId: 'test_client_id',
+      keyValuePairsToAdd: {
         test_secret_key_new: 'edit',
         new_key: 'add',
         organization: 'test_organization_new'
       },
-      ['to_delete'],
-      clientIdsSecretId
-    )
+      keysToDelete: ['to_delete'],
+      clientIdsSecretIdOverride: clientIdsSecretId
+    })
 
     const testSecret = await getSecretValue(
       'test_organization/ad_platforms/api'