@winible/winible-typed 2.118.0 → 2.120.0

package/utils/lambdaUtils/initialization.test.ts

@@ -20,12 +20,19 @@ describe('Lambda Initialization', () => {
 
     // Clear environment variables
     delete process.env.LAMBDA_SECRET_ARN;
+    delete process.env.LAMBDA_SECRET_NAME;
+    delete process.env.LAMBDA_SECRET;
     delete process.env.AWS_REGION;
     delete process.env.TEST_VAR_1;
     delete process.env.TEST_VAR_2;
     delete process.env.VAR1;
     delete process.env.VAR2;
     delete process.env.VAR3;
+    delete process.env.DB_HOST;
+    delete process.env.DB_USER;
+    delete process.env.DB_PASSWORD;
+    delete process.env.REDIS_HOST;
+    delete process.env.REDIS_PASSWORD;
   });
 
   afterEach(() => {
@@ -116,8 +123,8 @@ describe('Lambda Initialization', () => {
         );
       });
 
-      it('should use default secret ARN from environment', async () => {
-        process.env.LAMBDA_SECRET_ARN = 'env-secret-arn';
+      it('should use default secret ARN from LAMBDA_SECRET_NAME environment variable', async () => {
+        process.env.LAMBDA_SECRET_NAME = 'env-secret-name';
         const mockCredentials = { TEST_VAR_1: 'value1' };
 
         mockLoadCredentials.mockResolvedValue(mockCredentials);
@@ -127,7 +134,42 @@ describe('Lambda Initialization', () => {
         });
 
         expect(mockLoadCredentials).toHaveBeenCalledWith(
-          'env-secret-arn',
+          'env-secret-name',
+          'us-east-1',
+          ['TEST_VAR_1']
+        );
+      });
+
+      it('should use LAMBDA_SECRET as fallback if LAMBDA_SECRET_NAME is not set', async () => {
+        process.env.LAMBDA_SECRET = 'env-secret-fallback';
+        const mockCredentials = { TEST_VAR_1: 'value1' };
+
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        await initializeLambda<TestCredentials>({
+          requiredEnvVars: ['TEST_VAR_1'],
+        });
+
+        expect(mockLoadCredentials).toHaveBeenCalledWith(
+          'env-secret-fallback',
+          'us-east-1',
+          ['TEST_VAR_1']
+        );
+      });
+
+      it('should prefer LAMBDA_SECRET_NAME over LAMBDA_SECRET', async () => {
+        process.env.LAMBDA_SECRET_NAME = 'preferred-secret';
+        process.env.LAMBDA_SECRET = 'fallback-secret';
+        const mockCredentials = { TEST_VAR_1: 'value1' };
+
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        await initializeLambda<TestCredentials>({
+          requiredEnvVars: ['TEST_VAR_1'],
+        });
+
+        expect(mockLoadCredentials).toHaveBeenCalledWith(
+          'preferred-secret',
           'us-east-1',
           ['TEST_VAR_1']
         );
@@ -302,9 +344,9 @@ describe('Lambda Initialization', () => {
 
     describe('integration scenarios', () => {
       it('should handle a typical Lambda initialization flow', async () => {
-        // Setup: environment has AWS region and secret ARN
+        // Setup: environment has AWS region and secret name
         process.env.AWS_REGION = 'us-east-1';
-        process.env.LAMBDA_SECRET_ARN = 'arn:aws:secretsmanager:us-east-1:123456789:secret:my-secret';
+        process.env.LAMBDA_SECRET_NAME = 'my-lambda-secret';
 
         const mockCredentials = {
           DB_HOST: 'localhost',
@@ -329,5 +371,233 @@ describe('Lambda Initialization', () => {
         expect(process.env.DB_PASSWORD).toBe('secret');
       });
     });
+
+    describe('Multi-secret mode', () => {
+      interface DatabaseCredentials {
+        DB_HOST: string;
+        DB_USER: string;
+        DB_PASSWORD: string;
+      }
+
+      interface RedisCredentials {
+        REDIS_HOST: string;
+        REDIS_PASSWORD: string;
+      }
+
+      it('should load credentials from multiple secrets', async () => {
+        const dbCredentials = {
+          DB_HOST: 'db.example.com',
+          DB_USER: 'dbuser',
+          DB_PASSWORD: 'dbpass',
+        };
+
+        const redisCredentials = {
+          REDIS_HOST: 'redis.example.com',
+          REDIS_PASSWORD: 'redispass',
+        };
+
+        mockLoadCredentials
+          .mockResolvedValueOnce(dbCredentials)
+          .mockResolvedValueOnce(redisCredentials);
+
+        await initializeLambda({
+          secrets: [
+            {
+              secretArn: 'db-secret-arn',
+              requiredEnvVars: ['DB_HOST', 'DB_USER', 'DB_PASSWORD'] as (keyof DatabaseCredentials)[],
+            },
+            {
+              secretArn: 'redis-secret-arn',
+              requiredEnvVars: ['REDIS_HOST', 'REDIS_PASSWORD'] as (keyof RedisCredentials)[],
+            },
+          ],
+        });
+
+        // Verify loadCredentials was called for each secret
+        expect(mockLoadCredentials).toHaveBeenCalledTimes(2);
+        expect(mockLoadCredentials).toHaveBeenNthCalledWith(
+          1,
+          'db-secret-arn',
+          'us-east-1',
+          ['DB_HOST', 'DB_USER', 'DB_PASSWORD']
+        );
+        expect(mockLoadCredentials).toHaveBeenNthCalledWith(
+          2,
+          'redis-secret-arn',
+          'us-east-1',
+          ['REDIS_HOST', 'REDIS_PASSWORD']
+        );
+
+        // Verify all credentials are set in process.env
+        expect(process.env.DB_HOST).toBe('db.example.com');
+        expect(process.env.DB_USER).toBe('dbuser');
+        expect(process.env.DB_PASSWORD).toBe('dbpass');
+        expect(process.env.REDIS_HOST).toBe('redis.example.com');
+        expect(process.env.REDIS_PASSWORD).toBe('redispass');
+
+        // Verify console output
+        expect(consoleLogSpy).toHaveBeenCalledWith('📦 Loading credentials from 2 secrets');
+        expect(consoleLogSpy).toHaveBeenCalledWith('✅ Lambda initialization complete');
+      });
+
+      it('should use custom region for multi-secret mode', async () => {
+        const mockCredentials = { DB_HOST: 'localhost' };
+
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        await initializeLambda({
+          region: 'eu-west-1',
+          secrets: [
+            {
+              secretArn: 'test-secret',
+              requiredEnvVars: ['DB_HOST'],
+            },
+          ],
+        });
+
+        expect(mockLoadCredentials).toHaveBeenCalledWith(
+          'test-secret',
+          'eu-west-1',
+          ['DB_HOST']
+        );
+      });
+
+      it('should throw error if one secret fails to load', async () => {
+        mockLoadCredentials
+          .mockResolvedValueOnce({ DB_HOST: 'localhost' })
+          .mockResolvedValueOnce(null as any); // Second secret fails
+
+        await expect(
+          initializeLambda({
+            secrets: [
+              {
+                secretArn: 'db-secret',
+                requiredEnvVars: ['DB_HOST'],
+              },
+              {
+                secretArn: 'redis-secret',
+                requiredEnvVars: ['REDIS_HOST'],
+              },
+            ],
+          })
+        ).rejects.toThrow('Failed to load credentials from secret: redis-secret');
+
+        expect(consoleErrorSpy).toHaveBeenCalledWith(
+          '❌ Lambda initialization failed:',
+          expect.any(Error)
+        );
+      });
+
+      it('should validate all environment variables across secrets', async () => {
+        mockLoadCredentials
+          .mockResolvedValueOnce({ DB_HOST: 'localhost' }) // Missing DB_USER
+          .mockResolvedValueOnce({ REDIS_HOST: 'localhost' });
+
+        await expect(
+          initializeLambda({
+            secrets: [
+              {
+                secretArn: 'db-secret',
+                requiredEnvVars: ['DB_HOST', 'DB_USER'],
+              },
+              {
+                secretArn: 'redis-secret',
+                requiredEnvVars: ['REDIS_HOST'],
+              },
+            ],
+          })
+        ).rejects.toThrow('Missing required environment variables: DB_USER');
+      });
+
+      it('should handle single secret in multi-secret mode', async () => {
+        const mockCredentials = { DB_HOST: 'localhost', DB_USER: 'admin' };
+
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        await initializeLambda({
+          secrets: [
+            {
+              secretArn: 'my-secret',
+              requiredEnvVars: ['DB_HOST', 'DB_USER'],
+            },
+          ],
+        });
+
+        expect(mockLoadCredentials).toHaveBeenCalledTimes(1);
+        expect(process.env.DB_HOST).toBe('localhost');
+        expect(process.env.DB_USER).toBe('admin');
+        expect(consoleLogSpy).toHaveBeenCalledWith('📦 Loading credentials from 1 secrets');
+      });
+
+      it('should handle empty secrets array', async () => {
+        await expect(
+          initializeLambda({
+            secrets: [],
+          })
+        ).resolves.not.toThrow();
+
+        expect(mockLoadCredentials).not.toHaveBeenCalled();
+      });
+
+      it('should throw error if secret load fails with exception', async () => {
+        mockLoadCredentials.mockRejectedValue(new Error('Network error'));
+
+        await expect(
+          initializeLambda({
+            secrets: [
+              {
+                secretArn: 'my-secret',
+                requiredEnvVars: ['DB_HOST'],
+              },
+            ],
+          })
+        ).rejects.toThrow('Network error');
+      });
+
+      it('should skip initialization on subsequent calls in multi-secret mode', async () => {
+        const mockCredentials = { DB_HOST: 'localhost' };
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        // First initialization
+        await initializeLambda({
+          secrets: [
+            {
+              secretArn: 'my-secret',
+              requiredEnvVars: ['DB_HOST'],
+            },
+          ],
+        });
+
+        // Second initialization
+        await initializeLambda({
+          secrets: [
+            {
+              secretArn: 'my-secret',
+              requiredEnvVars: ['DB_HOST'],
+            },
+          ],
+        });
+
+        expect(mockLoadCredentials).toHaveBeenCalledTimes(1);
+        expect(consoleLogSpy).toHaveBeenCalledWith('⚡ Lambda already initialized, skipping');
+      });
+
+      it('should handle multi-secret mode with no required vars', async () => {
+        const mockCredentials = {};
+
+        mockLoadCredentials.mockResolvedValue(mockCredentials);
+
+        await expect(
+          initializeLambda({
+            secrets: [
+              {
+                secretArn: 'my-secret',
+                requiredEnvVars: [],
+              },
+            ],
+          })
+        ).resolves.not.toThrow();
+      });
+    });
   });
 });

package/utils/lambdaUtils/initialization.ts

@@ -3,13 +3,22 @@ import { loadCredentials } from './secretsManager';
 
 let initialized = false;
 
-export interface InitializeLambdaOptions<T extends Record<string, any> = Record<string, any>> {
+export interface SecretConfig<T extends Record<string, any> = Record<string, any>> {
   /** The ARN or name of the secret in AWS Secrets Manager */
+  secretArn: string;
+  /** List of required environment variable names to load from this secret */
+  requiredEnvVars: (keyof T)[];
+}
+
+export interface InitializeLambdaOptions<T extends Record<string, any> = Record<string, any>> {
+  /** The ARN or name of the secret in AWS Secrets Manager (single secret mode) */
   secretArn?: string;
   /** AWS region for Secrets Manager (defaults to 'us-east-1') */
   region?: string;
-  /** List of required environment variable names to validate and load from secrets */
+  /** List of required environment variable names to validate and load from secrets (single secret mode) */
   requiredEnvVars?: (keyof T)[];
+  /** Array of secrets to load (multi-secret mode) */
+  secrets?: SecretConfig[];
 }
 
 /**
@@ -53,9 +62,10 @@ export function validateEnvConfig(requiredEnvVars: string[]): void {
  * This should be called once at the start of your Lambda handler
  *
  * @param options - Configuration options for initialization
- * @param options.secretArn - The ARN or name of the secret (defaults to process.env.LAMBDA_SECRET_ARN)
+ * @param options.secretArn - The ARN or name of the secret (defaults to process.env.LAMBDA_SECRET) - single secret mode
  * @param options.region - AWS region (defaults to process.env.AWS_REGION or 'us-east-1')
- * @param options.requiredEnvVars - Array of required environment variable names to validate and load from secrets
+ * @param options.requiredEnvVars - Array of required environment variable names to validate and load from secrets - single secret mode
+ * @param options.secrets - Array of secrets to load - multi-secret mode (takes precedence over single secret mode)
  */
 export async function initializeLambda<T extends Record<string, any>>(
   options: InitializeLambdaOptions<T> = {}
@@ -69,13 +79,45 @@ export async function initializeLambda<T extends Record<string, any>>(
 
   try {
     const {
-      secretArn = process.env.LAMBDA_SECRET_NAME || process.env.LAMBDA_SECRET_ARN,
+      secretArn = process.env.LAMBDA_SECRET_NAME || process.env.LAMBDA_SECRET,
       region = process.env.AWS_REGION || 'us-east-1',
-      requiredEnvVars = []
+      requiredEnvVars = [],
+      secrets = []
     } = options;
 
-    // Load credentials from Secrets Manager if secretArn is provided
-    if (secretArn && requiredEnvVars.length > 0) {
+    // Multi-secret mode: Load from multiple secrets
+    if (secrets.length > 0) {
+      console.log(`📦 Loading credentials from ${secrets.length} secrets`);
+
+      const allRequiredVars: string[] = [];
+
+      for (const secretConfig of secrets) {
+        const credentials = await loadCredentials<T>(
+          secretConfig.secretArn,
+          region,
+          secretConfig.requiredEnvVars
+        );
+
+        if (!credentials) {
+          throw new Error(`Failed to load credentials from secret: ${secretConfig.secretArn}`);
+        }
+
+        // Set credentials in process.env
+        for (const [key, value] of Object.entries(credentials)) {
+          process.env[key] = value;
+        }
+
+        // Track all required vars for validation
+        allRequiredVars.push(...secretConfig.requiredEnvVars.map(String));
+      }
+
+      // Validate all required environment variables
+      if (allRequiredVars.length > 0) {
+        validateEnvConfig(allRequiredVars);
+      }
+    }
+    // Single secret mode: Load from one secret (backward compatibility)
+    else if (secretArn && requiredEnvVars.length > 0) {
       const credentials = await loadCredentials<T>(secretArn, region, requiredEnvVars);
       if (!credentials) {
         throw new Error('Failed to load credentials from Secrets Manager');

package/utils/openSearch/openSearchClient.ts

@@ -0,0 +1,43 @@
+import { Client } from "@opensearch-project/opensearch";
+import logger from "../logger";
+
+let openSearchClient: Client | null = null;
+
+export async function initializeOpenSearchClient(): Promise<Client> {
+  if (openSearchClient) {
+    return openSearchClient;
+  }
+  try {
+    openSearchClient = new Client({
+      node: process.env.OPEN_SEARCH_DOMAIN!,
+      auth: {
+        username: process.env.OPEN_SEARCH_USER!,
+        password: process.env.OPEN_SEARCH_PASSWORD!,
+      },
+      ssl: process.env.NODE_ENV === "local" || process.env.OPENSEARCH_SSL === "false"
+        ? null
+        : {
+          rejectUnauthorized: true,
+        },
+      maxRetries: 1,
+      requestTimeout: 5000,
+      pingTimeout: 3000,
+      sniffOnStart: false,
+    });
+
+    await openSearchClient.ping()
+
+    logger("OpenSearch client initialized and ping successful", {
+      level: "info",
+      method: "initializeOpenSearchClient",
+    });
+  } catch (error) {
+    logger("OpenSearch client ping failed", {
+      level: "error",
+      method: "initializeOpenSearchClient",
+      error: error.message,
+    });
+  }
+
+  return openSearchClient;
+}