@zintrust/core 0.4.17 → 0.4.19

package/src/config/SecretsManager.ts

@@ -1,451 +0,0 @@
-/**
- * Unified Secrets Management Layer
- * Abstracts secrets retrieval across different cloud platforms
- * Supports: AWS Secrets Manager, Parameter Store, Cloudflare KV, Deno env
- */
-
-import { Env } from '@config/env';
-import { Logger } from '@config/logger';
-import type {
-  GetSecretOptions,
-  SecretConfig,
-  SecretsManagerInstance,
-  SetSecretOptions,
-} from '@config/type';
-import { ErrorFactory } from '@exceptions/ZintrustError';
-
-let instance: SecretsManagerInstance | undefined;
-
-function pruneCache(
-  cache: Map<string, { value: string; expiresAt: number }>,
-  maxEntries: number
-): void {
-  if (cache.size <= maxEntries) return;
-
-  const now = Date.now();
-  for (const [key, entry] of cache.entries()) {
-    if (entry.expiresAt <= now) cache.delete(key);
-  }
-
-  // If still large, drop oldest entries (Map preserves insertion order)
-  while (cache.size > maxEntries) {
-    const next = cache.keys().next();
-    if (next.done === true) break;
-    cache.delete(next.value);
-  }
-}
-
-/**
- * Get secret value from appropriate backend
- */
-async function runGetSecret(
-  config: SecretConfig,
-  cache: Map<string, { value: string; expiresAt: number }>,
-  key: string,
-  options?: GetSecretOptions
-): Promise<string> {
-  // Check cache first
-  const cached = cache.get(key);
-  if (cached !== undefined && cached.expiresAt > Date.now()) {
-    return cached.value;
-  }
-
-  // Opportunistic cleanup if cache has grown
-  pruneCache(cache, 500);
-
-  let value: string;
-
-  switch (config.platform) {
-    case 'aws':
-      value = await getFromAWSSecretsManager(key);
-      break;
-    case 'cloudflare':
-      value = await getFromCloudflareKV(config, key);
-      break;
-    case 'deno':
-      value = await getFromDenoEnv(key);
-      break;
-    case 'local':
-    default:
-      value = await getFromEnv(key);
-  }
-
-  // Cache the value
-  const ttl = options?.cacheTtl ?? 3600000; // 1 hour default
-  cache.set(key, {
-    value,
-    expiresAt: Date.now() + ttl,
-  });
-
-  pruneCache(cache, 500);
-
-  return value;
-}
-
-/**
- * Set secret value
- */
-async function runSetSecret(
-  config: SecretConfig,
-  cache: Map<string, { value: string; expiresAt: number }>,
-  key: string,
-  value: string,
-  options?: SetSecretOptions
-): Promise<void> {
-  switch (config.platform) {
-    case 'aws':
-      await setInAWSSecretsManager(key, value, options);
-      break;
-    case 'cloudflare':
-      await setInCloudflareKV(config, key, value, options);
-      break;
-    case 'deno':
-      throw ErrorFactory.createConfigError('Cannot set secrets in Deno environment');
-    case 'local':
-    default:
-      throw ErrorFactory.createConfigError('Cannot set secrets in local environment');
-  }
-
-  // Invalidate cache
-  cache.delete(key);
-}
-
-/**
- * Delete secret
- */
-async function runDeleteSecret(
-  config: SecretConfig,
-  cache: Map<string, { value: string; expiresAt: number }>,
-  key: string
-): Promise<void> {
-  switch (config.platform) {
-    case 'aws':
-      await deleteFromAWSSecretsManager(key);
-      break;
-    case 'cloudflare':
-      await deleteFromCloudflareKV(config, key);
-      break;
-    case 'deno':
-    case 'local':
-    default:
-      throw ErrorFactory.createConfigError('Cannot delete secrets in this environment');
-  }
-
-  // Invalidate cache
-  cache.delete(key);
-}
-
-/**
- * SecretsManager implementation
- * Refactored to Functional Object pattern
- */
-const SecretsManagerImpl = {
-  /**
-   * Create a new secrets manager instance
-   */
-  create(config: SecretConfig): SecretsManagerInstance {
-    const cache: Map<string, { value: string; expiresAt: number }> = new Map();
-
-    return {
-      /**
-       * Get secret value from appropriate backend
-       */
-      async getSecret(key: string, options?: GetSecretOptions): Promise<string> {
-        return runGetSecret(config, cache, key, options);
-      },
-
-      /**
-       * Set secret value
-       */
-      async setSecret(key: string, value: string, options?: SetSecretOptions): Promise<void> {
-        return runSetSecret(config, cache, key, value, options);
-      },
-
-      /**
-       * Delete secret
-       */
-      async deleteSecret(key: string): Promise<void> {
-        return runDeleteSecret(config, cache, key);
-      },
-
-      /**
-       * Rotate secret (trigger new secret generation)
-       */
-      // eslint-disable-next-line @typescript-eslint/require-await
-      async rotateSecret(_key: string): Promise<void> {
-        if (config.platform === 'aws') {
-          // AWS Secrets Manager supports automatic rotation
-          throw ErrorFactory.createConfigError('Secret rotation not implemented');
-        }
-        throw ErrorFactory.createConfigError('Secret rotation not supported on this platform');
-      },
-
-      /**
-       * Get all secrets matching pattern
-       */
-      async listSecrets(pattern?: string): Promise<string[]> {
-        switch (config.platform) {
-          case 'aws':
-            return listFromAWSSecretsManager(pattern);
-          case 'cloudflare':
-            return listFromCloudflareKV(config, pattern);
-          case 'deno':
-          case 'local':
-          default:
-            return [];
-        }
-      },
-
-      /**
-       * Clear cache (useful after rotation)
-       */
-      clearCache(key?: string): void {
-        if (key === undefined) {
-          cache.clear();
-        } else {
-          cache.delete(key);
-        }
-      },
-    };
-  },
-};
-
-/**
- * AWS Secrets Manager integration
- */
-// eslint-disable-next-line @typescript-eslint/require-await
-async function getFromAWSSecretsManager(key: string): Promise<string> {
-  try {
-    Logger.debug(`[AWS] Getting secret: ${key}`);
-    throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
-  } catch (error) {
-    throw ErrorFactory.createTryCatchError(
-      `Failed to retrieve secret from AWS: ${(error as Error).message}`,
-      error
-    );
-  }
-}
-
-// eslint-disable-next-line @typescript-eslint/require-await
-async function setInAWSSecretsManager(
-  key: string,
-  _value: string,
-  _options?: SetSecretOptions
-): Promise<void> {
-  Logger.info(`[AWS] Setting secret: ${key}`);
-  throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
-}
-
-// eslint-disable-next-line @typescript-eslint/require-await
-async function deleteFromAWSSecretsManager(key: string): Promise<void> {
-  Logger.info(`[AWS] Deleting secret: ${key}`);
-  throw ErrorFactory.createConfigError('AWS SDK not available in core - use wrapper module');
-}
-
-// eslint-disable-next-line @typescript-eslint/require-await
-async function listFromAWSSecretsManager(pattern?: string): Promise<string[]> {
-  Logger.info(`[AWS] Listing secrets with pattern: ${pattern ?? '*'}`);
-  return [];
-}
-
-/**
- * Cloudflare KV integration
- */
-async function getFromCloudflareKV(config: SecretConfig, key: string): Promise<string> {
-  if (config.kv === undefined) {
-    throw ErrorFactory.createConfigError('Cloudflare KV namespace not configured');
-  }
-  const value = await config.kv.get(key);
-  if (value === null || value === '') {
-    throw ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key });
-  }
-  return value;
-}
-
-async function setInCloudflareKV(
-  config: SecretConfig,
-  key: string,
-  value: string,
-  options?: SetSecretOptions
-): Promise<void> {
-  if (config.kv === undefined) {
-    throw ErrorFactory.createConfigError('Cloudflare KV namespace not configured');
-  }
-  const ttl = options?.expirationTtl;
-  await config.kv.put(key, value, { expirationTtl: ttl });
-}
-
-async function deleteFromCloudflareKV(config: SecretConfig, key: string): Promise<void> {
-  if (config.kv === undefined) {
-    throw ErrorFactory.createConfigError('Cloudflare KV namespace not configured');
-  }
-  await config.kv.delete(key);
-}
-
-async function listFromCloudflareKV(config: SecretConfig, pattern?: string): Promise<string[]> {
-  if (config.kv === undefined) {
-    throw ErrorFactory.createConfigError('Cloudflare KV namespace not configured');
-  }
-  const result = await config.kv.list({ prefix: pattern });
-  return result.keys.map((k: { name: string }) => k.name);
-}
-
-/**
- * Deno environment integration
- */
-// eslint-disable-next-line @typescript-eslint/require-await
-async function getFromDenoEnv(key: string): Promise<string> {
-  const value = (
-    globalThis as unknown as Record<string, { env?: { get?: (key: string) => string } }>
-  )['Deno']?.env?.get?.(key);
-  if (value === undefined || value === null || value === '') {
-    throw ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key });
-  }
-  return value;
-}
-
-/**
- * Local environment variables (Node.js)
- */
-// eslint-disable-next-line @typescript-eslint/require-await
-async function getFromEnv(key: string): Promise<string> {
-  const value = Env.get(key, '');
-  if (value === undefined || value === null || value === '') {
-    throw ErrorFactory.createNotFoundError(`Secret not found: ${key}`, { key });
-  }
-  return value;
-}
-
-/**
- * SecretsManager - Unified interface for retrieving secrets
- * Sealed namespace for immutability
- */
-export const SecretsManager = Object.freeze({
-  /**
-   * Get or create singleton instance
-   */
-  getInstance(config?: SecretConfig): SecretsManagerInstance {
-    if (instance === undefined && config !== undefined) {
-      instance = SecretsManagerImpl.create(config);
-    }
-    if (instance === undefined) {
-      throw ErrorFactory.createConfigError(
-        'SecretsManager not initialized. Call getInstance(config) first.'
-      );
-    }
-    return instance;
-  },
-
-  /**
-   * Get secret value from appropriate backend
-   */
-  async getSecret(key: string, options?: GetSecretOptions): Promise<string> {
-    return this.getInstance().getSecret(key, options);
-  },
-
-  /**
-   * Set secret value
-   */
-  async setSecret(key: string, value: string, options?: SetSecretOptions): Promise<void> {
-    return this.getInstance().setSecret(key, value, options);
-  },
-
-  /**
-   * Delete secret
-   */
-  async deleteSecret(key: string): Promise<void> {
-    return this.getInstance().deleteSecret(key);
-  },
-
-  /**
-   * Rotate secret (trigger new secret generation)
-   */
-  async rotateSecret(key: string): Promise<void> {
-    return this.getInstance().rotateSecret(key);
-  },
-
-  /**
-   * Get all secrets matching pattern
-   */
-  async listSecrets(pattern?: string): Promise<string[]> {
-    return this.getInstance().listSecrets(pattern);
-  },
-
-  /**
-   * Clear cache (useful after rotation)
-   */
-  clearCache(key?: string): void {
-    this.getInstance().clearCache(key);
-  },
-});
-
-/**
- * Predefined secret keys
- * Sealed namespace for immutability
- */
-export const SECRETS = Object.freeze({
-  // Database credentials
-  DB_USERNAME: 'db/username',
-  // Secret identifier only (not a credential value)
-  DB_PASSWORD: 'db/password', // NOSONAR (typescript:S2068) - secret key name, not hardcoded password
-  DB_HOST: 'db/host',
-  DB_PORT: 'db/port',
-  DB_DATABASE: 'db/database',
-
-  // API keys
-  JWT_SECRET: 'jwt/secret',
-  JWT_REFRESH_SECRET: 'jwt/refresh-secret',
-
-  // Encryption
-  ENCRYPTION_KEY: 'encryption/key',
-  ENCRYPTION_IV: 'encryption/iv',
-
-  // Third-party APIs
-  STRIPE_API_KEY: 'stripe/api-key',
-  SENDGRID_API_KEY: 'sendgrid/api-key',
-  GITHUB_TOKEN: 'github/token',
-
-  // Session/CSRF
-  SESSION_SECRET: 'session/secret',
-  CSRF_SECRET: 'csrf/secret',
-} as const);
-
-/**
- * Helper to get database credentials using secrets manager
- */
-export async function getDatabaseCredentials(): Promise<DatabaseCredentials> {
-  const manager = SecretsManager.getInstance();
-
-  return {
-    username: await manager.getSecret(SECRETS.DB_USERNAME),
-    password: await manager.getSecret(SECRETS.DB_PASSWORD),
-    host: await manager.getSecret(SECRETS.DB_HOST),
-    port: Number.parseInt(await manager.getSecret(SECRETS.DB_PORT), 10),
-    database: await manager.getSecret(SECRETS.DB_DATABASE),
-  };
-}
-
-/**
- * Helper to get JWT secrets
- */
-export async function getJwtSecrets(): Promise<JwtSecrets> {
-  const manager = SecretsManager.getInstance();
-
-  return {
-    secret: await manager.getSecret(SECRETS.JWT_SECRET),
-    refreshSecret: await manager.getSecret(SECRETS.JWT_REFRESH_SECRET),
-  };
-}
-
-export interface DatabaseCredentials {
-  username: string;
-  password: string;
-  host: string;
-  port: number;
-  database: string;
-}
-
-export interface JwtSecrets {
-  secret: string;
-  refreshSecret: string;
-}

package/src/config/StartupConfigValidator.ts

@@ -1,268 +0,0 @@
-import { appConfig } from '@config/app';
-import type { StartupConfigValidationError, StartupConfigValidationResult } from '@config/type';
-import { ErrorFactory } from '@exceptions/ZintrustError';
-
-const isSensitiveKey = (key: string): boolean => {
-  const normalized = key.toLowerCase();
-  return (
-    normalized.includes('password') ||
-    normalized.includes('secret') ||
-    normalized.includes('token') ||
-    normalized.includes('key') ||
-    normalized.includes('authorization')
-  );
-};
-
-const redactValue = (key: string, value: unknown): unknown => {
-  return isSensitiveKey(key) ? '<redacted>' : value;
-};
-
-const pushError = (
-  errors: StartupConfigValidationError[],
-  key: string,
-  value: unknown,
-  message: string
-): void => {
-  errors.push({ key, value: redactValue(key, value), message });
-};
-
-const validateEnum = (
-  errors: StartupConfigValidationError[],
-  key: string,
-  value: string,
-  allowed: readonly string[]
-): void => {
-  if (!allowed.includes(value)) {
-    pushError(errors, key, value, `${key} must be one of: ${allowed.join(', ')}`);
-  }
-};
-
-const validateIntRange = (
-  errors: StartupConfigValidationError[],
-  key: string,
-  value: number,
-  min: number,
-  max: number
-): void => {
-  if (Number.isNaN(value)) {
-    pushError(errors, key, value, `${key} must be a valid integer`);
-    return;
-  }
-
-  if (value < min || value > max) {
-    pushError(errors, key, value, `${key} must be between ${min} and ${max}`);
-  }
-};
-
-const validatePositiveInt = (
-  errors: StartupConfigValidationError[],
-  key: string,
-  value: number
-): void => {
-  if (Number.isNaN(value)) {
-    pushError(errors, key, value, `${key} must be a valid integer`);
-    return;
-  }
-
-  if (value <= 0) {
-    pushError(errors, key, value, `${key} must be greater than 0`);
-  }
-};
-
-type ProcessLike = {
-  env?: Record<string, string | undefined>;
-};
-
-const getProcessLike = (): ProcessLike | undefined => {
-  return typeof process === 'undefined' ? undefined : (process as unknown as ProcessLike);
-};
-
-const getEnvString = (key: string, defaultValue: string): string => {
-  const proc = getProcessLike();
-  const env = proc?.env ?? {};
-  return env[key] ?? defaultValue;
-};
-
-const getEnvOptionalString = (key: string): string | undefined => {
-  const proc = getProcessLike();
-  const env = proc?.env ?? {};
-  const value = env[key];
-  if (typeof value !== 'string') return undefined;
-  const trimmed = value.trim();
-  return trimmed === '' ? undefined : trimmed;
-};
-
-const getEnvBoolLoose = (key: string, defaultValue: boolean): boolean => {
-  const raw = getEnvOptionalString(key);
-  if (raw === undefined) return defaultValue;
-  const normalized = raw.toLowerCase();
-  return normalized === 'true' || normalized === '1' || normalized === 'yes' || normalized === 'on';
-};
-
-const getEnvInt = (key: string, defaultValue: number): number => {
-  const raw = getEnvString(key, String(defaultValue));
-  return Number.parseInt(raw, 10);
-};
-
-type RequireEnvStringOptions = {
-  aliases?: readonly string[];
-  requiredMessage?: string;
-  minLength?: number;
-  minLengthMessage?: string;
-};
-
-const requireEnvString = (
-  errors: StartupConfigValidationError[],
-  key: string,
-  options: RequireEnvStringOptions = {}
-): string | undefined => {
-  const value =
-    getEnvOptionalString(key) ??
-    (options.aliases ?? []).reduce<string | undefined>((found, alias) => {
-      if (found !== undefined) return found;
-      return getEnvOptionalString(alias);
-    }, undefined);
-
-  if (value === undefined) {
-    pushError(errors, key, value, options.requiredMessage ?? `${key} is required`);
-    return undefined;
-  }
-
-  if (options.minLength !== undefined && value.length < options.minLength) {
-    pushError(
-      errors,
-      key,
-      value,
-      options.minLengthMessage ?? `${key} must be at least ${options.minLength} characters`
-    );
-  }
-
-  return value;
-};
-
-const validateSqliteDbFileRequired = (
-  errors: StartupConfigValidationError[],
-  dbConnection: string | undefined
-): void => {
-  // sqlite convenience: accept DB_DATABASE or DB_PATH
-  if ((dbConnection ?? '').toLowerCase() !== 'sqlite') return;
-
-  const dbFile = getEnvOptionalString('DB_DATABASE') ?? getEnvOptionalString('DB_PATH');
-  if (dbFile === undefined) {
-    pushError(errors, 'DB_DATABASE', dbFile, 'DB_DATABASE (or DB_PATH) is required for sqlite');
-  }
-};
-
-const validateStrictRequiredEnv = (errors: StartupConfigValidationError[]): void => {
-  const requireEnv = getEnvBoolLoose('STARTUP_REQUIRE_ENV', false);
-  if (!requireEnv) return;
-
-  requireEnvString(errors, 'NODE_ENV');
-  requireEnvString(errors, 'APP_NAME');
-  requireEnvString(errors, 'HOST');
-
-  const portRaw = requireEnvString(errors, 'PORT', {
-    aliases: ['APP_PORT'],
-    requiredMessage: 'PORT (or APP_PORT) is required',
-  });
-  if (portRaw !== undefined) {
-    const port = Number.parseInt(portRaw, 10);
-    validateIntRange(errors, 'PORT', port, 1, 65535);
-  }
-
-  const dbConnection = requireEnvString(errors, 'DB_CONNECTION');
-
-  requireEnvString(errors, 'APP_KEY', { minLength: 16 });
-  requireEnvString(errors, 'LOG_LEVEL');
-  requireEnvString(errors, 'LOG_CHANNEL');
-
-  validateSqliteDbFileRequired(errors, dbConnection);
-};
-
-const validateNodeEnv = (errors: StartupConfigValidationError[]): void => {
-  const nodeEnv = getEnvString('NODE_ENV', 'development');
-  validateEnum(errors, 'NODE_ENV', nodeEnv, ['development', 'production', 'testing', 'test']);
-};
-
-const validatePort = (errors: StartupConfigValidationError[]): void => {
-  // Port can be provided as PORT or APP_PORT. In non-strict mode we keep defaults.
-  const portFromPort = getEnvOptionalString('PORT');
-  const portFromAppPort = getEnvOptionalString('APP_PORT');
-  const portRaw = portFromPort ?? portFromAppPort;
-
-  if (portRaw === undefined) {
-    const appPort = getEnvInt('APP_PORT', 3000);
-    validateIntRange(errors, 'APP_PORT', appPort, 1, 65535);
-    return;
-  }
-
-  const parsed = Number.parseInt(portRaw, 10);
-  const key = portFromPort === undefined ? 'APP_PORT' : 'PORT';
-  validateIntRange(errors, key, parsed, 1, 65535);
-};
-
-const validateLogging = (errors: StartupConfigValidationError[]): void => {
-  const logFormat = getEnvString('LOG_FORMAT', 'text');
-  validateEnum(errors, 'LOG_FORMAT', logFormat, ['text', 'json']);
-
-  const logLevel = getEnvString('LOG_LEVEL', 'debug');
-  validateEnum(errors, 'LOG_LEVEL', logLevel, ['debug', 'info', 'warn', 'error']);
-
-  // Optional (but validated when provided): LOG_CHANNEL (starter apps often use this)
-  const logChannel = getEnvOptionalString('LOG_CHANNEL');
-  if (logChannel !== undefined) {
-    validateEnum(errors, 'LOG_CHANNEL', logChannel, ['console', 'file', 'all']);
-  }
-};
-
-const validateRotationAndTimeout = (errors: StartupConfigValidationError[]): void => {
-  const logRotationSize = getEnvInt('LOG_ROTATION_SIZE', 10485760);
-  validatePositiveInt(errors, 'LOG_ROTATION_SIZE', logRotationSize);
-
-  const logRotationDays = getEnvInt('LOG_ROTATION_DAYS', 7);
-  validatePositiveInt(errors, 'LOG_ROTATION_DAYS', logRotationDays);
-
-  const startupHealthTimeoutMs = getEnvInt('STARTUP_HEALTH_TIMEOUT_MS', 2500);
-  validatePositiveInt(errors, 'STARTUP_HEALTH_TIMEOUT_MS', startupHealthTimeoutMs);
-};
-
-const validateProductionAppKey = (errors: StartupConfigValidationError[]): void => {
-  if (!appConfig.isProduction()) return;
-
-  const appKey = getEnvString('APP_KEY', '');
-  if (appKey.trim().length < 16) {
-    pushError(
-      errors,
-      'APP_KEY',
-      appKey,
-      'APP_KEY must be set and at least 16 characters in production'
-    );
-  }
-};
-
-export const StartupConfigValidator = Object.freeze({
-  validate(): StartupConfigValidationResult {
-    const errors: StartupConfigValidationError[] = [];
-
-    validateStrictRequiredEnv(errors);
-
-    validateNodeEnv(errors);
-    validatePort(errors);
-    validateLogging(errors);
-    validateRotationAndTimeout(errors);
-    validateProductionAppKey(errors);
-
-    return { valid: errors.length === 0, errors };
-  },
-
-  assertValid(): void {
-    const result = StartupConfigValidator.validate();
-    if (result.valid) return;
-
-    throw ErrorFactory.createConfigError('Invalid startup configuration', {
-      errors: result.errors,
-    });
-  },
-});
-
-export default StartupConfigValidator;