env-secrets 0.5.0 → 0.5.2

package/src/index.ts

@@ -18,6 +18,7 @@ import {
 } from './vaults/secretsmanager-admin';
 import {
   asOutputFormat,
+  parseEnvSecrets,
   parseEnvSecretsFile,
   printData,
   parseRecoveryDays,
@@ -58,6 +59,48 @@ const parseSecretJsonObject = (
   return parsed as Record<string, unknown>;
 };
 
+const parseEnvToObject = (
+  value: string
+): Record<string, unknown> | undefined => {
+  try {
+    const parsed = parseEnvSecrets(value);
+    if (parsed.entries.length === 0) {
+      return undefined;
+    }
+
+    return Object.fromEntries(
+      parsed.entries.map((entry) => [entry.key, entry.value])
+    );
+  } catch {
+    return undefined;
+  }
+};
+
+const toSecretJsonObject = (value: string): Record<string, unknown> => {
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (parsed && !Array.isArray(parsed) && typeof parsed === 'object') {
+      return parsed as Record<string, unknown>;
+    }
+
+    if (typeof parsed === 'string') {
+      const envPayload = parseEnvToObject(parsed);
+      if (envPayload) {
+        return envPayload;
+      }
+    }
+
+    return { value: parsed };
+  } catch {
+    const envPayload = parseEnvToObject(value);
+    if (envPayload) {
+      return envPayload;
+    }
+  }
+
+  return { value };
+};
+
 // main program
 program
   .name('env-secrets')
@@ -87,6 +130,9 @@ const awsCommand = program
 
     const secrets = await secretsmanager(options);
     debug(secrets);
+    const envSecrets = Object.fromEntries(
+      Object.entries(secrets).map(([key, value]) => [key, String(value)])
+    );
 
     if (options.output) {
       // Check if file already exists
@@ -99,13 +145,13 @@ const awsCommand = program
       }
 
       // Write secrets to file with 0400 permissions
-      const envContent = objectToExport(secrets);
+      const envContent = objectToExport(envSecrets);
       writeFileSync(options.output, envContent, { mode: 0o400 });
       // eslint-disable-next-line no-console
       console.log(`Secrets written to ${options.output}`);
     } else {
       // Original behavior: merge secrets into environment and run program
-      const env = Object.assign({}, process.env, secrets);
+      const env = Object.assign({}, process.env, envSecrets);
       debug(env);
       if (program && program.length > 0) {
         debug(`${program[0]} ${program.slice(1)}`);
@@ -163,9 +209,10 @@ secretCommand
         );
       }
 
+      const payload = toSecretJsonObject(value);
       const result = await createSecret({
         name: options.name,
-        value,
+        value: JSON.stringify(payload),
         description: options.description,
         kmsKeyId: options.kmsKeyId,
         tags: options.tag,

package/src/vaults/secretsmanager.ts

@@ -5,6 +5,7 @@ import {
 import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
 import Debug from 'debug';
 import { buildAwsClientConfig } from './aws-config';
+import { parseEnvSecrets } from '../cli/helpers';
 
 const debug = Debug('env-secrets:secretsmanager');
 
@@ -19,6 +20,68 @@ interface AWSLikeError {
   message?: string;
 }
 
+type SecretValue = string | number | boolean;
+
+const isSecretValue = (value: unknown): value is SecretValue => {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  );
+};
+
+const asSecretRecord = (value: unknown): Record<string, SecretValue> => {
+  if (!value || Array.isArray(value) || typeof value !== 'object') {
+    return {};
+  }
+
+  return Object.entries(value).reduce<Record<string, SecretValue>>(
+    (result, [key, entryValue]) => {
+      if (isSecretValue(entryValue)) {
+        result[key] = entryValue;
+      }
+
+      return result;
+    },
+    {}
+  );
+};
+
+const parseSecretString = (
+  secretvalue: string
+): Record<string, SecretValue> => {
+  const parseAsEnvRecord = (envSource: string): Record<string, SecretValue> => {
+    try {
+      const parsedEnv = parseEnvSecrets(envSource);
+      if (parsedEnv.entries.length === 0) {
+        return {};
+      }
+
+      return Object.fromEntries(
+        parsedEnv.entries.map((entry) => [entry.key, entry.value])
+      );
+    } catch {
+      return {};
+    }
+  };
+
+  try {
+    const parsedJson = JSON.parse(secretvalue);
+    const parsedRecord = asSecretRecord(parsedJson);
+    if (Object.keys(parsedRecord).length > 0) {
+      return parsedRecord;
+    }
+
+    if (typeof parsedJson === 'string') {
+      return parseAsEnvRecord(parsedJson);
+    }
+
+    return {};
+  } catch {
+    return parseAsEnvRecord(secretvalue);
+  }
+};
+
 const isCredentialsError = (error: unknown): error is AWSLikeError => {
   if (!error || typeof error !== 'object') {
     return false;
@@ -81,13 +144,8 @@ export const secretsmanager = async (options: secretsmanagerType) => {
       const response = await client.send(command);
       const secretvalue = response.SecretString;
 
-      try {
-        if (secretvalue) {
-          return JSON.parse(secretvalue);
-        }
-      } catch (err) {
-        // eslint-disable-next-line no-console
-        console.error(err);
+      if (secretvalue) {
+        return parseSecretString(secretvalue);
       }
     } catch (err: unknown) {
       if (err && typeof err === 'object' && 'name' in err) {