hanzio 1.1.0 → 1.2.0

package/src/secrets/infisical.ts

@@ -1,15 +1,20 @@
 import { z } from 'zod'
-import { createApiClient } from '../api-wrapper'
-import type { SecretEnvironment } from '.'
+import { createApiClient, HttpResponseError } from '../api-wrapper'
+import { withSecretDeadline } from './deadline'
+import { getProcessEnvironment } from './environment'
+import { SecretLoadError } from './errors'
+import { readInfisicalCliToken } from './infisical-cli'
+import { validateInfisicalScope, type InfisicalScope } from './infisical-config'
+import { parseInfisicalSessionToken } from './infisical-session'
 
 export const DEFAULT_INFISICAL_SITE_URL = 'https://eu.infisical.com'
 
-const defaultFetch = globalThis.fetch
+export type InfisicalAuthMode = 'auto' | 'http' | 'cli'
 
-const infisicalAuthResponseSchema = z.object({
-	accessToken: z.string()
-})
+const defaultFetch = globalThis.fetch
 
+// Validate provider responses before exposing any values to a secret set.
+const infisicalAuthResponseSchema = z.object({ accessToken: z.string() })
 const infisicalSecretSchema = z.object({
 	secretKey: z.string(),
 	secretValue: z.string()
@@ -19,84 +24,204 @@ const infisicalSecretsResponseSchema = z.object({
 	secrets: z.array(infisicalSecretSchema)
 })
 
-export async function fetchInfisicalSecrets<SecretKey extends string>({
-	keys,
-	projectId,
-	environment,
-	siteUrl,
-	clientId,
-	clientSecret
-}: {
-	readonly keys: readonly SecretKey[]
-	readonly projectId: string
-	readonly environment: SecretEnvironment
-	readonly siteUrl: string
-	readonly clientId: string
-	readonly clientSecret: string
-}): Promise<Partial<Record<SecretKey, string>>> {
-	const infisical = createInfisicalApiClient(siteUrl)
-	const { data: auth } = await infisical.request('login', {
-		reqBody: {
-			clientId,
-			clientSecret
+export async function fetchInfisicalSecrets<K extends string>(
+	options: InfisicalScope<K> & {
+		readonly clientId: string
+		readonly clientSecret: string
+	}
+): Promise<Partial<Record<K, string>>> {
+	validateInfisicalScope(options)
+
+	return withSecretDeadline(options, async (signal) => {
+		let operation = 'login'
+
+		try {
+			const infisical = createInfisicalApiClient(options.siteUrl)
+			const { data: auth } = await infisical.request('login', {
+				signal,
+				reqBody: {
+					clientId: options.clientId,
+					clientSecret: options.clientSecret
+				}
+			})
+
+			// Authentication and fetching share a deadline. Do not start a second
+			// request if the caller cancelled while authentication was in progress.
+			signal.throwIfAborted()
+			operation = 'listSecrets'
+
+			return await listInfisicalSecrets(infisical, auth.accessToken, {
+				...options,
+				signal
+			})
+		} catch (error) {
+			throwInfisicalHttpError(error, operation, signal)
 		}
 	})
+}
+
+export type LoadInfisicalSecretsFromEnvOptions<K extends string> =
+	InfisicalScope<K> & {
+		readonly clientIdEnvKey: string
+		readonly clientSecretEnvKey: string
+		readonly auth?: InfisicalAuthMode
+		readonly reportSource?: (source: string) => void
+	}
+
+export async function loadInfisicalSecrets<K extends string>(
+	options: LoadInfisicalSecretsFromEnvOptions<K>
+): Promise<Partial<Record<K, string>>> {
+	validateInfisicalScope(options)
+
+	const env = getProcessEnvironment()
+	const clientId = env?.[options.clientIdEnvKey]
+	const clientSecret = env?.[options.clientSecretEnvKey]
+	const mode = options.auth ?? 'auto'
+
+	if (!['auto', 'http', 'cli'].includes(mode)) {
+		throw new SecretLoadError('CONFIGURATION', 'Invalid Infisical auth mode.')
+	}
+
+	// Explicit modes take precedence. Auto mode uses HTTP only when both
+	// credentials exist; a failed HTTP request must not switch accounts.
+	const useHttp =
+		mode === 'http' || (mode === 'auto' && Boolean(clientId && clientSecret))
+
+	if (useHttp) {
+		if (!clientId || !clientSecret) {
+			throw new SecretLoadError(
+				'AUTHENTICATION',
+				'Infisical HTTP authentication requires both client credentials.'
+			)
+		}
+
+		options.reportSource?.('Infisical HTTP')
+
+		return fetchInfisicalSecrets({ ...options, clientId, clientSecret })
+	}
+
+	options.reportSource?.(
+		`Infisical CLI session (organization=${options.organizationId} project=${options.projectId} environment=${options.environment})`
+	)
+
+	return withSecretDeadline(options, (signal) =>
+		fetchInfisicalSessionSecrets({ ...options, signal })
+	)
+}
+
+async function fetchInfisicalSessionSecrets<K extends string>(
+	options: InfisicalScope<K> & { signal: AbortSignal }
+): Promise<Partial<Record<K, string>>> {
+	const { signal } = options
+	let token = await readInfisicalCliToken(options)
+
+	signal.throwIfAborted()
+
+	const session = parseInfisicalSessionToken(token)
+	const infisical = createInfisicalApiClient(options.siteUrl)
+	let operation = 'selectOrganization'
+
+	try {
+		// JWT claims only guide routing; Infisical verifies authentication and access.
+		// An already scoped session needs no exchange (or additional MFA challenge).
+		if (session.organizationId !== options.organizationId) {
+			const { data } = await infisical.request('selectOrganization', {
+				signal,
+				reqHeaders: {
+					Authorization: `Bearer ${token}`,
+					'User-Agent': 'hanzio/secrets'
+				},
+				reqBody: { organizationId: options.organizationId }
+			})
+
+			signal.throwIfAborted()
+
+			if (data.isMfaEnabled) {
+				throw new SecretLoadError(
+					'AUTHENTICATION',
+					'Infisical requires MFA for this organization. Complete infisical login for the target organization and configured domain before loading secrets.',
+					{ operation }
+				)
+			}
+
+			const scopedSession = parseInfisicalSessionToken(data.token)
+
+			if (scopedSession.organizationId !== options.organizationId) {
+				throw new SecretLoadError(
+					'AUTHENTICATION',
+					'Infisical returned a session for a different organization.',
+					{ operation }
+				)
+			}
+
+			// Keep the exchanged token local: concurrent sets must never share or
+			// overwrite the CLI's persisted session or another organization's token.
+			token = data.token
+		}
+
+		signal.throwIfAborted()
+		operation = 'listSecrets'
+
+		return await listInfisicalSecrets(infisical, token, options)
+	} catch (error) {
+		throwInfisicalHttpError(error, operation, signal)
+	}
+}
+
+async function listInfisicalSecrets<K extends string>(
+	infisical: ReturnType<typeof createInfisicalApiClient>,
+	token: string,
+	options: InfisicalScope<K> & { signal: AbortSignal }
+): Promise<Partial<Record<K, string>>> {
 	const { data } = await infisical.request('listSecrets', {
-		reqHeaders: {
-			Authorization: `Bearer ${auth.accessToken}`
-		},
+		signal: options.signal,
+		reqHeaders: { Authorization: `Bearer ${token}` },
 		reqQuery: {
-			environment,
-			projectId,
-			secretPath: '/',
+			environment: options.environment,
+			projectId: options.projectId,
+			secretPath: options.secretPath ?? '/',
 			viewSecretValue: true,
 			expandSecretReferences: true,
 			includeImports: true
 		}
 	})
 
-	const wantedKeys = new Set<string>(keys)
+	// Infisical lists the folder, but callers only receive their requested keys.
+	const wantedKeys = new Set<string>(options.keys)
+
 	return Object.fromEntries(
 		data.secrets
 			.filter((secret) => wantedKeys.has(secret.secretKey))
 			.map((secret) => [secret.secretKey, secret.secretValue])
-	) as Partial<Record<SecretKey, string>>
+	) as Partial<Record<K, string>>
 }
 
-export type LoadInfisicalSecretsFromEnvOptions<SecretKey extends string> = {
-	readonly keys: readonly SecretKey[]
-	readonly projectId: string
-	readonly environment: SecretEnvironment
-	readonly siteUrl: string
-	readonly clientIdEnvKey: string
-	readonly clientSecretEnvKey: string
-}
+function throwInfisicalHttpError(
+	error: unknown,
+	operation: string,
+	signal: AbortSignal
+): never {
+	if (signal.aborted) {
+		throw signal.reason
+	}
 
-export async function loadInfisicalSecrets<SecretKey extends string>({
-	keys,
-	projectId,
-	environment,
-	siteUrl,
-	clientIdEnvKey,
-	clientSecretEnvKey
-}: LoadInfisicalSecretsFromEnvOptions<SecretKey>): Promise<
-	Partial<Record<SecretKey, string>>
-> {
-	const clientId = process.env[clientIdEnvKey]
-	const clientSecret = process.env[clientSecretEnvKey]
-
-	if (!clientId || !clientSecret) {
-		throw new Error('Missing Infisical credentials')
+	if (error instanceof SecretLoadError) {
+		throw error
 	}
 
-	return fetchInfisicalSecrets({
-		keys,
-		projectId,
-		environment,
-		siteUrl,
-		clientId,
-		clientSecret
-	})
+	// API-wrapper errors can retain request bodies and raw responses.
+	// Copy safe metadata only; never preserve the original error as a cause.
+	const status = error instanceof HttpResponseError ? error.status : undefined
+	const guidance =
+		operation === 'selectOrganization' && (status === 401 || status === 403)
+			? ' Run infisical login for the target organization and configured domain, then verify your access.'
+			: ''
+
+	throw new SecretLoadError(
+		'HTTP',
+		`Infisical HTTP ${operation} failed${status ? ` (status ${status})` : ''}.${guidance}`,
+		{ operation, status }
+	)
 }
 
 function createInfisicalApiClient(siteUrl: string) {
@@ -109,6 +234,22 @@ function createInfisicalApiClient(siteUrl: string) {
 		fetch: getFetch(),
 		retries: 1,
 		endpoints: {
+			// Internal endpoint also used by Infisical CLI init. Keep its contract
+			// isolated here so upstream authentication changes have one integration point.
+			selectOrganization: {
+				method: 'POST',
+				path: '/api/v3/auth/select-organization',
+				reqHeadersSchema: z.object({
+					Authorization: z.string(),
+					'User-Agent': z.string()
+				}),
+				reqBodySchema: z.object({ organizationId: z.string() }),
+				resSchema: z.object({
+					token: z.string().min(1),
+					isMfaEnabled: z.boolean().optional()
+				}),
+				reqBodyFormat: 'json'
+			},
 			login: {
 				method: 'POST',
 				path: '/api/v1/auth/universal-auth/login',
@@ -140,5 +281,12 @@ function createInfisicalApiClient(siteUrl: string) {
 }
 
 function getFetch(): typeof fetch {
-	return globalThis.fetch ?? defaultFetch
+	const fetchFn = globalThis.fetch ?? defaultFetch
+
+	// A retry may wake after the overall deadline; stop before issuing fetch.
+	return ((input, init) => {
+		init?.signal?.throwIfAborted()
+
+		return fetchFn(input, init)
+	}) as typeof fetch
 }

package/src/secrets/loaders.ts

@@ -1,67 +1,43 @@
 import { DEFAULT_INFISICAL_SITE_URL, fetchInfisicalSecrets } from './infisical'
-import type { SecretSetLoader, SecretSetLoaderContext } from './index'
+import {
+	validateInfisicalOrganizationId,
+	type InfisicalProjectOptions
+} from './infisical-config'
+import type { SecretSetLoader, SecretSetLoaderContext } from './core'
 
-/**
- * Reads secrets from a Cloudflare Worker `env` bindings object (or any similar
- * `Record`), for Workers where `process.env` is not populated. Pass the same
- * object you get as `env` in your fetch handler, or values you’d read from
- * `import { env } from "cloudflare:workers"` in your Worker bundle — this
- * package does not import that module.
- */
-export function cloudflareWorkerEnvLoader<SecretKey extends string>(
-	workerEnv: Record<string, unknown>
-): SecretSetLoader<SecretKey> {
-	return async (ctx) => {
-		const out: Partial<Record<SecretKey, string>> = {}
-		for (const key of ctx.keys) {
-			const str = workerBindingToString(workerEnv[key])
-			if (str !== undefined) {
-				out[key] = str
-			}
-		}
-		return out
-	}
-}
+export { cloudflareWorkerEnvLoader } from './worker-loader'
 
-function workerBindingToString(value: unknown): string | undefined {
-	if (value === undefined || value === null) {
-		return undefined
-	}
-	if (typeof value === 'string') {
-		return value === '' ? undefined : value
-	}
-	if (
-		typeof value === 'number' ||
-		typeof value === 'boolean' ||
-		typeof value === 'bigint'
-	) {
-		return String(value)
+export function infisicalLoader<SecretKey extends string>(
+	config: InfisicalProjectOptions & {
+		readonly clientId: string
+		readonly clientSecret: string
+		readonly timeoutMs?: number
 	}
-	if (typeof value === 'object') {
-		return JSON.stringify(value)
-	}
-	return String(value)
-}
+): SecretSetLoader<SecretKey> {
+	validateInfisicalOrganizationId(config.organizationId)
 
-export function infisicalLoader<SecretKey extends string>(config: {
-	readonly projectId: string
-	readonly clientId: string
-	readonly clientSecret: string
-	readonly siteUrl?: string
-}): SecretSetLoader<SecretKey> {
-	return async (ctx) =>
+	const loader: SecretSetLoader<SecretKey> = async (ctx) =>
 		fetchInfisicalSecrets({
 			keys: ctx.keys,
 			projectId: config.projectId,
+			organizationId: config.organizationId,
 			environment: ctx.environment,
 			siteUrl: config.siteUrl ?? DEFAULT_INFISICAL_SITE_URL,
 			clientId: config.clientId,
-			clientSecret: config.clientSecret
+			clientSecret: config.clientSecret,
+			secretPath: config.secretPath,
+			timeoutMs: config.timeoutMs ?? ctx.timeoutMs,
+			signal: ctx.signal
 		})
+
+	return Object.assign(loader, { source: 'Infisical HTTP' })
 }
 
 export async function processEnvLoader<SecretKey extends string>(
 	_ctx: SecretSetLoaderContext<SecretKey>
 ): Promise<Partial<Record<SecretKey, string>>> {
+	// The core has already read environment overrides; there is no remote source.
 	return {}
 }
+
+Object.assign(processEnvLoader, { source: 'process.env' })

package/src/secrets/vite.ts

@@ -1,30 +1,59 @@
-import type { SecretSet } from '.'
+import type { SecretSet } from './core'
+import { SecretLoadError } from './errors'
 
 export type ViteSecretSetPlugin = {
 	name: string
-	config: () => {
-		define: Record<string, string>
-	}
+	config: () => { define: Record<string, string> }
+}
+
+export type ViteSecretSetOptions<K extends string> = {
+	/** Explicit acknowledgement that these values may be shipped to browsers. */
+	readonly publicKeys?: readonly K[]
 }
 
-export function getViteDefine<SecretKey extends string>(
-	secretSet: SecretSet<SecretKey>
+export function getViteDefine<K extends string>(
+	secretSet: Pick<SecretSet<K, unknown>, 'secrets'>,
+	options: ViteSecretSetOptions<K> = {}
 ): Record<string, string> {
+	const values = secretSet.secrets()
+	const keys = options.publicKeys ?? (Object.keys(values) as K[])
+
+	// An explicit allowlist is required before exposing non-prefixed values.
+	if (!options.publicKeys && keys.some((key) => !key.startsWith('VITE_'))) {
+		throw new SecretLoadError(
+			'CONFIGURATION',
+			'Vite secret sets must contain only VITE_ keys, or provide an explicit publicKeys list.'
+		)
+	}
+
+	for (const key of keys) {
+		if (!Object.hasOwn(values, key) || !/^[A-Za-z_$][\w$]*$/.test(key)) {
+			throw new SecretLoadError(
+				'CONFIGURATION',
+				'Vite publicKeys must reference configured keys with valid JavaScript identifiers.'
+			)
+		}
+
+		if (['MODE', 'BASE_URL', 'PROD', 'DEV', 'SSR'].includes(key)) {
+			throw new SecretLoadError(
+				'CONFIGURATION',
+				'Vite built-in environment constants cannot be overridden by secrets.'
+			)
+		}
+	}
+
+	// Only selected public values become browser-visible replacements.
 	return Object.fromEntries(
-		Object.entries(secretSet.secrets()).map(([key, value]) => [
-			`import.meta.env.${key}`,
-			JSON.stringify(value)
-		])
+		keys.map((key) => [`import.meta.env.${key}`, JSON.stringify(values[key])])
 	)
 }
 
-export function viteSecretSetPlugin<SecretKey extends string>(
-	secretSet: SecretSet<SecretKey>
+export function viteSecretSetPlugin<K extends string>(
+	secretSet: Pick<SecretSet<K, unknown>, 'secrets'>,
+	options: ViteSecretSetOptions<K> = {}
 ): ViteSecretSetPlugin {
 	return {
 		name: 'hanzio-secret-set',
-		config: () => ({
-			define: getViteDefine(secretSet)
-		})
+		config: () => ({ define: getViteDefine(secretSet, options) })
 	}
 }

package/src/secrets/worker-loader.ts

@@ -0,0 +1,56 @@
+import type { SecretSetLoader } from './core'
+
+/**
+ * Reads secrets from a Cloudflare Worker `env` bindings object (or any similar
+ * `Record`), for Workers where `process.env` is not populated. Pass the same
+ * object you get as `env` in your fetch handler, or values you’d read from
+ * `import { env } from "cloudflare:workers"` in your Worker bundle — this
+ * package does not import that module.
+ */
+export function cloudflareWorkerEnvLoader<SecretKey extends string>(
+	workerEnv: Record<string, unknown>
+): SecretSetLoader<SecretKey> {
+	const loader: SecretSetLoader<SecretKey> = async (ctx) => {
+		// A null prototype lets secret names safely overlap with object properties.
+		const out: Partial<Record<SecretKey, string>> = Object.create(null)
+
+		for (const key of ctx.keys) {
+			const str = workerBindingToString(
+				Object.hasOwn(workerEnv, key) ? workerEnv[key] : undefined
+			)
+
+			if (str !== undefined) {
+				out[key] = str
+			}
+		}
+
+		return out
+	}
+
+	return Object.assign(loader, { source: 'Cloudflare Worker bindings' })
+}
+
+function workerBindingToString(value: unknown): string | undefined {
+	if (value === undefined || value === null) {
+		return undefined
+	}
+
+	if (typeof value === 'string') {
+		return value === '' ? undefined : value
+	}
+
+	if (
+		typeof value === 'number' ||
+		typeof value === 'boolean' ||
+		typeof value === 'bigint'
+	) {
+		return String(value)
+	}
+
+	// JSON bindings remain strings until the optional schema parses them.
+	if (typeof value === 'object') {
+		return JSON.stringify(value)
+	}
+
+	return String(value)
+}

package/src/secrets/worker.ts

@@ -0,0 +1,4 @@
+// Runtime-neutral entry point: no process globals or Infisical CLI dependencies.
+export * from './core'
+export { cloudflareWorkerEnvLoader } from './worker-loader'
+export type { SecretRequestOptions } from './deadline'