node-server-engine 1.3.2 → 1.3.4

package/dist/utils/secretManager/secretLoader.js

@@ -0,0 +1,64 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.secretCache = exports.initializeSecrets = void 0;
+var _secretManager = require("@google-cloud/secret-manager");
+var _EngineError = require("../../entities/EngineError");
+// Cache to store preloaded secrets
+const secretCache = exports.secretCache = {};
+let secretClient;
+
+/**
+ * Initialize the Secret Manager client and preload secrets.
+ * @param secretEnvVars List of env var names that contain secret paths
+ */
+const initializeSecrets = async secretEnvVars => {
+  if (process.env.NODE_ENV !== 'production') {
+    console.log('Development mode → using local files for secrets');
+    return; // No need to preload anything
+  }
+  try {
+    // Default creds (for GCP runtime)
+    secretClient = new _secretManager.SecretManagerServiceClient();
+    const secretNames = secretEnvVars.filter(name => process.env[name]);
+    if (secretNames.length === 0) {
+      throw new _EngineError.EngineError({
+        message: 'No secret names defined in environment variables'
+      });
+    }
+
+    // Fetch all secrets from GCP Secret Manager
+    for (const name of secretNames) {
+      const secretPath = process.env[name];
+      if (!secretPath) {
+        throw new _EngineError.EngineError({
+          message: `Secret path for ${name} is not defined`
+        });
+      }
+      try {
+        const [version] = await secretClient.accessSecretVersion({
+          name: secretPath
+        });
+        const payload = version.payload?.data?.toString('utf-8');
+        if (!payload) {
+          throw new _EngineError.EngineError({
+            message: `Secret ${name} not found or empty`
+          });
+        }
+        secretCache[name] = payload;
+      } catch (err) {
+        throw new _EngineError.EngineError({
+          message: `Error accessing secret ${name}: ${err.message}`
+        });
+      }
+    }
+  } catch (err) {
+    throw new _EngineError.EngineError({
+      message: `Failed to initialize secrets: ${err.message}`
+    });
+  }
+};
+exports.initializeSecrets = initializeSecrets;
+//# sourceMappingURL=secretLoader.js.map

package/dist/utils/secretManager/secretLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretLoader.js","names":["_secretManager","require","_EngineError","secretCache","exports","secretClient","initializeSecrets","secretEnvVars","process","env","NODE_ENV","console","log","SecretManagerServiceClient","secretNames","filter","name","length","EngineError","message","secretPath","version","accessSecretVersion","payload","data","toString","err"],"sources":["../../../src/utils/secretManager/secretLoader.ts"],"sourcesContent":["import { SecretManagerServiceClient } from '@google-cloud/secret-manager';\nimport { EngineError } from 'entities/EngineError';\n\n// Cache to store preloaded secrets\nexport const secretCache: { [key: string]: string } = {};\nlet secretClient: SecretManagerServiceClient;\n\n/**\n * Initialize the Secret Manager client and preload secrets.\n * @param secretEnvVars List of env var names that contain secret paths\n */\nexport const initializeSecrets = async (\n  secretEnvVars: string[]\n): Promise<void> => {\n  if (process.env.NODE_ENV !== 'production') {\n    console.log('Development mode → using local files for secrets');\n    return; // No need to preload anything\n  }\n\n  try {\n    // Default creds (for GCP runtime)\n    secretClient = new SecretManagerServiceClient();\n\n    const secretNames = secretEnvVars.filter((name) => process.env[name]);\n    if (secretNames.length === 0) {\n      throw new EngineError({\n        message: 'No secret names defined in environment variables'\n      });\n    }\n\n    // Fetch all secrets from GCP Secret Manager\n    for (const name of secretNames) {\n      const secretPath = process.env[name];\n      if (!secretPath) {\n        throw new EngineError({\n          message: `Secret path for ${name} is not defined`\n        });\n      }\n\n      try {\n        const [version] = await secretClient.accessSecretVersion({\n          name: secretPath\n        });\n        const payload = version.payload?.data?.toString('utf-8');\n        if (!payload) {\n          throw new EngineError({\n            message: `Secret ${name} not found or empty`\n          });\n        }\n        secretCache[name] = payload;\n      } catch (err) {\n        throw new EngineError({\n          message: `Error accessing secret ${name}: ${(err as Error).message}`\n        });\n      }\n    }\n  } catch (err) {\n    throw new EngineError({\n      message: `Failed to initialize secrets: ${(err as Error).message}`\n    });\n  }\n};\n"],"mappings":";;;;;;AAAA,IAAAA,cAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AAEA;AACO,MAAME,WAAsC,GAAAC,OAAA,CAAAD,WAAA,GAAG,CAAC,CAAC;AACxD,IAAIE,YAAwC;;AAE5C;AACA;AACA;AACA;AACO,MAAMC,iBAAiB,GAAG,MAC/BC,aAAuB,IACL;EAClB,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;IACzCC,OAAO,CAACC,GAAG,CAAC,kDAAkD,CAAC;IAC/D,OAAO,CAAC;EACV;EAEA,IAAI;IACF;IACAP,YAAY,GAAG,IAAIQ,yCAA0B,CAAC,CAAC;IAE/C,MAAMC,WAAW,GAAGP,aAAa,CAACQ,MAAM,CAAEC,IAAI,IAAKR,OAAO,CAACC,GAAG,CAACO,IAAI,CAAC,CAAC;IACrE,IAAIF,WAAW,CAACG,MAAM,KAAK,CAAC,EAAE;MAC5B,MAAM,IAAIC,wBAAW,CAAC;QACpBC,OAAO,EAAE;MACX,CAAC,CAAC;IACJ;;IAEA;IACA,KAAK,MAAMH,IAAI,IAAIF,WAAW,EAAE;MAC9B,MAAMM,UAAU,GAAGZ,OAAO,CAACC,GAAG,CAACO,IAAI,CAAC;MACpC,IAAI,CAACI,UAAU,EAAE;QACf,MAAM,IAAIF,wBAAW,CAAC;UACpBC,OAAO,EAAE,mBAAmBH,IAAI;QAClC,CAAC,CAAC;MACJ;MAEA,IAAI;QACF,MAAM,CAACK,OAAO,CAAC,GAAG,MAAMhB,YAAY,CAACiB,mBAAmB,CAAC;UACvDN,IAAI,EAAEI;QACR,CAAC,CAAC;QACF,MAAMG,OAAO,GAAGF,OAAO,CAACE,OAAO,EAAEC,IAAI,EAAEC,QAAQ,CAAC,OAAO,CAAC;QACxD,IAAI,CAACF,OAAO,EAAE;UACZ,MAAM,IAAIL,wBAAW,CAAC;YACpBC,OAAO,EAAE,UAAUH,IAAI;UACzB,CAAC,CAAC;QACJ;QACAb,WAAW,CAACa,IAAI,CAAC,GAAGO,OAAO;MAC7B,CAAC,CAAC,OAAOG,GAAG,EAAE;QACZ,MAAM,IAAIR,wBAAW,CAAC;UACpBC,OAAO,EAAE,0BAA0BH,IAAI,KAAMU,GAAG,CAAWP,OAAO;QACpE,CAAC,CAAC;MACJ;IACF;EACF,CAAC,CAAC,OAAOO,GAAG,EAAE;IACZ,MAAM,IAAIR,wBAAW,CAAC;MACpBC,OAAO,EAAE,iCAAkCO,GAAG,CAAWP,OAAO;IAClE,CAAC,CAAC;EACJ;AACF,CAAC;AAACf,OAAA,CAAAE,iBAAA,GAAAA,iBAAA","ignoreList":[]}

package/dist/utils/secretManager/secretResolver.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Retrieve a secret value (production) or file content (development).
+ * @param name The env var name that contains either the secret path (prod) or local file path (dev)
+ */
+export declare const getSecretOrFile: (name: string) => string;

package/dist/utils/secretManager/secretResolver.js

@@ -0,0 +1,42 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getSecretOrFile = void 0;
+var _fs = _interopRequireDefault(require("fs"));
+var _EngineError = require("../../entities/EngineError");
+var _secretLoader = require("./secretLoader");
+/**
+ * Retrieve a secret value (production) or file content (development).
+ * @param name The env var name that contains either the secret path (prod) or local file path (dev)
+ */
+const getSecretOrFile = name => {
+  if (process.env.NODE_ENV === 'production') {
+    const secretValue = _secretLoader.secretCache[name];
+    console.log('SecrrtCj', _secretLoader.secretCache);
+    if (!secretValue) {
+      throw new _EngineError.EngineError({
+        message: `Secret value for ${name} not found in cache`
+      });
+    }
+    return secretValue;
+  } else {
+    const localPath = process.env[name];
+    if (!localPath) {
+      throw new _EngineError.EngineError({
+        message: `Local path for ${name} is not defined`
+      });
+    }
+    try {
+      return _fs.default.readFileSync(localPath, 'utf-8');
+    } catch (err) {
+      throw new _EngineError.EngineError({
+        message: `Error reading local file for ${name}: ${err.message}`
+      });
+    }
+  }
+};
+exports.getSecretOrFile = getSecretOrFile;
+//# sourceMappingURL=secretResolver.js.map

package/dist/utils/secretManager/secretResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretResolver.js","names":["_fs","_interopRequireDefault","require","_EngineError","_secretLoader","getSecretOrFile","name","process","env","NODE_ENV","secretValue","secretCache","console","log","EngineError","message","localPath","fs","readFileSync","err","exports"],"sources":["../../../src/utils/secretManager/secretResolver.ts"],"sourcesContent":["import fs from 'fs';\nimport { EngineError } from 'entities/EngineError';\nimport { secretCache } from './secretLoader';\n\n/**\n * Retrieve a secret value (production) or file content (development).\n * @param name The env var name that contains either the secret path (prod) or local file path (dev)\n */\nexport const getSecretOrFile = (name: string): string => {\n  if (process.env.NODE_ENV === 'production') {\n    const secretValue = secretCache[name];\n    console.log('SecrrtCj', secretCache);\n\n    if (!secretValue) {\n      throw new EngineError({\n        message: `Secret value for ${name} not found in cache`\n      });\n    }\n    return secretValue;\n  } else {\n    const localPath = process.env[name];\n    if (!localPath) {\n      throw new EngineError({\n        message: `Local path for ${name} is not defined`\n      });\n    }\n\n    try {\n      return fs.readFileSync(localPath, 'utf-8');\n    } catch (err) {\n      throw new EngineError({\n        message: `Error reading local file for ${name}: ${(err as Error).message}`\n      });\n    }\n  }\n};\n"],"mappings":";;;;;;;AAAA,IAAAA,GAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAEA;AACA;AACA;AACA;AACO,MAAMG,eAAe,GAAIC,IAAY,IAAa;EACvD,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;IACzC,MAAMC,WAAW,GAAGC,yBAAW,CAACL,IAAI,CAAC;IACrCM,OAAO,CAACC,GAAG,CAAC,UAAU,EAAEF,yBAAW,CAAC;IAEpC,IAAI,CAACD,WAAW,EAAE;MAChB,MAAM,IAAII,wBAAW,CAAC;QACpBC,OAAO,EAAE,oBAAoBT,IAAI;MACnC,CAAC,CAAC;IACJ;IACA,OAAOI,WAAW;EACpB,CAAC,MAAM;IACL,MAAMM,SAAS,GAAGT,OAAO,CAACC,GAAG,CAACF,IAAI,CAAC;IACnC,IAAI,CAACU,SAAS,EAAE;MACd,MAAM,IAAIF,wBAAW,CAAC;QACpBC,OAAO,EAAE,kBAAkBT,IAAI;MACjC,CAAC,CAAC;IACJ;IAEA,IAAI;MACF,OAAOW,WAAE,CAACC,YAAY,CAACF,SAAS,EAAE,OAAO,CAAC;IAC5C,CAAC,CAAC,OAAOG,GAAG,EAAE;MACZ,MAAM,IAAIL,wBAAW,CAAC;QACpBC,OAAO,EAAE,gCAAgCT,IAAI,KAAMa,GAAG,CAAWJ,OAAO;MAC1E,CAAC,CAAC;IACJ;EACF;AACF,CAAC;AAACK,OAAA,CAAAf,eAAA,GAAAA,eAAA","ignoreList":[]}

package/dist/utils/tlsConfig/httpsAgent.js

@@ -5,17 +5,21 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.getHttpsAgent = getHttpsAgent;
-var _fs = _interopRequireDefault(require("fs"));
 var _https = _interopRequireDefault(require("https"));
 var _tlsConfig = require("./tlsConfig.validate");
 var _EngineError = require("../../entities/EngineError");
+var _ = require("./..");
 let httpsAgent;
 function getHttpsAgent() {
   if (httpsAgent) return httpsAgent;
   (0, _tlsConfig.validateTlsConfig)();
-  const key = _fs.default.readFileSync(process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY, 'utf-8');
-  const cert = _fs.default.readFileSync(process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT, 'utf-8');
-  const ca = _fs.default.readFileSync(process.env.TLS_REQUEST_CA ?? process.env.TLS_CA, 'utf-8');
+
+  // Always pass env var *names*, not their values
+  const key = (0, _.getSecretOrFile)(process.env.TLS_REQUEST_KEY ? 'TLS_REQUEST_KEY' : 'TLS_SERVER_KEY');
+  const cert = (0, _.getSecretOrFile)(process.env.TLS_REQUEST_CERT ? 'TLS_REQUEST_CERT' : 'TLS_SERVER_CERT');
+
+  // CA is optional → only load if env var is set
+  const ca = process.env.TLS_REQUEST_CA ? (0, _.getSecretOrFile)('TLS_REQUEST_CA') : process.env.TLS_CA ? (0, _.getSecretOrFile)('TLS_CA') : undefined;
   const passphrase = process.env.TLS_REQUEST_KEY_PASSPHRASE ?? process.env.TLS_SERVER_KEY_PASSPHRASE;
   if (!key || !cert || !ca || !passphrase) {
     throw new _EngineError.EngineError({

package/dist/utils/tlsConfig/httpsAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpsAgent.js","names":["_fs","_interopRequireDefault","require","_https","_tlsConfig","_EngineError","httpsAgent","getHttpsAgent","validateTlsConfig","key","fs","readFileSync","process","env","TLS_REQUEST_KEY","TLS_SERVER_KEY","cert","TLS_REQUEST_CERT","TLS_SERVER_CERT","ca","TLS_REQUEST_CA","TLS_CA","passphrase","TLS_REQUEST_KEY_PASSPHRASE","TLS_SERVER_KEY_PASSPHRASE","EngineError","message","https","Agent"],"sources":["../../../src/utils/tlsConfig/httpsAgent.ts"],"sourcesContent":["import fs from 'fs';\nimport https, { Agent } from 'https';\nimport { validateTlsConfig } from './tlsConfig.validate';\nimport { EngineError } from 'entities/EngineError';\n\nlet httpsAgent: Agent | undefined;\n\nexport function getHttpsAgent(): Agent {\n  if (httpsAgent) return httpsAgent;\n\n  validateTlsConfig();\n\n  const key = fs.readFileSync(\n    process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY!,\n    'utf-8'\n  );\n  const cert = fs.readFileSync(\n    process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT!,\n    'utf-8'\n  );\n  const ca = fs.readFileSync(\n    process.env.TLS_REQUEST_CA ?? process.env.TLS_CA!,\n    'utf-8'\n  );\n  const passphrase =\n    process.env.TLS_REQUEST_KEY_PASSPHRASE ??\n    process.env.TLS_SERVER_KEY_PASSPHRASE;\n\n  if (!key || !cert || !ca || !passphrase) {\n    throw new EngineError({\n      message: 'TLS environment variables are not set correctly'\n    });\n  }\n\n  httpsAgent = new https.Agent({ key, cert, ca, passphrase });\n  return httpsAgent;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,GAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,YAAA,GAAAH,OAAA;AAEA,IAAII,UAA6B;AAE1B,SAASC,aAAaA,CAAA,EAAU;EACrC,IAAID,UAAU,EAAE,OAAOA,UAAU;EAEjC,IAAAE,4BAAiB,EAAC,CAAC;EAEnB,MAAMC,GAAG,GAAGC,WAAE,CAACC,YAAY,CACzBC,OAAO,CAACC,GAAG,CAACC,eAAe,IAAIF,OAAO,CAACC,GAAG,CAACE,cAAe,EAC1D,OACF,CAAC;EACD,MAAMC,IAAI,GAAGN,WAAE,CAACC,YAAY,CAC1BC,OAAO,CAACC,GAAG,CAACI,gBAAgB,IAAIL,OAAO,CAACC,GAAG,CAACK,eAAgB,EAC5D,OACF,CAAC;EACD,MAAMC,EAAE,GAAGT,WAAE,CAACC,YAAY,CACxBC,OAAO,CAACC,GAAG,CAACO,cAAc,IAAIR,OAAO,CAACC,GAAG,CAACQ,MAAO,EACjD,OACF,CAAC;EACD,MAAMC,UAAU,GACdV,OAAO,CAACC,GAAG,CAACU,0BAA0B,IACtCX,OAAO,CAACC,GAAG,CAACW,yBAAyB;EAEvC,IAAI,CAACf,GAAG,IAAI,CAACO,IAAI,IAAI,CAACG,EAAE,IAAI,CAACG,UAAU,EAAE;IACvC,MAAM,IAAIG,wBAAW,CAAC;MACpBC,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEApB,UAAU,GAAG,IAAIqB,cAAK,CAACC,KAAK,CAAC;IAAEnB,GAAG;IAAEO,IAAI;IAAEG,EAAE;IAAEG;EAAW,CAAC,CAAC;EAC3D,OAAOhB,UAAU;AACnB","ignoreList":[]}
+{"version":3,"file":"httpsAgent.js","names":["_https","_interopRequireDefault","require","_tlsConfig","_EngineError","_","httpsAgent","getHttpsAgent","validateTlsConfig","key","getSecretOrFile","process","env","TLS_REQUEST_KEY","cert","TLS_REQUEST_CERT","ca","TLS_REQUEST_CA","TLS_CA","undefined","passphrase","TLS_REQUEST_KEY_PASSPHRASE","TLS_SERVER_KEY_PASSPHRASE","EngineError","message","https","Agent"],"sources":["../../../src/utils/tlsConfig/httpsAgent.ts"],"sourcesContent":["import https, { Agent } from 'https';\nimport { validateTlsConfig } from './tlsConfig.validate';\nimport { EngineError } from 'entities/EngineError';\nimport { getSecretOrFile } from 'utils';\n\nlet httpsAgent: Agent | undefined;\nexport function getHttpsAgent(): Agent {\n  if (httpsAgent) return httpsAgent;\n\n  validateTlsConfig();\n\n  // Always pass env var *names*, not their values\n  const key = getSecretOrFile(\n    process.env.TLS_REQUEST_KEY ? 'TLS_REQUEST_KEY' : 'TLS_SERVER_KEY'\n  );\n\n  const cert = getSecretOrFile(\n    process.env.TLS_REQUEST_CERT ? 'TLS_REQUEST_CERT' : 'TLS_SERVER_CERT'\n  );\n\n  // CA is optional → only load if env var is set\n  const ca = process.env.TLS_REQUEST_CA\n    ? getSecretOrFile('TLS_REQUEST_CA')\n    : process.env.TLS_CA\n      ? getSecretOrFile('TLS_CA')\n      : undefined;\n\n  const passphrase =\n    process.env.TLS_REQUEST_KEY_PASSPHRASE ??\n    process.env.TLS_SERVER_KEY_PASSPHRASE;\n\n  if (!key || !cert || !ca || !passphrase) {\n    throw new EngineError({\n      message: 'TLS environment variables are not set correctly'\n    });\n  }\n\n  httpsAgent = new https.Agent({\n    key,\n    cert,\n    ca,\n    passphrase\n  });\n\n  return httpsAgent;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,CAAA,GAAAH,OAAA;AAEA,IAAII,UAA6B;AAC1B,SAASC,aAAaA,CAAA,EAAU;EACrC,IAAID,UAAU,EAAE,OAAOA,UAAU;EAEjC,IAAAE,4BAAiB,EAAC,CAAC;;EAEnB;EACA,MAAMC,GAAG,GAAG,IAAAC,iBAAe,EACzBC,OAAO,CAACC,GAAG,CAACC,eAAe,GAAG,iBAAiB,GAAG,gBACpD,CAAC;EAED,MAAMC,IAAI,GAAG,IAAAJ,iBAAe,EAC1BC,OAAO,CAACC,GAAG,CAACG,gBAAgB,GAAG,kBAAkB,GAAG,iBACtD,CAAC;;EAED;EACA,MAAMC,EAAE,GAAGL,OAAO,CAACC,GAAG,CAACK,cAAc,GACjC,IAAAP,iBAAe,EAAC,gBAAgB,CAAC,GACjCC,OAAO,CAACC,GAAG,CAACM,MAAM,GAChB,IAAAR,iBAAe,EAAC,QAAQ,CAAC,GACzBS,SAAS;EAEf,MAAMC,UAAU,GACdT,OAAO,CAACC,GAAG,CAACS,0BAA0B,IACtCV,OAAO,CAACC,GAAG,CAACU,yBAAyB;EAEvC,IAAI,CAACb,GAAG,IAAI,CAACK,IAAI,IAAI,CAACE,EAAE,IAAI,CAACI,UAAU,EAAE;IACvC,MAAM,IAAIG,wBAAW,CAAC;MACpBC,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;EAEAlB,UAAU,GAAG,IAAImB,cAAK,CAACC,KAAK,CAAC;IAC3BjB,GAAG;IACHK,IAAI;IACJE,EAAE;IACFI;EACF,CAAC,CAAC;EAEF,OAAOd,UAAU;AACnB","ignoreList":[]}

package/dist/utils/tlsConfig/tlsConfig.d.ts

@@ -3,6 +3,6 @@ import { TlsConfig } from './tlsConfig.types';
 export declare let tlsConfig: undefined | TlsConfig;
 export declare let httpsAgent: undefined | Agent;
 /**
- * Load TLS config by its Environment setting.
+ * Load TLS config by its environment setting (local files or GCP secrets)
  */
 export declare function loadTlsConfig(): void;

package/dist/utils/tlsConfig/tlsConfig.js

@@ -7,26 +7,32 @@ Object.defineProperty(exports, "__esModule", {
 exports.httpsAgent = void 0;
 exports.loadTlsConfig = loadTlsConfig;
 exports.tlsConfig = void 0;
-var _fs = _interopRequireDefault(require("fs"));
 var _https = _interopRequireDefault(require("https"));
 var _tlsConfig = require("./tlsConfig.validate");
 var _EngineError = require("../../entities/EngineError");
+var _ = require("./..");
 let tlsConfig = exports.tlsConfig = void 0;
 let httpsAgent = exports.httpsAgent = void 0;
 
 /**
- * Load TLS config by its Environment setting.
+ * Load TLS config by its environment setting (local files or GCP secrets)
  */
 function loadTlsConfig() {
-  // Check that environment variables are correctly set
   (0, _tlsConfig.validateTlsConfig)();
   exports.tlsConfig = tlsConfig = undefined;
   if (process.env.TLS_REQUEST_KEY || process.env.TLS_SERVER_KEY) {
+    // Fetch TLS secrets using unified utility
+    const key = (0, _.getSecretOrFile)(process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY);
+    const cert = (0, _.getSecretOrFile)(process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT);
+    const ca = (0, _.getSecretOrFile)(process.env.TLS_REQUEST_CA ?? process.env.TLS_CA);
+
+    // Passphrase is read directly from env variables
+    const passphrase = process.env.TLS_REQUEST_KEY_PASSPHRASE ?? process.env.TLS_SERVER_KEY_PASSPHRASE;
     exports.tlsConfig = tlsConfig = {
-      key: _fs.default.readFileSync(process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY, 'utf-8'),
-      cert: _fs.default.readFileSync(process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT, 'utf-8'),
-      ca: _fs.default.readFileSync(process.env.TLS_REQUEST_CA ?? process.env.TLS_CA, 'utf-8'),
-      passphrase: process.env.TLS_REQUEST_KEY_PASSPHRASE ?? process.env.TLS_SERVER_KEY_PASSPHRASE
+      key,
+      cert,
+      ca,
+      passphrase
     };
     exports.httpsAgent = httpsAgent = new _https.default.Agent({
       key: tlsConfig.key,
@@ -35,7 +41,7 @@ function loadTlsConfig() {
       passphrase: tlsConfig.passphrase
     });
   }
-  if (!tlsConfig || !(tlsConfig.ca && tlsConfig.cert && tlsConfig.key)) {
+  if (!tlsConfig || !(tlsConfig.key && tlsConfig.cert && tlsConfig.ca)) {
     throw new _EngineError.EngineError({
       message: 'TLS environment variables are not set correctly'
     });

package/dist/utils/tlsConfig/tlsConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"tlsConfig.js","names":["_fs","_interopRequireDefault","require","_https","_tlsConfig","_EngineError","tlsConfig","exports","httpsAgent","loadTlsConfig","validateTlsConfig","undefined","process","env","TLS_REQUEST_KEY","TLS_SERVER_KEY","key","fs","readFileSync","cert","TLS_REQUEST_CERT","TLS_SERVER_CERT","ca","TLS_REQUEST_CA","TLS_CA","passphrase","TLS_REQUEST_KEY_PASSPHRASE","TLS_SERVER_KEY_PASSPHRASE","https","Agent","EngineError","message"],"sources":["../../../src/utils/tlsConfig/tlsConfig.ts"],"sourcesContent":["import fs from 'fs';\nimport https, { Agent } from 'https';\nimport { TlsConfig } from './tlsConfig.types';\nimport { validateTlsConfig } from './tlsConfig.validate';\nimport { EngineError } from 'entities/EngineError';\n\nexport let tlsConfig: undefined | TlsConfig;\nexport let httpsAgent: undefined | Agent;\n\n/**\n * Load TLS config by its Environment setting.\n */\nexport function loadTlsConfig(): void {\n  // Check that environment variables are correctly set\n  validateTlsConfig();\n  tlsConfig = undefined;\n\n  if (process.env.TLS_REQUEST_KEY || process.env.TLS_SERVER_KEY) {\n    tlsConfig = {\n      key: fs.readFileSync(\n        (process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY) as string,\n        'utf-8'\n      ),\n      cert: fs.readFileSync(\n        (process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT) as string,\n        'utf-8'\n      ),\n      ca: fs.readFileSync(\n        (process.env.TLS_REQUEST_CA ?? process.env.TLS_CA) as string,\n        'utf-8'\n      ),\n      passphrase: (process.env.TLS_REQUEST_KEY_PASSPHRASE ??\n        process.env.TLS_SERVER_KEY_PASSPHRASE) as string\n    } as TlsConfig;\n    httpsAgent = new https.Agent({\n      key: tlsConfig.key,\n      cert: tlsConfig.cert,\n      ca: tlsConfig.ca,\n      passphrase: tlsConfig.passphrase\n    });\n  }\n  if (!tlsConfig || !(tlsConfig.ca && tlsConfig.cert && tlsConfig.key)) {\n    throw new EngineError({\n      message: 'TLS environment variables are not set correctly'\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAAA,IAAAA,GAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,YAAA,GAAAH,OAAA;AAEO,IAAII,SAAgC,GAAAC,OAAA,CAAAD,SAAA;AACpC,IAAIE,UAA6B,GAAAD,OAAA,CAAAC,UAAA;;AAExC;AACA;AACA;AACO,SAASC,aAAaA,CAAA,EAAS;EACpC;EACA,IAAAC,4BAAiB,EAAC,CAAC;EACnBH,OAAA,CAAAD,SAAA,GAAAA,SAAS,GAAGK,SAAS;EAErB,IAAIC,OAAO,CAACC,GAAG,CAACC,eAAe,IAAIF,OAAO,CAACC,GAAG,CAACE,cAAc,EAAE;IAC7DR,OAAA,CAAAD,SAAA,GAAAA,SAAS,GAAG;MACVU,GAAG,EAAEC,WAAE,CAACC,YAAY,CACjBN,OAAO,CAACC,GAAG,CAACC,eAAe,IAAIF,OAAO,CAACC,GAAG,CAACE,cAAc,EAC1D,OACF,CAAC;MACDI,IAAI,EAAEF,WAAE,CAACC,YAAY,CAClBN,OAAO,CAACC,GAAG,CAACO,gBAAgB,IAAIR,OAAO,CAACC,GAAG,CAACQ,eAAe,EAC5D,OACF,CAAC;MACDC,EAAE,EAAEL,WAAE,CAACC,YAAY,CAChBN,OAAO,CAACC,GAAG,CAACU,cAAc,IAAIX,OAAO,CAACC,GAAG,CAACW,MAAM,EACjD,OACF,CAAC;MACDC,UAAU,EAAGb,OAAO,CAACC,GAAG,CAACa,0BAA0B,IACjDd,OAAO,CAACC,GAAG,CAACc;IAChB,CAAc;IACdpB,OAAA,CAAAC,UAAA,GAAAA,UAAU,GAAG,IAAIoB,cAAK,CAACC,KAAK,CAAC;MAC3Bb,GAAG,EAAEV,SAAS,CAACU,GAAG;MAClBG,IAAI,EAAEb,SAAS,CAACa,IAAI;MACpBG,EAAE,EAAEhB,SAAS,CAACgB,EAAE;MAChBG,UAAU,EAAEnB,SAAS,CAACmB;IACxB,CAAC,CAAC;EACJ;EACA,IAAI,CAACnB,SAAS,IAAI,EAAEA,SAAS,CAACgB,EAAE,IAAIhB,SAAS,CAACa,IAAI,IAAIb,SAAS,CAACU,GAAG,CAAC,EAAE;IACpE,MAAM,IAAIc,wBAAW,CAAC;MACpBC,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;AACF","ignoreList":[]}
+{"version":3,"file":"tlsConfig.js","names":["_https","_interopRequireDefault","require","_tlsConfig","_EngineError","_","tlsConfig","exports","httpsAgent","loadTlsConfig","validateTlsConfig","undefined","process","env","TLS_REQUEST_KEY","TLS_SERVER_KEY","key","getSecretOrFile","cert","TLS_REQUEST_CERT","TLS_SERVER_CERT","ca","TLS_REQUEST_CA","TLS_CA","passphrase","TLS_REQUEST_KEY_PASSPHRASE","TLS_SERVER_KEY_PASSPHRASE","https","Agent","EngineError","message"],"sources":["../../../src/utils/tlsConfig/tlsConfig.ts"],"sourcesContent":["import https, { Agent } from 'https';\nimport { TlsConfig } from './tlsConfig.types';\nimport { validateTlsConfig } from './tlsConfig.validate';\nimport { EngineError } from 'entities/EngineError';\nimport { getSecretOrFile } from 'utils';\n\nexport let tlsConfig: undefined | TlsConfig;\nexport let httpsAgent: undefined | Agent;\n\n/**\n * Load TLS config by its environment setting (local files or GCP secrets)\n */\nexport function loadTlsConfig(): void {\n  validateTlsConfig();\n  tlsConfig = undefined;\n\n  if (process.env.TLS_REQUEST_KEY || process.env.TLS_SERVER_KEY) {\n    // Fetch TLS secrets using unified utility\n    const key = getSecretOrFile(\n      process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY!\n    );\n    const cert = getSecretOrFile(\n      process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT!\n    );\n    const ca = getSecretOrFile(\n      process.env.TLS_REQUEST_CA ?? process.env.TLS_CA!\n    );\n\n    // Passphrase is read directly from env variables\n    const passphrase =\n      process.env.TLS_REQUEST_KEY_PASSPHRASE ??\n      process.env.TLS_SERVER_KEY_PASSPHRASE;\n\n    tlsConfig = { key, cert, ca, passphrase } as TlsConfig;\n\n    httpsAgent = new https.Agent({\n      key: tlsConfig.key,\n      cert: tlsConfig.cert,\n      ca: tlsConfig.ca,\n      passphrase: tlsConfig.passphrase\n    });\n  }\n\n  if (!tlsConfig || !(tlsConfig.key && tlsConfig.cert && tlsConfig.ca)) {\n    throw new EngineError({\n      message: 'TLS environment variables are not set correctly'\n    });\n  }\n}\n"],"mappings":";;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,YAAA,GAAAF,OAAA;AACA,IAAAG,CAAA,GAAAH,OAAA;AAEO,IAAII,SAAgC,GAAAC,OAAA,CAAAD,SAAA;AACpC,IAAIE,UAA6B,GAAAD,OAAA,CAAAC,UAAA;;AAExC;AACA;AACA;AACO,SAASC,aAAaA,CAAA,EAAS;EACpC,IAAAC,4BAAiB,EAAC,CAAC;EACnBH,OAAA,CAAAD,SAAA,GAAAA,SAAS,GAAGK,SAAS;EAErB,IAAIC,OAAO,CAACC,GAAG,CAACC,eAAe,IAAIF,OAAO,CAACC,GAAG,CAACE,cAAc,EAAE;IAC7D;IACA,MAAMC,GAAG,GAAG,IAAAC,iBAAe,EACzBL,OAAO,CAACC,GAAG,CAACC,eAAe,IAAIF,OAAO,CAACC,GAAG,CAACE,cAC7C,CAAC;IACD,MAAMG,IAAI,GAAG,IAAAD,iBAAe,EAC1BL,OAAO,CAACC,GAAG,CAACM,gBAAgB,IAAIP,OAAO,CAACC,GAAG,CAACO,eAC9C,CAAC;IACD,MAAMC,EAAE,GAAG,IAAAJ,iBAAe,EACxBL,OAAO,CAACC,GAAG,CAACS,cAAc,IAAIV,OAAO,CAACC,GAAG,CAACU,MAC5C,CAAC;;IAED;IACA,MAAMC,UAAU,GACdZ,OAAO,CAACC,GAAG,CAACY,0BAA0B,IACtCb,OAAO,CAACC,GAAG,CAACa,yBAAyB;IAEvCnB,OAAA,CAAAD,SAAA,GAAAA,SAAS,GAAG;MAAEU,GAAG;MAAEE,IAAI;MAAEG,EAAE;MAAEG;IAAW,CAAc;IAEtDjB,OAAA,CAAAC,UAAA,GAAAA,UAAU,GAAG,IAAImB,cAAK,CAACC,KAAK,CAAC;MAC3BZ,GAAG,EAAEV,SAAS,CAACU,GAAG;MAClBE,IAAI,EAAEZ,SAAS,CAACY,IAAI;MACpBG,EAAE,EAAEf,SAAS,CAACe,EAAE;MAChBG,UAAU,EAAElB,SAAS,CAACkB;IACxB,CAAC,CAAC;EACJ;EAEA,IAAI,CAAClB,SAAS,IAAI,EAAEA,SAAS,CAACU,GAAG,IAAIV,SAAS,CAACY,IAAI,IAAIZ,SAAS,CAACe,EAAE,CAAC,EAAE;IACpE,MAAM,IAAIQ,wBAAW,CAAC;MACpBC,OAAO,EAAE;IACX,CAAC,CAAC;EACJ;AACF","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-server-engine",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "Framework used to develop backend services. This package ships with a lot of features to standardize the creation of services, letting you focus on the business logic.",
   "main": "dist/index.js",
   "scripts": {
@@ -41,6 +41,7 @@
     "@babel/runtime": "^7.26.0",
     "@elastic/elasticsearch": "^8.17.0",
     "@google-cloud/pubsub": "^4.9.0",
+    "@google-cloud/secret-manager": "^6.1.0",
     "@google-cloud/storage": "^7.14.0",
     "@google/generative-ai": "^0.21.0",
     "ajv": "^8.17.1",

package/src/entities/Server/Server.ts

@@ -1,8 +1,6 @@
-import fs from 'fs';
 import http from 'http';
 import https from 'https';
 import { AddressInfo } from 'net';
-import path from 'path';
 import { setTimeout as setTimeoutPromise } from 'timers/promises';
 import { ValidatorSpec } from 'envalid';
 import express, { Application } from 'express';
@@ -203,8 +201,8 @@ export class Server {
 
     this.handleSignal();
 
-    // Watch TSL config files changing
-    this.watchTlsCaFileChange();
+    // Load TSL config files
+    this.loadTls();
   }
 
   /** Graceful shutdown */
@@ -344,27 +342,11 @@ export class Server {
     );
   }
 
-  /** Watch the TLS certificate change event */
-  private watchTlsCaFileChange(): void {
-    [
-      'TLS_REQUEST_KEY',
-      'TLS_REQUEST_CERT',
-      'TLS_REQUEST_CA',
-      'TLS_SERVER_KEY',
-      'TLS_SERVER_CERT',
-      'TLS_CA'
-    ].forEach((key) => {
-      const file = process.env[key];
-      if (file)
-        fs.watch(path.resolve(file), (event) => {
-          if (event !== 'change') return;
-          reportInfo(`Reloading TLS config [${file} changed]`);
-          loadTlsConfig();
-          (this.httpServer as https.Server).setSecureContext(
-            tlsConfig as TlsConfig
-          );
-        });
-    });
+  /** Load TLS Config */
+  private loadTls(): void {
+    reportInfo(`Loading TLS config`);
+    loadTlsConfig();
+    (this.httpServer as https.Server).setSecureContext(tlsConfig as TlsConfig);
   }
 
   /** Executes a recurring job */

package/src/middleware/userResolver/userResolver.ts

@@ -1,6 +1,7 @@
 import { Request, Response, NextFunction } from 'express';
 import { EngineError } from 'entities/EngineError';
 import { reportDebug } from 'utils';
+import { tlsRequest } from 'utils/tlsRequest';
 
 const namespace = 'engine:middleware:userResolver';
 
@@ -15,7 +16,7 @@ export async function userResolver(
     throw new EngineError({
       message: 'Could not resolve user as the request is missing his ID'
     });
-  const user = { user: 'ram', id };
+  const user = await getUserById(id);
   if (!user)
     throw new EngineError({
       message: 'Could not resolve user as it could not be fetched',
@@ -33,3 +34,20 @@ export async function userResolver(
 
   next();
 }
+
+/**
+ * Call the GET /user/{id} endpoint using TLS
+ */
+export async function getUserById(userId: number): Promise<unknown> {
+  const userServiceUrl = process.env.USER_SERVICE_URL;
+  if (!userServiceUrl) {
+    throw new Error('USER_SERVICE_URL is not defined in environment variables');
+  }
+
+  const response = await tlsRequest<unknown>({
+    method: 'GET',
+    url: `${userServiceUrl}/${userId}`
+  });
+
+  return response.data;
+}

package/src/utils/createHttpServer/createHttpServer.ts

@@ -1,4 +1,3 @@
-import fs from 'fs';
 import { createServer, RequestListener, Server } from 'http';
 import {
   createServer as createSecureServer,
@@ -6,23 +5,29 @@ import {
 } from 'https';
 import { Application } from 'express';
 import { validateHttpEnvironment } from './createHttpServer.validate';
+import { getSecretOrFile } from 'utils';
 
-/** Create and configure an http/https server */
-export function createHttpServer(
+/**
+ * Create and configure an HTTP/HTTPS server.
+ * Supports local files in dev and GCP secrets in prod.
+ */
+export const createHttpServer = (
   handler?: Application | RequestListener
-): Server | SecureServer {
-  // Validate the environment variables
+): Server | SecureServer => {
   validateHttpEnvironment();
-  // Create a https server if env var are specified
+
   if (process.env.TLS_SERVER_KEY && process.env.TLS_SERVER_CERT) {
+    const key = getSecretOrFile('TLS_SERVER_KEY');
+    const cert = getSecretOrFile('TLS_SERVER_CERT');
+    const ca = process.env.TLS_CA ? getSecretOrFile('TLS_CA') : undefined;
+    const passphrase = process.env.TLS_SERVER_KEY_PASSPHRASE;
+
     return createSecureServer(
       {
-        key: fs.readFileSync(process.env.TLS_SERVER_KEY),
-        passphrase: process.env.TLS_SERVER_KEY_PASSPHRASE,
-        cert: fs.readFileSync(process.env.TLS_SERVER_CERT),
-        ca: process.env.TLS_CA
-          ? fs.readFileSync(process.env.TLS_CA)
-          : undefined,
+        key,
+        cert,
+        ca,
+        passphrase,
         requestCert: true,
         rejectUnauthorized: false
       },
@@ -31,4 +36,4 @@ export function createHttpServer(
   } else {
     return createServer(handler);
   }
-}
+};

package/src/utils/index.ts

@@ -23,5 +23,7 @@ export * from './sendEmail';
 // String manipulation
 export * from './trimPathSlash';
 
+export * from './secretManager';
+
 // File Upload
 export * from './geminiFileUpload';

package/src/utils/jwt/jwt.ts

@@ -6,7 +6,6 @@ import {
   VerifyOptions,
   sign
 } from 'jsonwebtoken';
-import fs from 'fs';
 import { UserTokenPayload } from './jwt.types';
 import { TokenIssuer } from 'const';
 import { EngineError } from 'entities/EngineError';
@@ -15,6 +14,7 @@ import { WebError } from 'entities/WebError';
 import { assertEnvironment } from 'utils/checkEnvironment';
 import { envAssert } from 'utils/envAssert';
 import { reportDebug } from 'utils/report';
+import { getSecretOrFile } from 'utils';
 
 export let keySet: KeySet | undefined;
 
@@ -125,7 +125,8 @@ export async function jwtVerify(
   }
   assertEnvironment({
     ACCESS_TOKEN_AUDIENCE: envAssert.isString(),
-    ACCESS_TOKEN_ISSUER: envAssert.isString()
+    ACCESS_TOKEN_ISSUER: envAssert.isString(),
+    ACCESS_TOKEN_EXPIRATION_TIME: envAssert.isString()
   });
   let options: VerifyOptions | undefined;
 
@@ -165,16 +166,16 @@ export async function jwtVerify(
 export function generateJwtToken(user: unknown) {
   const signOptions = {
     algorithm: 'ES256' as const, // or 'ES256' as Algorithm
-    expiresIn: '1h',
+    expiresIn: process.env.ACCESS_TOKEN_EXPIRATION_TIME
+      ? parseInt(process.env.ACCESS_TOKEN_EXPIRATION_TIME, 10)
+      : undefined,
     issuer: process.env.ACCESS_TOKEN_ISSUER,
     audience: process.env.ACCESS_TOKEN_AUDIENCE,
     keyid: Object.keys(keySet?.getKeys() ?? {})[0]
   };
 
-  const privateKey = fs.readFileSync(
-    process.env.PRIVATE_KEY_PATH ?? 'keys/private-key.pem',
-    'utf8'
-  );
+  const privateKey = getSecretOrFile('PRIVATE_KEY_PATH');
+
   const token = sign({ user }, privateKey, signOptions);
 
   return token;

package/src/utils/secretManager/index.ts

@@ -0,0 +1,2 @@
+export * from './secretResolver';
+export * from './secretLoader';

package/src/utils/secretManager/secretLoader.ts

@@ -0,0 +1,62 @@
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager';
+import { EngineError } from 'entities/EngineError';
+
+// Cache to store preloaded secrets
+export const secretCache: { [key: string]: string } = {};
+let secretClient: SecretManagerServiceClient;
+
+/**
+ * Initialize the Secret Manager client and preload secrets.
+ * @param secretEnvVars List of env var names that contain secret paths
+ */
+export const initializeSecrets = async (
+  secretEnvVars: string[]
+): Promise<void> => {
+  if (process.env.NODE_ENV !== 'production') {
+    console.log('Development mode → using local files for secrets');
+    return; // No need to preload anything
+  }
+
+  try {
+    // Default creds (for GCP runtime)
+    secretClient = new SecretManagerServiceClient();
+
+    const secretNames = secretEnvVars.filter((name) => process.env[name]);
+    if (secretNames.length === 0) {
+      throw new EngineError({
+        message: 'No secret names defined in environment variables'
+      });
+    }
+
+    // Fetch all secrets from GCP Secret Manager
+    for (const name of secretNames) {
+      const secretPath = process.env[name];
+      if (!secretPath) {
+        throw new EngineError({
+          message: `Secret path for ${name} is not defined`
+        });
+      }
+
+      try {
+        const [version] = await secretClient.accessSecretVersion({
+          name: secretPath
+        });
+        const payload = version.payload?.data?.toString('utf-8');
+        if (!payload) {
+          throw new EngineError({
+            message: `Secret ${name} not found or empty`
+          });
+        }
+        secretCache[name] = payload;
+      } catch (err) {
+        throw new EngineError({
+          message: `Error accessing secret ${name}: ${(err as Error).message}`
+        });
+      }
+    }
+  } catch (err) {
+    throw new EngineError({
+      message: `Failed to initialize secrets: ${(err as Error).message}`
+    });
+  }
+};

package/src/utils/secretManager/secretResolver.ts

@@ -0,0 +1,36 @@
+import fs from 'fs';
+import { EngineError } from 'entities/EngineError';
+import { secretCache } from './secretLoader';
+
+/**
+ * Retrieve a secret value (production) or file content (development).
+ * @param name The env var name that contains either the secret path (prod) or local file path (dev)
+ */
+export const getSecretOrFile = (name: string): string => {
+  if (process.env.NODE_ENV === 'production') {
+    const secretValue = secretCache[name];
+    console.log('SecrrtCj', secretCache);
+
+    if (!secretValue) {
+      throw new EngineError({
+        message: `Secret value for ${name} not found in cache`
+      });
+    }
+    return secretValue;
+  } else {
+    const localPath = process.env[name];
+    if (!localPath) {
+      throw new EngineError({
+        message: `Local path for ${name} is not defined`
+      });
+    }
+
+    try {
+      return fs.readFileSync(localPath, 'utf-8');
+    } catch (err) {
+      throw new EngineError({
+        message: `Error reading local file for ${name}: ${(err as Error).message}`
+      });
+    }
+  }
+};

package/src/utils/tlsConfig/httpsAgent.ts

@@ -1,27 +1,30 @@
-import fs from 'fs';
 import https, { Agent } from 'https';
 import { validateTlsConfig } from './tlsConfig.validate';
 import { EngineError } from 'entities/EngineError';
+import { getSecretOrFile } from 'utils';
 
 let httpsAgent: Agent | undefined;
-
 export function getHttpsAgent(): Agent {
   if (httpsAgent) return httpsAgent;
 
   validateTlsConfig();
 
-  const key = fs.readFileSync(
-    process.env.TLS_REQUEST_KEY ?? process.env.TLS_SERVER_KEY!,
-    'utf-8'
-  );
-  const cert = fs.readFileSync(
-    process.env.TLS_REQUEST_CERT ?? process.env.TLS_SERVER_CERT!,
-    'utf-8'
+  // Always pass env var *names*, not their values
+  const key = getSecretOrFile(
+    process.env.TLS_REQUEST_KEY ? 'TLS_REQUEST_KEY' : 'TLS_SERVER_KEY'
   );
-  const ca = fs.readFileSync(
-    process.env.TLS_REQUEST_CA ?? process.env.TLS_CA!,
-    'utf-8'
+
+  const cert = getSecretOrFile(
+    process.env.TLS_REQUEST_CERT ? 'TLS_REQUEST_CERT' : 'TLS_SERVER_CERT'
   );
+
+  // CA is optional → only load if env var is set
+  const ca = process.env.TLS_REQUEST_CA
+    ? getSecretOrFile('TLS_REQUEST_CA')
+    : process.env.TLS_CA
+      ? getSecretOrFile('TLS_CA')
+      : undefined;
+
   const passphrase =
     process.env.TLS_REQUEST_KEY_PASSPHRASE ??
     process.env.TLS_SERVER_KEY_PASSPHRASE;
@@ -32,6 +35,12 @@ export function getHttpsAgent(): Agent {
     });
   }
 
-  httpsAgent = new https.Agent({ key, cert, ca, passphrase });
+  httpsAgent = new https.Agent({
+    key,
+    cert,
+    ca,
+    passphrase
+  });
+
   return httpsAgent;
 }