vikunja-mcp-ng 0.4.0

package/dist/config/secrets.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Docker-secrets-style environment variable resolution
+ *
+ * Sensitive values (API tokens, etc.) must never be written to the
+ * (non-sensitive, Docker-config-mountable) JSON config file. Instead, every
+ * sensitive environment variable gets a `*_FILE` variant that points at a
+ * file whose contents are read at startup — the same convention used by the
+ * official postgres/mysql Docker images (`POSTGRES_PASSWORD_FILE`, etc.).
+ *
+ * Setting both the plain variable and its `_FILE` variant simultaneously is
+ * a hard startup error: silently preferring one over the other would hide a
+ * misconfiguration, so we fail loudly instead.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_ENV_VARS = void 0;
+exports.readSecretEnv = readSecretEnv;
+const fs = __importStar(require("fs"));
+const types_1 = require("./types");
+/**
+ * Environment variables in this codebase that carry sensitive material and
+ * therefore support the `_FILE` secrets convention. Audited against all
+ * `process.env.*` reads under `src/` — see docs/CONFIGURATION.md.
+ */
+exports.SENSITIVE_ENV_VARS = ['VIKUNJA_API_TOKEN'];
+/**
+ * Resolve a sensitive environment variable, honoring the `<name>_FILE`
+ * Docker-secrets convention.
+ *
+ * - Only `<name>` set: returns its value verbatim.
+ * - Only `<name>_FILE` set: reads the referenced file and returns its
+ *   contents with surrounding whitespace trimmed.
+ * - Both set: throws a `ConfigurationError` — this is a hard startup error,
+ *   never a silent precedence choice.
+ * - Neither set: returns `undefined`.
+ */
+function readSecretEnv(varName) {
+    const fileVarName = `${varName}_FILE`;
+    const plainValue = process.env[varName];
+    const filePath = process.env[fileVarName];
+    if (plainValue !== undefined && filePath !== undefined) {
+        throw new types_1.ConfigurationError(varName, `Both ${varName} and ${fileVarName} are set. Set only one — remove ` +
+            `${varName} to read the secret from a file, or remove ${fileVarName} ` +
+            `to use the plain environment variable.`);
+    }
+    if (filePath !== undefined) {
+        try {
+            return fs.readFileSync(filePath, 'utf-8').trim();
+        }
+        catch (error) {
+            throw new types_1.ConfigurationError(varName, `Failed to read secret file for ${fileVarName} (${filePath}): ` +
+                `${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return plainValue;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/config/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBH,sCA2BC;AAlDD,uCAAyB;AACzB,mCAA6C;AAE7C;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,CAAC,mBAAmB,CAAU,CAAC;AAIjE;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,MAAM,WAAW,GAAG,GAAG,OAAO,OAAO,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE1C,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,0BAAkB,CAC1B,OAAO,EACP,QAAQ,OAAO,QAAQ,WAAW,kCAAkC;YAClE,GAAG,OAAO,8CAA8C,WAAW,GAAG;YACtE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAAkB,CAC1B,OAAO,EACP,kCAAkC,WAAW,KAAK,QAAQ,KAAK;gBAC7D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}