Merge pull request #1 from qteab/module-setup

feat: initial module setup

Author: rahlenjakob

README.md

@@ -0,0 +1,21 @@
+# @qte/nest-google-secret-manager
+A module for reading Google Secret Manager secrets in Nest.
+
+## Installation
+
+```bash
+$ yarn add @qte/nest-google-secret-manager
+```
+
+## Quick start
+Import and use the module with a list of secrets to preload.
+```ts
+SecretManagerModule.register({
+  secrets: ['project/some-project/secrets/some-secret/versions/latest'],
+})
+```
+
+Use the `SecretManagerService` to get any preloaded secret, or to dynamically load more secrets.
+
+## License
+@qte/nest-google-secret-manager is [MIT licensed](LICENSE).

lib/constants.ts

@@ -0,0 +1,3 @@
+export const SECRET_MANAGER_PRELOADED_DATA_TOKEN = Symbol('SECRET_MANAGER_PRELOADED_DATA_TOKEN')
+export const SECRET_MANAGER_CLIENT_TOKEN = Symbol('SECRET_MANAGER_CLIENT_TOKEN')
+export const SECRET_MANAGER_OPTIONS = Symbol('SECRET_MANAGER_OPTIONS')

lib/exceptions/index.ts

@@ -0,0 +1,2 @@
+export class SecretNotLoadedException extends Error {}
+export class SecretLoadException extends Error {}

lib/index.spec.ts

@@ -1,5 +1,3 @@
-const sum = (...numbers: number[]) => {
-  return numbers.reduce((tot, curr) => tot + curr, 0)
-}
-
-export { sum }
+export { SecretManagerModule } from './secretmanager.module'
+export { SecretManagerService } from './secretmanager.service'
+export * from './exceptions'

lib/index.ts

@@ -0,0 +1,12 @@
+import { InjectionToken, OptionalFactoryDependency } from '@nestjs/common'
+
+export interface SecretManagerOptions {
+  secrets?: string[]
+  keyFile?: string
+}
+
+export interface AsyncSecretManagerOptions extends SecretManagerOptions {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  useFactory?: (...args: any[]) => SecretManagerOptions
+  inject?: (InjectionToken | OptionalFactoryDependency)[] | undefined
+}

lib/interfaces/options.ts

@@ -0,0 +1,116 @@
+import { Test } from '@nestjs/testing'
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager'
+import { SecretLoaderService } from './secretloader.service'
+import { SecretLoadException } from './exceptions'
+import { SECRET_MANAGER_CLIENT_TOKEN } from './constants'
+
+jest.mock('@google-cloud/secret-manager')
+describe('SecretLoaderService', () => {
+  describe('static', () => {
+    it('Can load 1 secret statically', async () => {
+      const client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementationOnce(({ name }) => [
+        {
+          payload: { data: name },
+        },
+      ])
+
+      const secrets = ['project/some-project/secrets/some-secret/versions/latest']
+      const values = await SecretLoaderService.staticLoadSecrets(client, secrets)
+      expect(client.accessSecretVersion).toBeCalledTimes(1)
+      expect(values).toEqual({
+        'project/some-project/secrets/some-secret/versions/latest': 'project/some-project/secrets/some-secret/versions/latest',
+      })
+    })
+
+    it('Can load 0 secrets statically', async () => {
+      const client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementationOnce(({ name }) => [
+        {
+          payload: { data: name },
+        },
+      ])
+
+      const secrets: string[] = []
+      const values = await SecretLoaderService.staticLoadSecrets(client, secrets)
+      expect(client.accessSecretVersion).toBeCalledTimes(0)
+      expect(values).toEqual({})
+    })
+
+    it('Can load 2 secrets statically', async () => {
+      const client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementation(({ name }) => [
+        {
+          payload: { data: name },
+        },
+      ])
+
+      const secrets: string[] = ['project/some-project/secrets/some-secret/versions/latest', 'project/some-project/secrets/some-secret/versions/1']
+      const values = await SecretLoaderService.staticLoadSecrets(client, secrets)
+      expect(client.accessSecretVersion).toBeCalledTimes(2)
+      expect(values).toEqual({
+        'project/some-project/secrets/some-secret/versions/latest': 'project/some-project/secrets/some-secret/versions/latest',
+        'project/some-project/secrets/some-secret/versions/1': 'project/some-project/secrets/some-secret/versions/1',
+      })
+    })
+
+    it('Overrides result object if the same secret is loaded twice', async () => {
+      const client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementation(({ name }) => [
+        {
+          payload: { data: name },
+        },
+      ])
+
+      const secrets: string[] = [
+        'project/some-project/secrets/some-secret/versions/latest',
+        'project/some-project/secrets/some-secret/versions/latest',
+      ]
+      const values = await SecretLoaderService.staticLoadSecrets(client, secrets)
+      expect(client.accessSecretVersion).toBeCalledTimes(2)
+      expect(values).toEqual({
+        'project/some-project/secrets/some-secret/versions/latest': 'project/some-project/secrets/some-secret/versions/latest',
+      })
+    })
+
+    it('Throws an error if secret load fails', async () => {
+      const client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementation(() => {
+        throw new SecretLoadException('Load failed')
+      })
+
+      const secrets: string[] = ['project/some-project/secrets/some-secret/versions/latest']
+      await expect(SecretLoaderService.staticLoadSecrets(client, secrets)).rejects.toThrow(SecretLoadException)
+    })
+  })
+
+  describe('dynamic', () => {
+    let secretLoadService: SecretLoaderService
+    let client: SecretManagerServiceClient
+    beforeEach(async () => {
+      client = new SecretManagerServiceClient()
+      ;(client.accessSecretVersion as jest.Mock).mockImplementation(({ name }) => [
+        {
+          payload: { data: name },
+        },
+      ])
+      const moduleRef = await Test.createTestingModule({
+        providers: [
+          SecretLoaderService,
+          {
+            provide: SECRET_MANAGER_CLIENT_TOKEN,
+            useValue: client,
+          },
+        ],
+      }).compile()
+      secretLoadService = moduleRef.get<SecretLoaderService>(SecretLoaderService)
+    })
+
+    it('Can load a secret dynamically', async () => {
+      const secret = 'project/some-project/secrets/some-secret/versions/latest'
+      const value = await secretLoadService.loadSecret(secret)
+      expect(secret).toEqual(value)
+      expect(client.accessSecretVersion).toHaveBeenCalledTimes(1)
+    })
+  })
+})

lib/secretloader.service.spec.ts

@@ -0,0 +1,47 @@
+import { Injectable, Inject } from '@nestjs/common'
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager'
+import { SECRET_MANAGER_CLIENT_TOKEN } from './constants'
+import { SecretLoadException } from './exceptions'
+
+@Injectable()
+export class SecretLoaderService {
+  private readonly client: SecretManagerServiceClient
+  constructor(@Inject(SECRET_MANAGER_CLIENT_TOKEN) client: SecretManagerServiceClient) {
+    this.client = client
+  }
+
+  public async loadSecret(secret: string) {
+    return SecretLoaderService.staticLoadSecret(this.client, secret)
+  }
+
+  private static async staticLoadSecret(client: SecretManagerServiceClient, secret: string) {
+    try {
+      const secretData = await client.accessSecretVersion({
+        name: secret,
+      })
+      const value = secretData[0].payload?.data?.toString()
+      if (!value) {
+        throw new SecretLoadException('Secret has no value')
+      }
+      return value
+    } catch (e) {
+      if (e instanceof Error) {
+        throw new SecretLoadException(e.message)
+      }
+      throw new SecretLoadException('Unknown error')
+    }
+  }
+
+  public static async staticLoadSecrets(client: SecretManagerServiceClient, secrets: string[]) {
+    const promises = secrets.map((secret) => this.staticLoadSecret(client, secret))
+    const secretValues = await Promise.all(promises)
+
+    const secretObject = secrets.reduce((obj, key, index) => {
+      return {
+        ...obj,
+        [key]: secretValues[index],
+      }
+    }, {})
+    return secretObject
+  }
+}

lib/secretloader.service.ts

@@ -0,0 +1,79 @@
+import { Test } from '@nestjs/testing'
+import { Module, Global } from '@nestjs/common'
+import { SecretManagerModule, SecretManagerService } from './index'
+import { SECRET_MANAGER_CLIENT_TOKEN } from './constants'
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager'
+
+const SECRET_CONFIG_MODULE = 'SECRET_CONFIG_MODULE'
+@Module({
+  providers: [
+    {
+      provide: SECRET_CONFIG_MODULE,
+      useValue: {
+        secrets: ['project/some-project/secrets/some-secret/versions/latest'],
+      },
+    },
+  ],
+  exports: [SECRET_CONFIG_MODULE],
+})
+@Global()
+class ConfigModule {}
+
+jest.mock('@google-cloud/secret-manager')
+describe('SecretManagerModule', () => {
+  let client: SecretManagerServiceClient
+
+  beforeEach(() => {
+    jest.resetAllMocks()
+    client = new SecretManagerServiceClient()
+    ;(client.accessSecretVersion as jest.Mock).mockImplementationOnce(({ name }) => [
+      {
+        payload: { data: name },
+      },
+    ])
+  })
+
+  describe('Static creation', () => {
+    it('Can create a module and load the provided secrets', async () => {
+      const moduleRef = await Test.createTestingModule({
+        imports: [
+          SecretManagerModule.register({
+            secrets: ['project/some-project/secrets/some-secret/versions/latest'],
+          }),
+        ],
+      })
+        .overrideProvider(SECRET_MANAGER_CLIENT_TOKEN)
+        .useValue(client)
+        .compile()
+      const secretManagerService = moduleRef.get<SecretManagerService>(SecretManagerService)
+      expect(secretManagerService.getSecrets()).toEqual({
+        'project/some-project/secrets/some-secret/versions/latest': 'project/some-project/secrets/some-secret/versions/latest',
+      })
+    })
+  })
+
+  describe('Factory creation', () => {
+    it('Can create a module and load the provided secrets', async () => {
+      const moduleRef = await Test.createTestingModule({
+        imports: [
+          SecretManagerModule.register({
+            useFactory: ({ secrets }: { secrets: string[] }) => {
+              return {
+                secrets: secrets,
+              }
+            },
+            inject: [{ token: SECRET_CONFIG_MODULE, optional: false }],
+          }),
+          ConfigModule,
+        ],
+      })
+        .overrideProvider(SECRET_MANAGER_CLIENT_TOKEN)
+        .useValue(client)
+        .compile()
+      const secretManagerService = moduleRef.get<SecretManagerService>(SecretManagerService)
+      expect(secretManagerService.getSecrets()).toEqual({
+        'project/some-project/secrets/some-secret/versions/latest': 'project/some-project/secrets/some-secret/versions/latest',
+      })
+    })
+  })
+})

lib/secretmanager.module.spec.ts

@@ -0,0 +1,46 @@
+import { DynamicModule, Module } from '@nestjs/common'
+import { SECRET_MANAGER_PRELOADED_DATA_TOKEN, SECRET_MANAGER_CLIENT_TOKEN, SECRET_MANAGER_OPTIONS } from './constants'
+import { SecretManagerServiceClient } from '@google-cloud/secret-manager'
+import { AsyncSecretManagerOptions, SecretManagerOptions } from './interfaces/options'
+import { SecretLoaderService } from './secretloader.service'
+import { SecretManagerService } from './secretmanager.service'
+
+@Module({})
+export class SecretManagerModule {
+  static async register(options: AsyncSecretManagerOptions): Promise<DynamicModule> {
+    return {
+      module: SecretManagerModule,
+      global: true,
+      providers: [
+        {
+          provide: SECRET_MANAGER_CLIENT_TOKEN,
+          useFactory: (options: SecretManagerOptions) => {
+            return new SecretManagerServiceClient({ keyFile: options.keyFile })
+          },
+          inject: [SECRET_MANAGER_OPTIONS],
+        },
+        {
+          provide: SECRET_MANAGER_OPTIONS,
+          useFactory: options.useFactory
+            ? options.useFactory
+            : (): SecretManagerOptions => {
+                return {
+                  secrets: options.secrets || [],
+                }
+              },
+          inject: options.inject,
+        },
+        {
+          provide: SECRET_MANAGER_PRELOADED_DATA_TOKEN,
+          useFactory: (client: SecretManagerServiceClient, options: SecretManagerOptions) => {
+            return SecretLoaderService.staticLoadSecrets(client, options.secrets || [])
+          },
+          inject: [SECRET_MANAGER_CLIENT_TOKEN, SECRET_MANAGER_OPTIONS],
+        },
+        SecretLoaderService,
+        SecretManagerService,
+      ],
+      exports: [SecretManagerService],
+    }
+  }
+}